Enterprise & B2B Customers
This DPA forms part of the Agreement, which consists of the Terms of Use, the Privacy Policy, the Service Level Agreement, and, for enterprise customers, the SaaS Agreement and applicable Order Form(s). In the event of any conflict with respect to data processing obligations, this DPA takes precedence. For a separately executed DPA or additional contractual commitments, contact Support@pdffillr.ai.
Definitions
For the purposes of this DPA, the following terms have the meanings set out below. Capitalized terms not defined here have the meanings given to them in the Agreement or the applicable Privacy Policy.
The Customer, being the natural or legal person who determines the purposes and means of the processing of Personal Data submitted through the Services.
Engineersmind Corp, which processes Personal Data on behalf of the Controller in accordance with this DPA.
The identified or identifiable natural person to whom Personal Data relates.
Any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller in connection with the Services.
Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, data concerning a person's sex life or sexual orientation, financial account data, government-issued identification numbers, or any other category of data treated as sensitive under applicable law.
Has the meaning given to it under applicable Data Protection Law and includes any operation performed on Personal Data.
All applicable laws and regulations relating to privacy and the processing of Personal Data, including without limitation the GDPR (EU) 2016/679, the UK GDPR and Data Protection Act 2018, the CCPA/CPRA, and any other applicable national or state privacy laws, as amended or supplemented from time to time.
Any confirmed unauthorized access, acquisition, disclosure, alteration, or destruction of Personal Data processed under this DPA.
Any third party engaged by the Processor to process Personal Data on behalf of the Controller.
The standard contractual clauses for the transfer of personal data to third countries as approved by the European Commission under Commission Implementing Decision (EU) 2021/914, and/or the equivalent mechanism approved under UK law, as applicable.
Subject Matter, Nature, and Purpose of Processing
2.1 Subject Matter
2.2 Nature of Processing
2.3 Purpose
2.4 Duration
Categories of Data Subjects and Personal Data
3.1 Categories of Data Subjects
3.2 Categories of Personal Data
3.3 Sensitive Personal Data
Obligations of the Controller
The Controller represents, warrants, and agrees that it shall comply with all applicable Data Protection Law in connection with its use of the Services and its instructions to the Processor. Specifically, the Controller shall:
- Ensure that it has a valid legal basis under applicable Data Protection Law to submit Personal Data to the Services and to authorize the Processor to process such Personal Data on its behalf;
- Ensure that it has provided all required notices to, and obtained all required consents from, Data Subjects as necessary under applicable law;
- Ensure that its instructions to the Processor are lawful and do not require the Processor to violate any applicable law;
- Be solely responsible for determining the appropriateness of using the Services for processing the categories of Personal Data it submits, including Sensitive Personal Data.
Obligations of the Processor
The Processor shall:
- Process Personal Data only in accordance with the documented instructions of the Controller, including as set out in this DPA and the Agreement, unless otherwise required by applicable law;
- Ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations;
- Implement and maintain the technical and organizational security measures described in Section 8;
- Assist the Controller in fulfilling its obligations to respond to Data Subject rights requests, as described in Section 9;
- Notify the Controller of any Security Incident in accordance with Section 11;
- Cooperate with and assist the Controller in conducting data protection impact assessments where required under applicable law;
- Make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and cooperate with audits or inspections as set out in Section 13;
- Upon termination or expiry of the Agreement, delete or return Personal Data in accordance with Section 10.
Sub-Processors
6.1 Authorization
6.2 Current Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS Bedrock) | AI processing and cloud infrastructure | United States |
| Anthropic (Claude) | AI model inference and document processing | United States |
| OpenAI | AI model inference and document processing | United States |
| Google Drive | Document storage and file integration | United States |
| Dropbox | Document storage and file integration | United States |
An up-to-date list of Sub-processors is available upon request by contacting Support@pdffillr.ai.
6.3 Changes to Sub-processors
6.4 Sub-processor Obligations
International Data Transfers
7.1 Transfers Outside the EEA/UK
7.2 Standard Contractual Clauses
7.3 Additional Safeguards
A signed copy of the applicable SCCs can be requested by contacting Support@pdffillr.ai.
Technical and Organizational Security Measures
The Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. Such measures include, at a minimum:
- Encryption of Personal Data in transit and at rest using industry-standard protocols;
- Role-based access controls limiting access to Personal Data to authorized personnel on a need-to-know basis;
- Internal data minimization practices consistent with the principle of purpose limitation;
- Regular security monitoring, logging, and audit capabilities;
- Incident response and breach notification procedures;
- Vendor management and sub-processor oversight controls.
