LEGAL

Data Processing Agreement

Last updated: February 24, 2026

This Data Processing Agreement ("DPA") describes the data processing practices of UltraPDF operated at www.useultrapdf.com ("Processor") with respect to personal data processed on behalf of users ("Controller") through our PDF tools and services.

This DPA supplements and forms an integral part of our Terms and Conditions and Privacy Policy. In case of conflict, this DPA takes precedence.

1. Important Notice: Client-Side Processing

UltraPDF processes all files entirely in your browser using client-side JavaScript. No files, documents, or their contents are transmitted to, stored on, or processed by our servers.

Because of this architecture, UltraPDF does not function as a traditional "data processor" under GDPR Article 28, as we never receive or process your file data. This DPA is provided for transparency and to address the limited data processing that does occur (analytics, website hosting).

2. Definitions

  • "Controller" refers to you, the user of our Services, who determines the purposes and means of processing personal data
  • "Processor" refers to UltraPDF
  • "Personal Data" has the meaning given in Article 4(1) of the GDPR
  • "Processing" has the meaning given in Article 4(2) of the GDPR
  • "Sub-processor" refers to any third party engaged by the Processor to process personal data

3. Scope of Processing

3.1 File Processing (No Server-Side Data Processing)

All PDF operations — compression, merging, splitting, and image-to-PDF conversion — are executed locally in the browser. The Processor does not receive, access, store, or transmit any file contents or personal data contained within user files.

3.2 Website Analytics (Limited Processing)

The following limited data processing occurs on our servers or via third-party services:

  • Analytics data: IP address (anonymized), browser type, page views, referral source — processed via Google Analytics
  • Hosting data: Standard server logs — processed via Vercel hosting infrastructure
  • Preference data: Theme settings stored locally in your browser via localStorage

4. Sub-processors

The Processor uses the following sub-processors for the limited data processing described in Section 3.2:

Sub-processorPurposeLocation
Google LLCWebsite analytics (Google Analytics, Google Tag Manager)United States
Vercel Inc.Website hosting and content deliveryUnited States

We will notify users of any changes to sub-processors by updating this page. Each sub-processor is bound by its own data protection obligations.

5. Data Security

The Processor implements the following technical and organizational measures:

  • HTTPS/TLS encryption for all data in transit
  • Client-side-only file processing (no server-side file handling)
  • No persistent storage of user file data
  • Regular security reviews of website infrastructure
  • Access controls for administrative functions

6. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights requests under applicable data protection laws, including the right to access, rectification, erasure, restriction, portability, and objection.

Given that UltraPDF does not store user files or create user accounts, most data subject requests regarding file content are not applicable. For requests regarding analytics data, please contact us at privacy@useultrapdf.com.

7. Data Breach Notification

In the event of a personal data breach affecting data processed under this DPA, the Processor will notify the Controller without undue delay after becoming aware of the breach. The notification will include:

  • Nature of the breach and categories of data affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach
  • Contact point for further information

8. International Data Transfers

Where personal data is transferred to sub-processors located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or the sub-processor's participation in recognized data protection frameworks.

9. Duration and Termination

This DPA remains in effect for as long as you use our Services. Upon cessation of use, since no file data is stored by the Processor, no data deletion or return is required for file contents. Analytics data will be handled in accordance with the retention policies described in our Privacy Policy.

10. Contact

For questions, concerns, or requests related to this DPA, contact us at: privacy@useultrapdf.com