Skip to content
Get started

Data Processing Agreement

Last updated: October 8, 2026

Definitions

For the purposes of this DPA, the following terms shall have the meanings set out below. Terms not defined herein shall have the meanings given to them in the UK GDPR, EU GDPR, or the Terms of Service, as applicable.

  1. "Applicable Data Protection Law" means all applicable laws and regulations relating to the processing of personal data, including but not limited to:

    • The UK General Data Protection Regulation (UK GDPR) as retained in United Kingdom law by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data Protection Act 2018.
    • The EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR").
    • Any national implementing legislation, as amended, replaced, or superseded from time to time.

  2. "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this DPA, the Controller is the Customer.

  3. "Data Subject" means an identified or identifiable natural person whose personal data is processed.

  4. "EEA" means the European Economic Area, comprising the EU member states plus Iceland, Liechtenstein, and Norway.

  5. "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller in connection with the Service.

  6. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

  7. "Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

  8. "Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller. For the purposes of this DPA, the Processor is Uptraff Ltd.

  9. "Services" means the Novitora file conversion platform and related services provided by the Processor to the Controller as described in the Terms of Service.

  10. "Special Categories of Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

  11. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

  12. "Supervisory Authority" means an independent public authority established by a Member State pursuant to Article 51 of the EU GDPR, or the Information Commissioner's Office (ICO) in the United Kingdom.

  13. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as approved by the European Commission or the UK Secretary of State, as applicable.

  14. "UK IDTA" means the International Data Transfer Agreement issued by the Information Commissioner under Section 119A of the Data Protection Act 2018.

Scope and purpose

Scope of Processing

  1. This DPA applies to all Processing of Personal Data carried out by the Processor on behalf of the Controller in connection with the provision of the Service.

  2. The Processor shall process Personal Data only to the extent necessary to provide the Service as described in the Terms of Service and as further instructed by the Controller in accordance with this DPA.

  3. The subject matter, nature, purpose, duration, types of Personal Data, and categories of Data Subjects are described in Annex 1 to this DPA.

Purpose of Processing

The Processor processes Personal Data solely for the following purposes:

  1. To receive, process, and convert files uploaded by the Controller or the Controller's users.
  2. To store files temporarily for the purpose of enabling file download after conversion.
  3. To provide technical support related to the conversion service.
  4. To maintain logs and records necessary for the operation, security, and improvement of the Service.
  5. To fulfil any other obligations under the Terms of Service.

Restrictions

  1. The Processor shall not process Personal Data for any purpose other than as set out in this DPA or as otherwise instructed by the Controller in writing.
  2. The Processor shall not sell, rent, lease, or otherwise make Personal Data available to third parties, except as expressly permitted by this DPA.
  3. The Processor shall not use Personal Data for profiling, marketing, or any form of automated decision-making, except as necessary for the provision of the Service.

Obligations of the Controller

The Controller warrants and undertakes that:

  1. Lawful Basis: It has a valid legal basis for the processing of Personal Data submitted to the Service, in accordance with Applicable Data Protection Law.

  2. Data Subject Rights: It has provided appropriate notices to, and obtained any necessary consents from, Data Subjects whose Personal Data is submitted to the Service, as required by Applicable Data Protection Law.

  3. Lawful Instructions: All instructions given to the Processor regarding the processing of Personal Data shall comply with Applicable Data Protection Law.

  4. Data Minimisation: It shall ensure that the Personal Data submitted to the Service is adequate, relevant, and limited to what is necessary for the purposes of the processing.

  5. Accuracy: It shall ensure that the Personal Data submitted to the Service is accurate and, where necessary, kept up to date.

  6. Special Categories: If Special Categories of Personal Data are submitted to the Service, the Controller shall ensure that it has a valid legal basis and that appropriate safeguards are in place, including where required, the explicit consent of Data Subjects.

  7. Compliance: It shall comply with its obligations under Applicable Data Protection Law in respect of the Personal Data.

  8. Cooperation: It shall cooperate with the Processor to enable the Processor to fulfil its obligations under this DPA and Applicable Data Protection Law.

Obligations of the Processor

General obligations

The Processor warrants and undertakes that:

  1. Documented Instructions: It shall process Personal Data only on documented instructions from the Controller, unless required to do so by Applicable Data Protection Law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification.

