LEGAL

Data Processing Agreement

Last updated: February 24, 2026

This Data Processing Agreement ("DPA") describes the data processing practices of UltraPDF operated at www.useultrapdf.com ("Processor") with respect to personal data processed on behalf of users ("Controller") through our PDF tools and services.

This DPA supplements and forms an integral part of our Terms and Conditions and Privacy Policy. In case of conflict, this DPA takes precedence.

1. How Files Are Processed

UltraPDF sends uploaded files to its processing service over HTTPS so the requested PDF action (compression, merge, split, or image-to-PDF conversion) can be completed.

Uploaded files are automatically deleted from our servers within 1 hour of processing. We do not read, sell, or use file contents for any purpose other than completing the action you requested.

2. Definitions

  • "Controller" refers to you, the user of our Services, who determines the purposes and means of processing personal data
  • "Processor" refers to UltraPDF
  • "Personal Data" has the meaning given in Article 4(1) of the GDPR
  • "Processing" has the meaning given in Article 4(2) of the GDPR
  • "Sub-processor" refers to any third party engaged by the Processor to process personal data

3. Scope of Processing

3.1 File Processing

PDF operations such as compression, merging, splitting, and image-to-PDF conversion require files to be sent to UltraPDF's processing service over an encrypted HTTPS connection. Uploaded files are automatically deleted within 1 hour of processing and are never shared with third parties.

3.2 Website Analytics (Limited Processing)

The following limited data processing occurs on our servers or via third-party services:

  • Analytics data: IP address (anonymized), browser type, page views, referral source — processed via Google Analytics
  • Hosting data: Standard server logs — processed via Vercel hosting infrastructure
  • Preference data: Theme settings stored locally in your browser via localStorage

4. Sub-processors

The Processor uses the following sub-processors for the limited data processing described in Section 3.2:

Sub-processorPurposeLocation
Google LLCWebsite analytics (Google Analytics, Google Tag Manager)United States
Vercel Inc.Website hosting and content deliveryUnited States

We will notify users of any changes to sub-processors by updating this page. Each sub-processor is bound by its own data protection obligations.

5. Data Security

The Processor implements the following technical and organizational measures:

  • HTTPS/TLS encryption for all data in transit
  • Controlled application access for administrative functions
  • Regular security reviews of website infrastructure
  • Automatic deletion of uploaded and processed files within 1 hour of processing

6. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights requests under applicable data protection laws, including the right to access, rectification, erasure, restriction, portability, and objection.

UltraPDF does not require user accounts. Uploaded files are automatically deleted within 1 hour of processing, so no file-level deletion request is needed after that window. For requests regarding analytics data or any other processing details, please contact us at hello@useultrapdf.com.

7. Data Breach Notification

In the event of a personal data breach affecting data processed under this DPA, the Processor will notify the Controller without undue delay after becoming aware of the breach. The notification will include:

  • Nature of the breach and categories of data affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach
  • Contact point for further information

8. International Data Transfers

Where personal data is transferred to sub-processors located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or the sub-processor's participation in recognized data protection frameworks.

9. Duration and Termination

This DPA remains in effect for as long as you use our Services. Analytics data will be handled in accordance with the retention policies described in our Privacy Policy. Uploaded files are automatically deleted within 1 hour of processing; no further retention occurs after that window.

10. Contact

For questions, concerns, or requests related to this DPA, contact us at: hello@useultrapdf.com