Data Processing Addendum (DPA)
Last Updated: March 12, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service and the Agreement between Notnull, Unipessoal, Lda ("Processor", "we", "us") and the user of www.bankpdf.com ("Controller", "you") (each a "Party", collectively the "Parties").
This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation — "GDPR") and applies to the processing of Personal Data by the Processor on behalf of the Controller in connection with the Service.
1. Definitions
In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given to them in the GDPR or the Terms of Service.
- "Applicable Data Protection Law" means all applicable laws and regulations relating to the processing of Personal Data, including the GDPR, the Portuguese Data Protection Act (Lei n.º 58/2019), and any applicable national implementing legislation.
- "Controller" means the natural or legal person that determines the purposes and means of the Processing of Personal Data (i.e., the user of the Service).
- "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.
- "Personal Data" means any information relating to an identified or identifiable natural person contained in the files uploaded to the Service, as well as any account data provided by the Controller.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
- "Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
- "Processor" means Notnull, Unipessoal, Lda, which processes Personal Data on behalf of the Controller.
- "Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
- "Standard Contractual Clauses" or "SCCs" means the contractual clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914.
2. Scope and Purpose of Processing
2.1 Subject Matter
This DPA governs the processing of Personal Data by the Processor when the Controller uploads PDF files (specifically bank statements) through the Service for conversion to spreadsheet and other supported formats (including XLS, CSV, and others as made available).
2.2 Duration of Processing
The Processing shall last for the duration of the Controller's use of the Service, plus the retention periods specified in Section 8 of this DPA.
2.3 Nature and Purpose of Processing
The Processor processes Personal Data solely for the following purposes:
- Conversion of PDF files (bank statements) to spreadsheet and other supported formats
- Temporary storage of files for service delivery, debugging, and quality assurance
- Providing customer support related to conversion issues
2.4 Types of Personal Data
The Personal Data processed may include, but is not limited to:
- Names (account holders)
- Bank account numbers and sort codes/IBAN
- Transaction details (dates, amounts, descriptions, references)
- Account balances
- Addresses associated with bank accounts
- Any other Personal Data contained in bank statement PDFs uploaded by the Controller
2.5 Categories of Data Subjects
Data Subjects may include:
- The Controller (account holder)
- Third parties whose names or details appear in bank transaction records
- Any other individuals identifiable from the uploaded documents
3. Obligations of the Controller
The Controller shall:
- Ensure that it has a lawful basis under Article 6 GDPR for processing the Personal Data and for instructing the Processor to process the Personal Data on its behalf.
- Ensure that all necessary notices have been given to, and all necessary consents or authorizations have been obtained from, the relevant Data Subjects in accordance with Applicable Data Protection Law.
- Ensure that the Personal Data provided to the Processor is accurate, complete, and up to date.
- Be responsible for the lawfulness of the content of the uploaded files.
- Provide documented instructions to the Processor regarding the Processing of Personal Data.
- Comply with its obligations under Applicable Data Protection Law.
4. Obligations of the Processor (Article 28(3) GDPR)
4.1 Processing on Instructions
The Processor shall:
- Process Personal Data only on documented instructions from the Controller, unless required to do so by EU or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
- The Controller's documented instructions are: to process Personal Data solely for the purpose of providing the conversion service as described in Section 2.3.
- The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions (Article 28(3), second subparagraph).
4.2 Confidentiality
The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b) GDPR).
4.3 Security of Processing (Article 32 GDPR)
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
These measures shall include, as appropriate:
4.3.1 Encryption (Article 32(1)(a))
- Encryption of Personal Data in transit using TLS 1.2 or higher for all communications.
- Encryption of uploaded documents at rest in Azure storage.
- Encryption of API communications with all Sub-Processors using TLS.
4.3.2 Confidentiality, Integrity, Availability, and Resilience (Article 32(1)(b))
- Confidentiality: Access to Personal Data is restricted to authorized personnel on a need-to-know basis. Multi-factor authentication (MFA) is enforced for administrative access.
- Integrity: Measures to ensure that Personal Data cannot be read, copied, modified, or removed without authorization.
- Availability: Regular backups to ensure continuity of service.