  2. Confidentiality: It shall ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

  3. Security: It shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR/EU GDPR, including as appropriate:

    • Encryption of Personal Data in transit and at rest.
    • The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
    • The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident.
    • A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

  4. Sub-processing: It shall not engage another processor (sub-processor) without the prior specific or general written authorisation of the Controller, in accordance with the "Sub-processing" section below.

  5. Data Subject Rights: It shall assist the Controller in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

  6. Breach Notification: It shall notify the Controller without undue delay after becoming aware of a Personal Data Breach, in accordance with the "Data breach notification" section below.

  7. Data Protection Impact Assessment: It shall assist the Controller in ensuring compliance with obligations relating to data protection impact assessments and prior consultation with Supervisory Authorities, as required by Articles 35 and 36 of the UK GDPR/EU GDPR.

  8. Deletion or Return: Upon termination of the Service, it shall, at the choice of the Controller, delete or return all Personal Data and delete existing copies, unless Applicable Data Protection Law requires storage of the Personal Data.

  9. Audit: It shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

  10. Notification of Non-Compliance: It shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes Applicable Data Protection Law.

Technical and organisational measures

The Processor shall implement and maintain the following technical and organisational measures:

  1. Access Controls:

    • Role-based access control (RBAC) for all systems processing Personal Data.
    • Multi-factor authentication for administrative access.
    • Regular access reviews and prompt revocation of access upon personnel changes.
    • Principle of least privilege applied to all access permissions.

  2. Encryption:

    • TLS 1.2 or higher for all data in transit.
    • AES-256 encryption for all data at rest.
    • Secure key management practices, including regular key rotation.

  3. Network Security:

    • Firewalls and intrusion detection/prevention systems.
    • DDoS mitigation measures.
    • Network segmentation to isolate processing environments.

  4. File Processing Security:

    • Isolated processing environments for each file conversion.
    • No cross-contamination between users' files.
    • Automated deletion of files after the retention period.

  5. Physical Security:

    • Data processed in data centres with appropriate physical security controls.
    • Restricted access to server rooms and equipment.

  6. Personnel:

    • Confidentiality agreements for all employees and contractors.
    • Regular data protection and security training.
    • Background checks for personnel with access to Personal Data.

  7. Incident Management:

    • Documented incident response procedures.
    • Regular testing of incident response plans.
    • Designated incident response team.

  8. Business Continuity:

    • Regular backups with encryption.
    • Disaster recovery procedures.
    • Redundant infrastructure where appropriate.

Sub-processing

General authorisation

  1. The Controller provides general written authorisation for the Processor to engage sub-processors for the processing of Personal Data, subject to the conditions set out in this section.

  2. The Processor shall maintain a current list of sub-processors, which shall be made available to the Controller upon request at privacy@novitora.com.

Notification of changes

  1. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object to such changes.

  2. Notification shall be provided by email to the Controller's designated contact or through the Service's administrative dashboard.

Objection to Sub-processors

  1. If the Controller objects to a new sub-processor on reasonable grounds relating to data protection, the Processor shall use reasonable efforts to make available to the Controller a change in the Service or recommend a commercially reasonable change to the Controller's configuration or use of the Service to avoid processing of Personal Data by the objected-to sub-processor.

  2. If the Processor is unable to make such a change within a reasonable period (not exceeding 30 days from the Controller's objection), the Controller may terminate the affected Service by providing written notice to the Processor.

Sub-processor obligations

  1. The Processor shall ensure that each sub-processor is bound by data protection obligations no less protective than those set out in this DPA.

  2. The Processor shall enter into a written agreement with each sub-processor that requires the sub-processor to comply with applicable data protection requirements.

  3. The Processor shall remain fully liable to the Controller for the performance of each sub-processor's obligations.

Current Sub-processors

The Processor's current sub-processors are:

  1. DigitalOcean, LLC: Cloud hosting, storage, and compute in the EU (Frankfurt) region, which power the file conversion service.
  2. Modal Labs, Inc.: On-demand computing in the European Economic Area for the Service's AI and rendering tools.
  3. OpenAI OpCo, LLC: Language model for the Service's AI document tools, in the United States.
  4. Google LLC (Google Cloud): Sign in with Google for user accounts, and cloud computing in the EU (Frankfurt) region that may power parts of the Service. No files or document text are processed on Google Cloud at present.
  5. Clerk, Inc.: User authentication and account management.
  6. Cloudflare, Inc.: Content delivery network (CDN), DNS, DDoS protection, web application firewall, bot protection (Turnstile), AI Gateway, and AI Search.

