Skip to content
pagenull

Data processing agreement

Under Article 28 GDPR. It forms part of the Terms of Service and applies automatically when you use the API to process personal data. A countersigned copy is available on request.

Draft, pending legal review. This is a starting template, not legal advice. Have a lawyer review and complete it before launch. Bracketed items are placeholders.

1. Parties and roles

The customer (“Controller”) and {{OPERATOR_NAME}}, a private individual, {{OPERATOR_ADDRESS}}, who provides pagenull in their own name (“Processor”). The Processor processes Customer Personal Data only to provide the pagenull API and only on the Controller’s documented instructions, which are the API requests the Controller sends and the settings it chooses.

2. Details of processing (Annex I)

Subject matterRendering HTML, URLs and templates into PDF and image files
DurationThe term of the agreement
NatureTransient processing in memory; storage only of templates the Controller saves. Outputs are returned or uploaded to Controller-provided storage, never kept
Data subjectsWhoever appears in the Controller’s documents (e.g. its customers, employees)
Categories of dataDetermined by the Controller; any personal data contained in documents
Special categoriesNot intended. If the Controller sends them, the same no-retention measures apply
RetentionRender inputs and outputs: not retained. Saved templates: until deleted. There is no option to store outputs

3. Processor obligations

  • Process only on documented instructions, and tell the Controller if an instruction appears to breach the GDPR.
  • Ensure everyone with access is bound by confidentiality.
  • Implement the technical and organisational measures in Annex II.
  • Assist the Controller with data subject requests and with Articles 32–36 obligations, taking into account that render data isn’t retained.
  • Notify the Controller of a personal data breach without undue delay and in any case within [48] hours of becoming aware.
  • On termination, delete all Customer Personal Data (account deletion is immediate), unless EU or Member State law requires storage.
  • Make available information needed to demonstrate compliance and allow for audits [scope, notice period and cost — PLACEHOLDER].

4. Sub-processors

The Controller gives general authorisation for the sub-processors listed below and on the sub-processors page. The Processor will give at least 30 days’ notice of changes; the Controller may object on reasonable grounds and terminate if no solution is found. The Processor imposes equivalent data protection obligations on each sub-processor.

  • TBD (not chosen yet; must be an EU company with EU data centres): One EU server for the website, API, renderer and database (Hetzner in Germany or Finland is the plan) (EU (TBD))
  • Creem: Sells the subscription to you as merchant of record: checkout, payment, VAT, invoices, refunds (Estonia (EU))
  • TBD (EU provider): Account and billing emails (EU (TBD))
  • Meta Platforms Ireland Ltd: Measuring Facebook and Instagram ads on marketing pages (Ireland / USA)

Creem, the merchant of record for paid plans, receives no Customer Personal Data from rendering: only the account email and an internal user id needed to sell the subscription. [Confirm with the lawyer whether Creem belongs in this list or only in the privacy policy — PLACEHOLDER.]

5. International transfers

[Processing location: EU/EEA, to be confirmed once hosting is chosen.] Any transfer outside it will rely on an adequacy decision or the Standard Contractual Clauses (Commission Decision 2021/914).

6. Annex II: technical and organisational measures

  • Render inputs and outputs processed in memory only; never written to disk, database or logs.
  • Logging restricted by code to metadata fields; request bodies cannot be logged.
  • Each render in an isolated, fresh browser context; renderer in a separate container without database access.
  • SSRF protection: only public http(s) destinations, checked for the page and all sub-resources.
  • Saved templates encrypted at rest with AES-256-GCM. [Encryption in transit and host disk encryption: confirm on deploy.]
  • API keys stored as SHA-256 hashes; passwords as salted scrypt hashes.
  • Access to production limited to the operator, with MFA [confirm on deploy].
  • Backups: [database backups, encrypted, retained N days, EU region — PLACEHOLDER]. Backups contain no render content.

7. Liability and precedence

[Liability cap, governing law (Bulgaria), and precedence over the Terms where they conflict — PLACEHOLDER for lawyer.]