- Resilience: Infrastructure hosted on Hetzner servers in ISO 27001 certified data centers in Germany.
4.3.3 Restoration (Article 32(1)(c))
The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident, through regular backup procedures.
4.3.4 Regular Testing (Article 32(1)(d))
A process for periodically reviewing and evaluating the effectiveness of technical and organizational measures for ensuring the security of Processing, including:
- Periodic internal security testing
- Review and remediation following any security incidents
4.3.5 Additional Measures
- Firewall rules to limit exposure.
- Secure deletion of files after the retention period.
- Monitoring and logging of system access and anomalies.
- Confidentiality obligations for all persons with access to Personal Data.
4.4 Sub-Processing (Article 28(2) and (4) GDPR)
4.4.1 General Authorization
The Controller provides a general written authorization for the Processor to engage Sub-Processors for the Processing of Personal Data. The current list of authorized Sub-Processors is set out in Annex B of this DPA.
4.4.2 Notification of Changes
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors, thereby giving the Controller the opportunity to object to such changes.
The Processor shall notify the Controller at least 30 days before engaging a new Sub-Processor by:
- Updating the list of Sub-Processors in this DPA and on the Service website.
- Sending a notification to the Controller's registered email address.
4.4.3 Right to Object
If the Controller objects to a new Sub-Processor on reasonable grounds relating to data protection, the Controller shall notify the Processor in writing within 14 days of receiving the notification. The Parties shall discuss the Controller's concerns in good faith with a view to achieving a commercially reasonable resolution. If no resolution can be reached, the Controller may terminate the Agreement by providing written notice.
4.4.4 Sub-Processor Obligations
The Processor shall:
- Impose the same data protection obligations as set out in this DPA on each Sub-Processor by way of a written contract (Article 28(4) GDPR).
- Remain fully liable to the Controller for the performance of the Sub-Processor's obligations (Article 28(4) GDPR).
- Ensure that each Sub-Processor provides sufficient guarantees to implement appropriate technical and organizational measures.
4.5 Data Subject Rights (Article 28(3)(e) GDPR)
The Processor shall:
- Assist the Controller, by appropriate technical and organizational measures and insofar as is possible, in fulfilling the Controller's obligation to respond to requests for exercising the Data Subject's rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection).
- Promptly notify the Controller if the Processor receives a request from a Data Subject in relation to Personal Data processed under this DPA. The Processor shall not respond to such a request itself unless authorized by the Controller.
4.6 Assistance with Compliance (Article 28(3)(f) GDPR)
The Processor shall assist the Controller in ensuring compliance with the obligations set out in Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor. This includes assistance with:
- Security of processing (Article 32)
- Notification of a Personal Data Breach to the supervisory authority (Article 33)
- Communication of a Personal Data Breach to the Data Subject (Article 34)
- Data protection impact assessments (Article 35)
- Prior consultation with the supervisory authority (Article 36)
4.7 Audit Rights (Article 28(3)(h) GDPR)
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. The Controller shall provide reasonable prior written notice of any audit request.
5. Personal Data Breach Notification
5.1 Notification to Controller
The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller.
5.2 Content of Notification
The notification shall include, at a minimum:
- A description of the nature of the Personal Data Breach including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned.
- The name and contact details of the Processor's Data Protection Officer or other contact point where more information can be obtained.
- A description of the likely consequences of the Personal Data Breach.
- A description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
5.3 Cooperation
The Processor shall cooperate with and assist the Controller in:
- Investigating the Personal Data Breach.
- Fulfilling the Controller's obligation to notify the supervisory authority (Article 33 GDPR) and, where applicable, the affected Data Subjects (Article 34 GDPR).
- Taking any remedial measures.
5.4 Documentation
The Processor shall document all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken, in accordance with Article 33(5) GDPR.
6. International Data Transfers
6.1 General Principle
The Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA) unless:
- The European Commission has determined that the country ensures an adequate level of data protection (adequacy decision under Article 45 GDPR); or
- Appropriate safeguards have been provided in accordance with Article 46 GDPR, including Standard Contractual Clauses (SCCs); or
- A derogation under Article 49 GDPR applies.