Novitora is currently free to use and processes no payments, so no payment sub-processor is engaged. A detailed and up-to-date list of sub-processors, including their locations and the nature of the processing, is maintained in our Subprocessor List and is also available upon request at privacy@novitora.com.

Data Subject rights

Assistance with requests

  1. The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including:

    • Right of access (Article 15).
    • Right to rectification (Article 16).
    • Right to erasure (Article 17).
    • Right to restriction of processing (Article 18).
    • Right to data portability (Article 20).
    • Right to object (Article 21).
    • Rights related to automated decision-making and profiling (Article 22).

  2. The Processor shall promptly notify the Controller if it receives a request directly from a Data Subject and shall not respond to such request itself unless authorised to do so by the Controller or required by Applicable Data Protection Law.

Implementation

  1. The Processor shall implement appropriate technical and organisational measures to assist the Controller in responding to Data Subject requests.

  2. The Processor shall provide the Controller with the ability to:

    • Access Personal Data processed on the Controller's behalf.
    • Export Personal Data in a structured, commonly used, and machine-readable format.
    • Delete Personal Data from the Service.

  3. The Processor shall respond to reasonable requests for assistance from the Controller within a timeframe that enables the Controller to meet its obligations under Applicable Data Protection Law (typically within 10 business days).

Data breach notification

Notification obligations

  1. The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller.

  2. The notification shall include, to the extent available at the time of notification:

    • A description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned.
    • The name and contact details of the Processor's data protection contact from whom more information can be obtained.
    • A description of the likely consequences of the Personal Data Breach.
    • A description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

  3. Where it is not possible to provide all information at the same time, the Processor shall provide the information in phases without undue further delay.

Cooperation

  1. The Processor shall cooperate with the Controller and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each Personal Data Breach.

  2. The Processor shall provide the Controller with all information necessary for the Controller to fulfil its obligation to notify the relevant Supervisory Authority and affected Data Subjects, as required by Articles 33 and 34 of the UK GDPR/EU GDPR.

  3. The Processor shall document all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken.

Notification method

Notifications shall be sent to the Controller's designated contact by:

  1. Email to the primary contact email address associated with the Controller's account.
  2. If email is not practicable, by telephone to the primary contact number associated with the Controller's account, followed by written confirmation by email.

Data protection impact assessment

  1. The Processor shall provide reasonable assistance to the Controller in conducting data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities, as required by Articles 35 and 36 of the UK GDPR/EU GDPR, to the extent that such assistance relates to the processing carried out by the Processor on behalf of the Controller.

  2. Such assistance shall include:

    • Providing information about the nature of the processing and the technical and organisational measures implemented by the Processor.
    • Providing information about the Processor's sub-processors and the locations where Personal Data is processed.
    • Assisting the Controller in assessing the risks to the rights and freedoms of Data Subjects.
    • Assisting the Controller in identifying appropriate measures to address identified risks.

  3. The Processor shall provide such assistance within a reasonable timeframe and may recover reasonable costs incurred in providing such assistance, to the extent permitted by Applicable Data Protection Law.

International transfers

Transfer restrictions

  1. The Processor shall not transfer Personal Data to a country outside the United Kingdom or the EEA unless appropriate safeguards are in place, as required by Applicable Data Protection Law.

  2. The Processor shall ensure that any transfer of Personal Data to a country outside the United Kingdom or the EEA is carried out in accordance with one of the following mechanisms:

    • The recipient country has been recognised by the UK Secretary of State or the European Commission as providing an adequate level of data protection.
    • The transfer is subject to appropriate safeguards, including the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs), or Binding Corporate Rules.
    • The transfer falls within a specific derogation under Article 49 of the UK GDPR/EU GDPR.

Supplementary measures

  1. Where required, the Processor shall implement supplementary technical, organisational, and contractual measures to ensure that the transferred Personal Data is afforded a level of protection essentially equivalent to that guaranteed within the United Kingdom or the EEA.

  2. Such supplementary measures may include:

    • Additional encryption measures.
    • Pseudonymisation of Personal Data.
    • Restricting access to transferred data.
    • Contractual provisions requiring the data importer to notify the data exporter of any government access requests.

