1. Parties, roles and agreement
This DPA is concluded electronically between the customer identified in the acceptance record and Martin Schrammel AB, 559591-7377, Björnsonsgatan 147, 168 43 Bromma, Sweden. martin@accessibilitypdf.com. The record contains the customer’s legal name, address and country, optional registration number, representative, contact email, role, acceptance time and document version. These particulars complete Annex I below. The supplier offers this DPA by making it available with the acceptance mechanism. The representative accepts for the customer by an affirmative, unticked-by-default checkbox and submit action.
The customer acts as controller, or as a processor engaging us as subprocessor where it has the controller’s authorisation. We act as processor or subprocessor for personal data inside documents. For our own contact, agreement, billing and security records we act as controller under the privacy notice. Once accepted, the DPA covers both the free assessment and paid work.
2. Documented instructions
We process document data only on documented instructions: storage, technical extraction, AI-assisted scope assessment and rule-based quoting, followed after ordering by AI-assisted accessibility adaptation, review, delivery, support and deletion under the agreed service. We do not use it for advertising, model training or unrelated product development. The upload record, service order and subsequent agreed written instructions constitute the instructions.
We immediately inform the customer if we consider an instruction to infringe applicable data-protection law, and suspend the affected operation pending clarification. If law requires other processing, we inform the customer before doing so unless the law prohibits this on important public-interest grounds.
3. People and security
Only authorised persons with a confidentiality obligation may access document data. We maintain appropriate technical and organisational measures under GDPR Article 32, considering risk, the state of the art and the nature of the data. Annex II records the service controls. We regularly review access, test recovery and deletion, and address vulnerabilities. We do not materially reduce protection during an active engagement.
4. Subprocessors
The customer gives general written authorisation for the providers and purposes in the accepted Annex III. We impose data-protection obligations that provide the protections required by Article 28 and remain responsible for their performance of those obligations. We provide at least 30 days’ prior notice by the agreement contact email of an intended addition or replacement that affects document data, allowing a reasoned data-protection objection.
We work with the customer to resolve an objection, use a reasonable alternative, or allow termination of affected unfinished work without charge and refund any prepaid undelivered portion. We do not route their data to a disputed new provider while the objection is unresolved. Provider contract changes with shorter notice require us to pause affected processing if we cannot maintain this commitment. A new website list alone does not replace notice for an existing customer.
5. International transfers
The service does not promise EEA-only processing. Approved providers may process data in the United States and other countries shown in Annex III. Before a restricted transfer, we establish an applicable adequacy basis or the relevant 2021 EU standard contractual clauses (SCCs), complete the required annexes and assess the destination and supplementary measures where necessary. We provide information on the applicable safeguards and a copy or means of obtaining them on request, with proportionate redactions for other customers or security.
The upload checkbox does not serve as GDPR Article 49 consent and cannot legalise an otherwise unlawful transfer. The customer-to-supplier relationship in the EEA is governed by this Article 28 DPA. Where an onward transfer requires SCCs, the relevant exporter and importer must be bound by the applicable module (including Module 3 for processor-to-processor transfers), or a valid adequacy route must apply. No bespoke SCC text in these terms replaces the Commission’s clauses.
6. Assistance and incidents
Taking account of the nature of processing, we assist the customer with requests for access, correction, deletion, restriction, portability and objections, and with security obligations, impact assessments and prior consultation under Articles 32–36. We promptly forward a request received directly from a data subject and do not answer on the customer’s behalf unless instructed or required by law.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting their data. An initial notice is not delayed until all facts are known. As information becomes available we provide the nature of the breach, categories and approximate numbers of people and records, contact details, likely consequences, actions taken or proposed and updates. We preserve necessary evidence, help with mitigation and the customer’s notifications, and document our response.
7. Information, audits and costs
We provide information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the customer or its mandated independent auditor. Existing reports may be used where sufficient. Reasonable notice, confidentiality and safeguards for other customers apply without preventing an effective audit, urgent incident review or regulatory access. Standard assistance and evidence are included. We agree any reasonable charge for exceptional, customer-requested work in advance; assistance required because of our breach is free.
8. Return, deletion and duration
This DPA begins at acceptance and continues for as long as we or our subprocessors process the customer’s document data. The customer may request return or deletion on termination; downloadable delivery is the ordinary return method. Unordered documents expire after 24 hours and are deleted in the next maintenance cycle. Unverified orders expire after seven days; cancelled orders are removed within one day of cancellation. Unpaid previews expire after 30 days; paid order documents expire 30 days after payment.
We delete active service copies and instruct the relevant providers to delete their copies, unless retention is required by law. Isolated backups and provider safety records may persist for the provider’s documented, limited retention period, with use restricted to that purpose and access controlled; we disclose material exceptions and confirm deletion on request. Local working copies are removed after each job, including failed jobs. A legal hold must be specific, documented and limited; retained data cannot be reused. The separate agreement and financial records described in the privacy notice do not justify keeping the document content.
Annex I — Processing particulars
Subject: uploaded business PDFs and derived content, accessible PDFs, page samples and review reports. Purpose: the free quote and the ordered accessibility service. Nature: receipt, storage, extraction, analysis, structuring, text alternatives, comparison, review, transmission and deletion. Frequency: per uploaded document and order. Duration: as set out in section 8.
Data subjects: authors, staff, business contacts, customers, suppliers, officials and people named in ordinary business publications. Data types: names, professional contact details, roles, affiliations, signatures appearing in ordinary business publications and professional biographical information incidentally present in documents. Special-category, criminal-offence and other excluded data under the service terms are not authorised. If the intended data subjects or categories fall outside this description, contact us for an agreed amendment before upload.
The acceptance record identifies the customer and its representative and GDPR role. Martin Schrammel AB is the supplier, with the contact details in section 1. Instructions and the customer’s rights and obligations are described in sections 2, 6–8 and the service terms.
Annex II — Technical and organisational measures
- HTTPS for client and service connections. Documents stored in private object storage with authorised access; no public document bucket or permanent public download URL.
- Server-side ownership checks; hashed random access credentials, time-limited email verification links and HttpOnly session cookies. Separate administrator and production-worker credentials.
- Upload limits, server-side format/page checks, rate limits and same-origin checks for browser mutations. Treat document content as untrusted input.
- Queue leases and attempt-specific artifacts prevent stale processing from releasing files. Payment is confirmed by a verified provider webhook before complete files are delivered.
- Technical validation, an independent AI review and a recorded human release decision. Human review remains necessary for semantic accessibility.
- Defined expiry and scheduled deletion; temporary local working directories are removed after each job. Provider-side conversations and residual retention follow documented deletion instructions.
- Confidentiality, least-privilege access, incident response, supplier checks and review of account settings. No claim that AccessibilityPDF is ISO 27001 certified or SOC 2 attested.
These measures apply in proportion to the agreed processing. A material change or additional requirement must be agreed before affected processing.
Annex III — Providers and transfer safeguards
The subprocessor and transfer register at /en/subprocessors forms part of this DPA. Its full accepted text is included in the downloadable agreement snapshot, so subsequent website changes do not alter the accepted list. Providers receive only the data needed for the specified task; payment and email providers do not need the PDF content. OpenAI assists the scope assessment before a fixed quote and accessibility production and review after an order. Code calculates the preliminary price and fixed quote amounts. Anthropic may be used by the operator for assisted remediation within the same contracted scope.