6.2 Transfer Mechanisms
For transfers to Sub-Processors outside the EEA, the Processor relies on the following mechanisms:
| Sub-Processor | Country | Transfer Mechanism |
|---|---|---|
| OpenAI | USA | Standard Contractual Clauses (SCCs) + Supplementary Measures |
| Anthropic | USA | Standard Contractual Clauses (SCCs) + Supplementary Measures |
| xAI | USA | Standard Contractual Clauses (SCCs) + Supplementary Measures |
| OpenRouter | USA | Standard Contractual Clauses (SCCs) + Supplementary Measures |
| Mistral AI | EU (France) | N/A (within EEA) |
| Microsoft Azure | EU (primary) / configurable | Adequacy / SCCs where applicable |
| Google Vertex AI | EU (primary) / configurable | Adequacy / SCCs where applicable |
6.3 Transfer Impact Assessment
The Processor has conducted a Transfer Impact Assessment (TIA) for transfers to the USA and has implemented supplementary measures where necessary, including:
- Encryption of data in transit using TLS
- Encryption of uploaded documents at rest
- Use of zero-data-retention API configurations where available
- Minimization of Personal Data transmitted to Sub-Processors
- Contractual commitments from Sub-Processors regarding government access requests
6.4 Controller's Right to Information
The Controller may request a copy of the Standard Contractual Clauses and Transfer Impact Assessments by contacting the Processor at [email protected].
7. Confidentiality
7.1 General Obligation
The Processor shall treat all Personal Data as confidential and shall ensure that all persons authorized to process Personal Data (including employees, agents, and Sub-Processors) are bound by appropriate confidentiality obligations, whether contractual or statutory.
7.2 Scope
This confidentiality obligation shall survive the termination or expiry of this DPA.
8. Data Retention and Deletion (Article 28(3)(g) GDPR)
8.1 Retention Periods
| Data Type | Retention Period |
|---|---|
| Uploaded PDF files | Maximum 30 days (or until issue resolution, if longer) |
| Converted output files | Maximum 30 days (or until issue resolution, if longer) |
| Processing logs (anonymized) | 12 months |
8.2 Deletion or Return of Data
Upon termination of the Agreement, or upon the Controller's request at any time, the Processor shall, at the choice of the Controller:
- Delete all Personal Data processed on behalf of the Controller and delete existing copies, unless EU or Member State law requires storage of the Personal Data; or
- Return all Personal Data to the Controller in a structured, commonly used, and machine-readable format, and delete existing copies.
8.3 Certification
The Processor shall, upon request, provide the Controller with written confirmation that the deletion has been completed, unless applicable law prevents such deletion.
8.4 Automatic Deletion
Uploaded files are automatically and permanently deleted from the Processor's systems after the retention period specified in Section 8.1, using secure deletion methods that prevent recovery.
8.5 Sub-Processor Retention
Data transmitted to AI Sub-Processors for processing is processed in real-time and is not retained by those Sub-Processors beyond the duration necessary to complete the processing request. The Processor uses zero-data-retention API configurations where available.
9. Liability
9.1 GDPR Liability
The liability of the Parties for any breaches of this DPA, including any damage caused by Processing that infringes the GDPR, shall be governed by Article 82 GDPR.
9.2 Limitation
Subject to Article 82 GDPR (which cannot be limited by contract), the total aggregate liability of each Party under this DPA shall be subject to the limitations of liability set out in the Terms of Service.
10. Term and Termination
10.1 Term
This DPA shall enter into effect when the Controller begins using the Service and shall remain in force for as long as the Processor processes Personal Data on behalf of the Controller.
10.2 Termination
This DPA shall automatically terminate upon the termination of the Agreement (Terms of Service). The provisions of this DPA that by their nature should survive termination shall survive, including but not limited to Sections 5 (Data Breach), 7 (Confidentiality), 8 (Retention and Deletion), and 9 (Liability).
11. Miscellaneous
11.1 Governing Law
This DPA shall be governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.
11.2 Jurisdiction
Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Porto, Portugal, without prejudice to the rights of Data Subjects under Article 79 GDPR to bring proceedings before the courts of the Member State where the Data Subject has their habitual residence.