The Processor may update or modify these measures from time to time, provided that any such updates do not materially reduce the overall level of protection afforded to Personal Data.
Full details of technical and organizational measures are set out in Annex II. Additional information for enterprise due diligence is available upon request at Support@pdffillr.ai.
Data Subject Rights
9.1 Controller Responsibility
9.2 Processor Assistance
Data Deletion and Return
10.1 During the Term
10.2 Upon Termination
Deletion from active systems will be completed within 30 days of termination. Encrypted backup copies may persist for up to 90 days and will be overwritten in the ordinary course of backup rotation.
Security Incidents and Data Breach Notification
11.1 Notification Obligation
11.2 Content of Notification
11.3 Cooperation
Breach notifications will be sent to the primary account email address. Ensure your contact details are kept current to receive timely notifications.
Confidentiality
The Processor shall ensure that all personnel authorized to process Personal Data on behalf of the Controller are subject to binding confidentiality obligations with respect to that Personal Data, whether by contract or statutory duty. Such obligations shall survive the termination of the relevant person's engagement with the Processor.
Audit Rights and Compliance Cooperation
13.1 Information and Audit
13.2 Costs
13.3 Regulatory Cooperation
Liability and Indemnification
14.1 Processor Liability
14.2 Controller Liability
14.3 Limitation
Term and Termination
This DPA shall remain in effect for the duration of the Agreement. Upon termination or expiry of the Agreement for any reason, this DPA shall automatically terminate, subject to the survival of those provisions that by their nature should survive, including Sections 10, 11, 12, and 14.
Governing Law
This DPA shall be governed by the laws specified in the Agreement. For the avoidance of doubt, where the SCCs apply pursuant to Section 7, the governing law and jurisdiction provisions of the applicable SCCs shall take precedence with respect to matters governed by those clauses.
Entire Agreement; Order of Precedence
This DPA, together with the Agreement and any applicable SCCs, constitutes the entire agreement between the parties with respect to the processing of Personal Data. In the event of any conflict, the order of precedence shall be: first, the applicable SCCs; second, this DPA; third, the SaaS Agreement and applicable Order Form; fourth, the Terms of Use and User Agreement; and fifth, the Privacy Policy.
Annex I Details of Processing
A. List of Parties
| Controller | Processor | |
|---|---|---|
| Name | Customer (as identified in the Agreement) | Engineersmind Corp |
| Address | As set out in the Agreement | Jersey City, New Jersey, United States |
| Contact | As set out in the Agreement | Support@pdffillr.ai |
| Role | Controller | Processor |
B. Description of Processing
| Item | Description |
|---|---|
| Subject matter | Automated document analysis, AI-powered PDF form population, file storage, and related services provided through the PDFFillr platform. |
| Nature and purpose | Processing of Personal Data contained in documents uploaded or generated by the Controller for the purpose of delivering the Services as described in the Agreement. |
| Duration | For the term of the Agreement and until deletion or return in accordance with Section 10. |
| Categories of Data Subjects | The Controller's customers, clients, employees, contractors, end users, and other individuals whose Personal Data is contained in documents submitted through the Services. |
| Categories of Personal Data | Contact information; government-issued identification data; financial account and transaction data; health and medical information; employment and professional information; and other Personal Data contained in documents submitted by the Controller. |
| Sensitive Personal Data | The parties acknowledge that documents submitted may contain health data, financial account data, and government-issued identification numbers, which are treated as sensitive categories under applicable law. |
Annex II Technical and Organizational Security Measures
The Processor's technical and organizational security measures include:
- Encryption of Personal Data in transit using TLS and at rest using AES-256 or equivalent;
- Role-based access controls with least-privilege principles;
- Multi-factor authentication for personnel accessing production systems;
- Security logging, monitoring, and alerting;
- Regular vulnerability assessments and patch management;
- Incident response procedures with defined escalation and notification timelines;
- Sub-processor security assessment and contractual obligations;
- Data minimization and purpose limitation practices.
Annex III Sub-Processors
| Sub-processor | Entity Location | Processing Location | Purpose |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS Bedrock) | United States | United States | AI model processing and cloud infrastructure hosting |
| Anthropic, PBC (Claude) | United States | United States | AI model inference and document processing |
| OpenAI, LLC | United States | United States | AI model inference and document processing |
| Google LLC (Google Drive) | United States | United States | Document storage and file integration |
| Dropbox, Inc. | United States | United States | Document storage and file integration |
The Processor shall maintain and make available an updated sub-processor list upon request at Support@pdffillr.ai.
By accessing or using the Services, the Customer agrees to the terms of this Data Processing Addendum.