Last Updated: March 18, 2026

This Data Processing Agreement (“DPA”) forms part of the PDF Pro Terms of Service. It applies when PDF Pro processes Personal Data on behalf of a Business Customer (the “Controller”) to the extent such data is subject to GDPR, CCPA, or the BC Personal Information Protection Act (PIPA).

1. PROCESSING ROLES

• Controller: The entity using PDF Pro for business document management.
• Processor: PDF Pro Software Inc.
• Sub-processor: Third-party entities engaged by PDF Pro to perform specific processing functions.

2. SUB-PROCESSOR LIST

The Controller provides general authorization for the following sub-processors:

3. SECURITY MEASURES (TOMs)

PDF Pro implements Technical and Organizational Measures (TOMs) to protect data, including:

• Encryption: Data at rest is encrypted using AES-256. Data in transit is encrypted via TLS 1.2+.
• Access Control: Access to customer data within project management tools (Teamwork/Google Drive) is restricted to authorized engineers and support staff via Multi-Factor Authentication (MFA).
• Data Minimization: We instruct our team to only move the minimum necessary data from support tickets into project management tasks.

4. DATA BREACH & ASSISTANCE

• Notification: We will notify the Controller without undue delay (within 72 hours) upon discovering a data breach affecting their users.
• DSARs: We will assist the Controller in fulfilling Data Subject Access Requests (e.g., requests for deletion or export).

5. INTERNATIONAL TRANSFERS

For transfers from the EEA/UK to Canada, we rely on Canada's Adequacy Decision. For transfers to the USA or Philippines, PDF Pro utilizes Standard Contractual Clauses (SCCs) to ensure a level of protection equivalent to the GDPR.

6. GOVERNING LAW

This DPA is governed by the laws of British Columbia, Canada.