LEGAL
Data Processing Agreement
Last updated: February 24, 2026
This Data Processing Agreement ("DPA") describes the data processing practices of UltraPDF operated at www.useultrapdf.com ("Processor") with respect to personal data processed on behalf of users ("Controller") through our PDF tools and services.
This DPA supplements and forms an integral part of our Terms and Conditions and Privacy Policy. In case of conflict, this DPA takes precedence.
1. Important Notice: Processing Transparency
UltraPDF sends uploaded files to its processing service so requested PDF actions can be completed.
The public site is still tightening its documentation around file retention, deletion, and operational handling. Until backend confirmation is complete, this page should be read as a transparency note for currently known processing behavior rather than a final technical specification.
2. Definitions
- "Controller" refers to you, the user of our Services, who determines the purposes and means of processing personal data
- "Processor" refers to UltraPDF
- "Personal Data" has the meaning given in Article 4(1) of the GDPR
- "Processing" has the meaning given in Article 4(2) of the GDPR
- "Sub-processor" refers to any third party engaged by the Processor to process personal data
3. Scope of Processing
3.1 File Processing
PDF operations such as compression, merging, splitting, and image-to-PDF conversion require files to be sent to UltraPDF's processing service. Detailed retention and deletion timing for those uploads still needs backend confirmation.
3.2 Website Analytics (Limited Processing)
The following limited data processing occurs on our servers or via third-party services:
- Analytics data: IP address (anonymized), browser type, page views, referral source — processed via Google Analytics
- Hosting data: Standard server logs — processed via Vercel hosting infrastructure
- Preference data: Theme settings stored locally in your browser via localStorage
4. Sub-processors
The Processor uses the following sub-processors for the limited data processing described in Section 3.2:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google LLC | Website analytics (Google Analytics, Google Tag Manager) | United States |
| Vercel Inc. | Website hosting and content delivery | United States |
We will notify users of any changes to sub-processors by updating this page. Each sub-processor is bound by its own data protection obligations.
5. Data Security
The Processor implements the following technical and organizational measures:
- HTTPS/TLS encryption for all data in transit
- Controlled application access for administrative functions
- Regular security reviews of website infrastructure
- Policy updates when backend-confirmed processing details are available
6. Data Subject Rights
The Processor will assist the Controller in fulfilling data subject rights requests under applicable data protection laws, including the right to access, rectification, erasure, restriction, portability, and objection.
UltraPDF does not require user accounts, and detailed file-retention policy is still being confirmed. For requests regarding analytics data or to ask about current processing details, please contact us at hello@useultrapdf.com.
7. Data Breach Notification
In the event of a personal data breach affecting data processed under this DPA, the Processor will notify the Controller without undue delay after becoming aware of the breach. The notification will include:
- Nature of the breach and categories of data affected
- Likely consequences of the breach
- Measures taken or proposed to address the breach
- Contact point for further information
8. International Data Transfers
Where personal data is transferred to sub-processors located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or the sub-processor's participation in recognized data protection frameworks.
9. Duration and Termination
This DPA remains in effect for as long as you use our Services. Analytics data will be handled in accordance with the retention policies described in our Privacy Policy. File-retention and deletion timing for processed uploads will be updated separately once backend confirmation is complete.
10. Contact
For questions, concerns, or requests related to this DPA, contact us at: hello@useultrapdf.com