Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Erantra Private Limited (“Erantra”, “we”, “us”), a company incorporated under the laws of India and registered in the State of Karnataka, which operates ImaginePDF (the “Service”), and the customer that uses the Service (“Customer”, “you”). It applies whenever we process Personal Data on your behalf through the Service. If this DPA conflicts with the Terms on the processing of Personal Data, this DPA controls.

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person that we process on your behalf.
• Document Data: the content you submit so that we can generate documents for you, including the values sent with a generation request (template variables and batch rows), and any designs, uploaded assets, and datasets you save in your workspace.
• Data Protection Laws: the laws that apply to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and India’s Digital Personal Data Protection Act, 2023.
• Sub-processor: a third party we engage to process Personal Data on your behalf.
• Security Incident: a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data we process on your behalf.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

2. Roles of the parties

For Personal Data in Document Data, you are the controller (or, where you process it for your own customers, a processor) and Erantra is your processor. You decide the purposes and means of processing. We process Personal Data only on your documented instructions, which are the Terms, this DPA, and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it.

Erantra is a separate controller for account, billing, and usage data, as described in our Privacy Policy.

3. Nature and purpose of processing

We process Personal Data only to provide the Service to you: to render documents (PDF, PNG, JPG) from your designs and the values you submit, to deliver the generated files to you, to store the designs, assets, and datasets you choose to save, and to secure, support, and maintain the Service. We do not sell Personal Data, use it for advertising, or use it to train machine-learning models.

4. Data retention

• Generation request data is not stored. The values you send with a generation request (template variables and batch rows) are used in memory to render the document and are not stored by us once processing completes. They are not written to our databases or to our logs.
• Generated files are deleted within 24 hours. Generated PDFs, images, and batch archives are deleted automatically within 24 hours of creation. Download links expire after one hour. Our storage provider may keep deleted objects in its recovery system for up to 7 further days, after which they are permanently erased.
• Saved content. Designs, uploaded assets, and datasets that you choose to save in your workspace are kept until you delete them or close your account.
• Metadata. For usage, billing, and support we keep a record of each generation: when it ran, which design and workspace it used, who or which API key triggered it, the output format, file size, and status, and an error message if it failed. These records do not contain the submitted values.

5. Confidentiality

We limit access to Personal Data to personnel who need it to provide, secure, and support the Service, and everyone with access is bound by confidentiality obligations.

6. Security

We maintain the technical and organisational measures described in Schedule 2, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. We may update these measures, provided we do not materially lower the overall level of protection. You are responsible for securing your own accounts, API keys, and devices.

7. Security Incidents

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident affecting your Personal Data. The notice will describe, as far as known, the nature of the incident, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed. We will cooperate with you so you can meet your own notification obligations.

8. Sub-processors

You give us general authorisation to engage the Sub-processors listed in Schedule 3. We bind each Sub-processor to data protection obligations that are no less protective than those in this DPA, and we remain responsible for their performance. We will give you at least 30 days’ notice, by email to the email address of your ImaginePDF account, before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, you may terminate the affected part of the Service and receive a pro-rata refund of any prepaid fees for it.

9. Assistance and data subject requests

If we receive a request from a data subject about Document Data, we will forward it to you and will not respond except on your instructions or where required by law. Taking into account the nature of the processing, we will reasonably assist you with data subject requests, data protection impact assessments, and consultations with supervisory authorities.

10. Deletion and return

You can export or delete your saved designs, assets, and datasets at any time from the dashboard. When your account is closed, we delete your Document Data within 30 days, except where the law requires us to keep it. Generation request data is never kept, so there is nothing to return or delete for it.

11. Audits

On request, we will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires. Where that is not sufficient, you may audit our compliance once a year, on at least 30 days’ notice, at your cost, and in a way that does not disrupt the Service or expose other customers’ data.