11.3 Conflict
In the event of any conflict between this DPA and the Terms of Service or Privacy Policy, this DPA shall prevail with respect to matters relating to the processing of Personal Data.
11.4 Amendments
This DPA may be amended by the Processor to reflect changes in Applicable Data Protection Law. The Processor shall notify the Controller of any material changes at least 30 days in advance.
11.5 Severability
If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Annex A — Description of Processing
| Element | Description |
|---|---|
| Controller | The user of www.bankpdf.com |
| Processor | Notnull, Unipessoal, Lda, Rua Campo Alegre, Nº 1636, h42, Porto, Portugal |
| Subject matter | Conversion of bank statement PDF files to spreadsheet and other supported formats |
| Duration | For the duration of the Controller's use of the Service |
| Nature of Processing | Automated extraction, analysis, and conversion of document content |
| Purpose of Processing | Providing the PDF conversion service, service delivery, debugging, and quality assurance |
| Types of Personal Data | Names, bank account numbers, IBAN, transaction details (dates, amounts, descriptions), account balances, addresses |
| Categories of Data Subjects | Account holders, third parties identified in transactions |
Annex B — List of Authorized Sub-Processors
Effective as of March 12, 2026
| Sub-Processor | Registered Address | Processing Activity | Location of Processing | Transfer Mechanism |
|---|---|---|---|---|
| OpenAI, LLC | San Francisco, CA, USA | Text processing and analysis in documents | USA | SCCs + Supplementary Measures |
| Anthropic, PBC | San Francisco, CA, USA | Text content processing and analysis | USA | SCCs + Supplementary Measures |
| xAI Corp | USA | Text content processing and analysis | USA | SCCs + Supplementary Measures |
| OpenRouter, Inc. | USA | AI model routing and processing | USA | SCCs + Supplementary Measures |
| Mistral AI | Paris, France | Text content processing and analysis | EU (France) | N/A (within EEA) |
| Microsoft Corporation (Azure) | Redmond, WA, USA | Document extraction and analysis | EU (Germany) | Adequacy / SCCs |
| Google LLC (Vertex AI) | Mountain View, CA, USA | Document processing tasks | EU | Adequacy / SCCs |
| Hetzner Online GmbH | Gunzenhausen, Germany | Server hosting and infrastructure | EU (Germany) | N/A (within EEA) |
| PostHog, Inc. | San Francisco, CA, USA | Usage analytics | EU | SCCs |
Annex C — Technical and Organizational Measures (Article 32 GDPR)
The Processor implements the following technical and organizational measures:
1. Encryption
- TLS 1.2+ for all data in transit
- Uploaded documents encrypted at rest
- Encrypted backups
- API communications with all Sub-Processors encrypted using TLS
2. Access Control
- Multi-factor authentication (MFA) for administrative access
- Access to Personal Data restricted to authorized personnel on a need-to-know basis
- Prompt deprovisioning upon role change or termination
3. Network Security
- Firewall rules to limit exposure
- Intrusion detection/prevention systems
- Hosting in Hetzner data centers (Germany) with ISO 27001 certification
- DDoS mitigation measures
4. Application Security
- Periodic internal security testing
- Input validation and output encoding
5. Physical Security
Physical security is provided by Hetzner's ISO 27001 certified data centers in Germany, including physical access controls, surveillance, and environmental controls.
6. Data Management
- Automated secure deletion of files after retention period
- Data minimization in processing
- Zero-data-retention API configurations where available
7. Incident Management
- Documented incident response procedure
- 48-hour breach notification to Controller
- Review and remediation following any security incidents
8. Business Continuity
- Regular encrypted backups to ensure data availability
9. Organizational Measures
- Designated Data Protection Officer ([email protected])
- Confidentiality obligations for all persons with access to Personal Data
- Privacy by design and by default in service development
- Record of Processing Activities maintained under Article 30 GDPR
Contact Information
Processor: Notnull, Unipessoal, Lda Rua Campo Alegre, Nº 1636, h42, Porto, Portugal
Data Protection Officer: Email: [email protected]
General Support: Email: [email protected]