Transfer impact assessment

  1. The Processor shall conduct a transfer impact assessment for each country to which Personal Data is transferred, to evaluate whether the legal framework of the recipient country provides an adequate level of protection.

  2. The Processor shall make the results of such assessments available to the Controller upon request.

Audit rights

Right to audit

  1. The Controller shall have the right to audit the Processor's compliance with this DPA, subject to the following conditions:

    • Audits shall be conducted no more than once per year, unless a Personal Data Breach has occurred or there are reasonable grounds to suspect non-compliance.
    • The Controller shall provide at least 30 days' prior written notice of its intention to conduct an audit.
    • Audits shall be conducted during normal business hours and shall not unreasonably disrupt the Processor's operations.
    • The Controller shall bear the costs of any audit, except where the audit reveals material non-compliance by the Processor.

  2. The Controller may appoint a qualified, independent third-party auditor to conduct the audit on its behalf, subject to the auditor entering into appropriate confidentiality agreements.

Processor's obligations

  1. The Processor shall cooperate with the Controller and provide reasonable access to relevant premises, systems, records, and personnel for the purpose of the audit.

  2. The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA, including:

    • Records of processing activities.
    • Technical and organisational security measures.
    • Sub-processor agreements.
    • Incident response records.
    • Training records.

  3. The Processor may satisfy audit requirements by providing the Controller with:

    • Documentation of the Processor's technical and organisational measures.
    • Summaries of internal security reviews and, where available, independent security assessments or penetration testing results.
    • Any relevant third-party audit reports or certifications that the Processor or its infrastructure sub-processors make available. The Processor follows SOC 2-aligned practices; formal certification (such as SOC 2) is part of its security roadmap and is not yet in place. Its infrastructure sub-processors maintain certifications such as SOC 2 Type II and ISO 27001 for their data centres.

Confidentiality

  1. All information obtained during an audit shall be treated as confidential and shall not be disclosed to third parties without the Processor's prior written consent, except as required by Applicable Data Protection Law or a Supervisory Authority.

  2. The Controller shall ensure that any third-party auditor is bound by appropriate confidentiality obligations.

Duration and termination

Duration

  1. This DPA shall remain in effect for the duration of the Controller's use of the Service, as governed by the Terms of Service.

  2. The obligations of the Processor under this DPA shall continue for as long as the Processor processes Personal Data on behalf of the Controller.

Termination

  1. This DPA shall automatically terminate upon the termination or expiration of the Terms of Service between the parties.

  2. Either party may terminate this DPA if the other party materially breaches any of its obligations under this DPA and fails to remedy such breach within 30 days of receiving written notice.

  3. The Controller may terminate this DPA immediately if:

    • The Processor processes Personal Data in a manner that is inconsistent with the Controller's instructions and fails to correct such processing within a reasonable timeframe.
    • The Processor is found to be in material breach of Applicable Data Protection Law.
    • A Supervisory Authority orders the cessation of data processing.

Survival

The following provisions shall survive the termination of this DPA:

  1. Confidentiality obligations.
  2. Data return and deletion obligations.
  3. Audit rights (for a period of 12 months following termination).
  4. Indemnification obligations.
  5. Any provisions that by their nature should survive termination.

Return and deletion of data

Upon termination

  1. Upon termination or expiration of the Service, and at the Controller's choice, the Processor shall:

    • Return all Personal Data to the Controller in a structured, commonly used, and machine-readable format; or
    • Delete all Personal Data and all copies thereof, including from backup systems, within 90 days.

  2. The Controller shall communicate its choice to the Processor in writing within 30 days of termination. If the Controller does not provide instructions within this period, the Processor shall delete all Personal Data.

Certification of deletion

  1. Upon request, the Processor shall provide the Controller with written certification that all Personal Data has been securely deleted.

  2. Deletion shall be performed using industry-standard secure deletion methods that render the data unrecoverable.

Exceptions

  1. The Processor may retain Personal Data to the extent required by Applicable Data Protection Law, provided that:
    • The Processor shall inform the Controller of any such retention and its legal basis.
    • The Processor shall ensure the confidentiality of the retained Personal Data.
    • The Processor shall process the retained Personal Data only for the purpose required by law.
    • The retained Personal Data shall be securely deleted as soon as the legal retention requirement has expired.