12. International transfers

Erantra is based in India, and the Service is hosted in the United States (see Schedule 3). Where Personal Data subject to the GDPR is transferred to us, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a processor.
• You are the data exporter and Erantra is the data importer.
• Clause 7 (docking clause) does not apply.
• Clause 9: Option 2 (general written authorisation) applies, with the notice period set out in Section 8 of this DPA.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is the one determined under Clause 13 by reference to the data exporter.
• Clause 17: the SCCs are governed by the law of the EU Member State in which the data exporter is established, or, where that law does not allow third-party beneficiary rights, the law of Ireland.
• Clause 18: disputes are resolved by the courts of that same Member State.
• Annex I is completed by Schedule 1, Annex II by Schedule 2, and Annex III by Schedule 3.

For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies to the SCCs, with the tables completed by the information in this DPA. For transfers from Switzerland, the SCCs apply with the adjustments required by Swiss law. If the SCCs conflict with this DPA, the SCCs prevail.

If we receive a request from a public authority for your Personal Data, we will notify you unless the law prohibits it, challenge the request where we have reasonable grounds to, and disclose only the minimum required.

13. Liability

Each party’s liability under this DPA is subject to the limitation of liability in the Terms, except where Data Protection Laws or the SCCs do not allow liability to be limited.

14. Term and signed copies

This DPA remains in effect for as long as we process Personal Data on your behalf. It takes effect automatically when you accept the Terms, so no signature is needed. If your internal process requires a signed copy, email us and we will send a countersigned version.

15. Contact

Erantra Private Limited, Karnataka, India.
Privacy and data processing questions: support@imaginepdf.com.

Schedule 1: Details of processing

• Data exporter: the Customer, as identified in its ImaginePDF account. Activities: generating documents through the Service.
• Data importer: Erantra Private Limited, Karnataka, India, contact support@imaginepdf.com. Activities: providing the ImaginePDF document generation service.
• Categories of data subjects: individuals whose data the Customer places in its documents, such as the Customer’s customers, suppliers, employees, and contacts.
• Categories of Personal Data: determined by the Customer. Typically names, contact details (email address, phone number, postal address), business and order details, and financial details such as bank account information.
• Sensitive data: none is intended. The Customer should not submit special categories of data unless it has a lawful basis to do so.
• Frequency of transfer: continuous, each time the Customer generates a document.
• Nature and purpose: rendering documents from the Customer’s designs and submitted values, delivering the generated files, and storing content the Customer chooses to save.
• Retention: as set out in Section 4. Generation request data is not stored after processing, generated files are deleted within 24 hours, and saved content is kept until the Customer deletes it.
• Transfers to Sub-processors: for hosting, storage, and the other purposes listed in Schedule 3, for the duration of the Service.

Schedule 2: Technical and organisational measures

• Encryption in transit (TLS) for all traffic to the Service and API.
• Encryption at rest for databases and object storage, provided by Google Cloud.
• Generation request values are processed in memory, are not written to databases or logs, and temporary render files are deleted as soon as each document is produced.
• Automatic deletion of generated files within 24 hours; download links expire after one hour.
• Workspace-scoped API keys, stored only as SHA-256 hashes and revocable at any time.
• Passwords stored only as salted hashes.
• Strict separation of workspaces; every request is authorised against the workspace it targets.
• Production access restricted to authorised personnel on a least-privilege basis.
• Managed cloud infrastructure with provider-level physical security, redundancy, and backups.
• Monitoring, error logging that excludes submitted values, and an incident response process.

Schedule 3: Sub-processors

• Google Cloud (Google LLC): application hosting, document rendering, databases, and file storage. United States.
• Amazon Web Services (Amazon Web Services, Inc.): transactional account emails only. Does not receive Document Data. United States.
• PostHog (PostHog, Inc.): product analytics on the web application. Does not receive generation request data. United States.
• Google Analytics (Google LLC): website traffic analytics. Does not receive Document Data. United States.
• Dodo Payments: payment processing and merchant of record for paid plans. Receives billing data only, not Document Data.