Data Processing Agreement

This agreement applies when you use KovaPDF to process personal data that you are responsible for, for example the names and details in the documents you upload, convert, edit or send for signature, or the people you add to a team. For that data you are the controller and KovaPDF is your processor, as the GDPR and the UK GDPR use those words.

It forms part of our Terms of Use and applies automatically, with no signature needed.

• We process the data only to provide the service, on your instructions, which are your use of the tools and settings. We tell you if we believe an instruction breaks data protection law.
• Everyone who can access the data is bound to keep it confidential.
• We keep the security measures in section 5 in place.
• We use other providers only as section 4 describes.
• We help you answer requests from the people the data is about, and with security, breach notices and impact assessments, as far as our role allows.
• When you delete documents, requests or your account, we delete the data as the Privacy Policy describes. Encrypted backups are overwritten within 30 days.
• We give you the information you need to show that these terms are met, and answer reasonable audit questions in writing.

You allow us to use the providers in our list of service providers. Each one is bound by data protection terms that protect the data at least as well as this agreement, and we remain responsible for them.

We update that list before a new provider starts processing your data. If you object to a change for a data protection reason, email support@kovapdf.com within 30 days. If we cannot meet your concern, you may cancel your plan.

• Every connection to the site is encrypted.
• Files are worked on in the server’s memory and deleted when the job is done; files kept for a tool that works in steps are deleted 30 minutes after you finish, and within three hours at most.
• Every upload is checked for malware, and scripts are removed from PDFs.
• Web pages are turned into PDFs in a separate environment that cannot reach the database or our keys.
• Passwords are stored only as strong one-way hashes.
• The server only accepts traffic through our protection network, and the database account the site uses can only read and write records.
• Staff access needs two-step verification and an approved device, and changes made there are logged.
• The database is backed up every six hours, encrypted, and a restore is tested every month.
• IP addresses in our usage records are stored as keyed hashes, and logs leave out file names and contents.
• New versions go live only after automated tests pass, and our software packages are checked for known vulnerabilities every week.

If personal data we process for you is lost, changed or seen by someone who should not see it, we tell you without undue delay after we become aware of it, with what we know and what we are doing about it.

Our server and some providers are outside the EU and the UK. Where your data is transferred there, we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses (Appendix II of the Privacy Policy).

The limits of liability in the Terms of Use apply to this agreement. If this agreement and the Terms of Use differ on data protection, this agreement applies; if the standard contractual clauses differ from either, the clauses apply.

Questions about this agreement: support@kovapdf.com.