Ongoing deletion during service

  1. During the term of the Service, the Processor shall automatically delete uploaded and converted files within 24 hours of upload at the latest (files from anonymous conversions are deleted within 2 hours), in accordance with the data retention periods specified in the Privacy Policy and Terms of Service.

  2. The Controller may request the immediate deletion of specific files or data through the Service's interface or by contacting privacy@novitora.com.

Liability and indemnification

Liability

  1. Each party shall be liable for its own breaches of this DPA and Applicable Data Protection Law.

  2. The Processor's liability under this DPA shall be subject to the limitations of liability set out in the Terms of Service, except to the extent that such limitations are not permitted by Applicable Data Protection Law.

Indemnification

  1. The Processor shall indemnify the Controller against all costs, claims, damages, and expenses incurred by the Controller arising from any breach of this DPA by the Processor or its sub-processors, to the extent caused by the Processor's failure to comply with its obligations under this DPA.

  2. The Controller shall indemnify the Processor against all costs, claims, damages, and expenses incurred by the Processor arising from any breach of this DPA by the Controller, including any processing instructions that infringe Applicable Data Protection Law.

General provisions

Conflicts

In the event of any conflict between the provisions of this DPA and the Terms of Service, the provisions of this DPA shall prevail to the extent that the conflict relates to the processing of Personal Data.

Amendments

  1. This DPA may be amended by the Processor from time to time to reflect changes in Applicable Data Protection Law or the Service.

  2. Material changes to this DPA will be notified to the Controller at least 30 days in advance of the effective date.

  3. Continued use of the Service after the effective date of any amendment shall constitute acceptance of the amended DPA.

Governing law

This DPA shall be governed by and construed in accordance with the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA.

Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

Entire agreement

This DPA, together with the Terms of Service, Privacy Policy, and any annexes or schedules attached hereto, constitutes the entire agreement between the parties with respect to the subject matter hereof.

Annex 1: Details of Processing

Subject matter and duration of Processing

  1. Subject Matter: The processing of Personal Data in connection with the provision of the Novitora file conversion service.
  2. Duration: For the duration of the Controller's use of the Service, plus any applicable retention period as described in this DPA and the Privacy Policy.

Nature and purpose of Processing

  1. Nature: Automated processing, including collection, storage, conversion, retrieval, and deletion.
  2. Purpose: To provide file conversion services, including receiving, processing, converting, temporarily storing, and delivering files uploaded by the Controller or the Controller's authorised users.

Location of Processing

Primary processing and storage of Personal Data take place within the European Union, in the DigitalOcean Frankfurt region. Files submitted to the Service's AI and rendering tools are processed by Modal in the European Economic Area. Limited Personal Data (such as authentication identifiers), and the text of documents submitted to the Service's AI document tools, may be processed by sub-processors outside the UK and the EEA; any such transfer is safeguarded as described in the "International transfers" section and in our Subprocessor List.

Types of Personal Data

The types of Personal Data processed may include, depending on the content of the files uploaded by the Controller:

  1. Names and contact information.
  2. Identification numbers.
  3. Financial information.
  4. Employment information.
  5. Health information (if present in uploaded files).
  6. Any other personal data contained within files uploaded for conversion.

Categories of Data Subjects

The categories of Data Subjects whose Personal Data may be processed include:

  1. The Controller's employees and contractors.
  2. The Controller's customers and clients.
  3. The Controller's business partners and suppliers.
  4. Any other individuals whose personal data is contained within files uploaded for conversion.

Special Categories of Personal Data

Special Categories of Personal Data may be processed if such data is contained within files uploaded by the Controller for conversion. The Controller is responsible for ensuring that it has a valid legal basis for the processing of such data, including, where required, the explicit consent of the Data Subjects.

Annex 2: Technical and organisational measures

A summary of the technical and organisational measures implemented by the Processor is provided in the "Technical and organisational measures" section of this DPA. A detailed description is available upon request at privacy@novitora.com.

Contact information

For questions or concerns regarding this DPA, please contact:

Uptraff Ltd 124 City Road London, England EC1V 2NX

Email: privacy@novitora.com

General Legal Inquiries: legal@novitora.com

Website: novitora.com

By using the Novitora Service, you acknowledge that you have read and understood this Data Processing Agreement.