Legal
Data processing agreement (Auftragsverarbeitungsvertrag, Art. 28 GDPR)
Version 2026-10-23
This English version is a courtesy translation. The German version of this agreement is the one that is concluded and prevails in case of any difference.
Controller (client): the company that accepts this agreement in the company panel.
Processor (contractor): the operator named in the imprint of pdf.ucagg.de (a natural person, sole trader, developer of the UCA apps), email noreply@ucagg.de.
1. Subject and duration
The contractor provides the company account of UCA PDF Editor (company panel, delivery of the company data to the employees' apps, number sequences). The agreement applies as long as the company account exists.
2. Nature, purpose, data, data subjects
Storing and transmitting: company data, logo, stamp; for employees: email, name, job title, department, phone, signing authority, approval status, the signature they drew themselves (stored encrypted), sign-in times, document numbers taken with time and person. Data subjects: employees and agents of the client. Employees' documents are not processed; they stay on the devices.
3. Instructions
The contractor processes the data only on documented instructions from the client; the settings in the company panel count as instructions. If the contractor considers an instruction unlawful, it informs the client.
4. Confidentiality
Only the contractor personally has access to the processing. Other persons get access only after committing to confidentiality.
5. Technical and organisational measures (Art. 32 GDPR)
- Transport encryption (TLS) for all connections; HSTS.
- Signatures stored encrypted (AES-256-GCM); sign-in codes only as hashes; no passwords.
- Separate roles: operator admin, partners (without access to signatures), company admins, employees; a log of every change in the company panel.
- Admin access with an emailed code, rate limits, server-to-server interfaces only in the private network and with a token.
- Daily backup; recoverability; software kept up to date.
6. Subprocessors
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (server hosting in the data centre in Kansas City, USA; sending emails). The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) in the contract with IONOS. The client agrees to this subprocessor. The contractor informs the client of new subprocessors in advance by email; the client can object and then end the agreement.
7. Assistance
The contractor assists the client with requests from data subjects (Art. 15-22 GDPR) and with the obligations under Art. 32-36 GDPR. The client can fulfil many rights directly in the company panel (change, delete).
8. Data breaches
The contractor reports a personal data breach without undue delay, if possible within 48 hours, to the email addresses of the company admins.
9. Deletion and return
After the end of the agreement or on instruction, the contractor deletes all of the client's data within 30 days, in backups at the latest when they expire (30 days). Before that the client can view the data in the panel and have it exported.
10. Evidence and audits
On request the contractor provides the information needed to demonstrate compliance and allows audits by arrangement, usually by written information.
11. Miscellaneous
German law applies. In case of conflict, the data protection provisions of this agreement take precedence over other agreements.
Companies accept this agreement in their company panel (pdf.ucagg.de/company).