Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service between the Customer and IT Solid Solutions (CARLOS A. GIRALT TORRIENTE TECNOLOGIA DA INFORMACAO LTDA, CNPJ 47.281.371/0001-52), Avenida Prefeito Osmar Cunha, 416, Florianópolis-SC, 88015-100, Brazil, the company that operates Pressfox ("Pressfox") and applies whenever Pressfox processes personal data on the Customer's behalf. It is offered as the default to every workspace; a countersigned copy is available on request, and redlines are considered on Enterprise agreements.

1. Roles and scope

The Customer is the controller (or a processor acting for its own controllers) and Pressfox is the processor for personal data contained in templates, payloads, assets and rendered reports ("Customer Data"). Pressfox is an independent controller for account, billing and audit data as described in the privacy notice.

2. Subject matter, duration, nature and purpose

Subject matter: the rendering, hosting and delivery of documents from Customer Data. Duration: the term of the service and the deletion period after it. Nature and purpose: validation of payloads against a template contract, rendering to HTML and PDF, storage, delivery through links and the API, and the Customer's own administration. Details in Annex 1.

3. Pressfox's obligations

1. Instructions. Pressfox processes Customer Data only on the Customer's documented instructions, which are the terms, this DPA, the plan configuration and the API calls the Customer makes, including instructions on transfers. Pressfox informs the Customer if an instruction appears to infringe data protection law.
2. Confidentiality. Persons authorised to process Customer Data are bound by confidentiality and access Customer Data only when needed to operate or support the service.
3. Security. Pressfox implements the technical and organisational measures in Annex 2 and keeps them under review (Art. 32).
4. Subprocessors. The Customer gives general written authorisation for the subprocessors listed in Annex 3 (the public page). Pressfox gives at least 30 days' notice before adding or replacing one; the Customer may object on reasonable grounds within that period and, if no resolution is found, terminate the affected service with a refund of prepaid, unused fees. Pressfox imposes the same data protection obligations on each subprocessor and remains liable for their performance.
5. Data subject requests. Pressfox assists the Customer with appropriate technical and organisational measures, in particular export, correction through re-render, and deletion of reports and assets, and forwards any request received directly without answering it.
6. Security assistance, breach notification and DPIAs. Pressfox notifies the Customer of a personal data breach affecting Customer Data without undue delay and in any case within 48 hours of becoming aware of it, with the information available at the time and updates as the investigation proceeds; and assists with data protection impact assessments and prior consultations in so far as they concern the service.
7. Deletion and return. At the end of the service the Customer may export Customer Data in a machine-readable format for 30 days; Pressfox then deletes it from production within 30 days and destroys the workspace's data encryption key. Encrypted copies, and that key, remain in database backups for at most a further 35 days, unless EU or Member State law requires storage; the system is designed so that after that the data cannot be decrypted by anyone, including Pressfox. Backups are used only to recover from a failure, and Pressfox's restore procedure re-applies the deletions and revocations recorded since the restore point before a restored system processes Customer Data.
8. Audit. Pressfox makes available the information necessary to demonstrate compliance, including this DPA, the security page, subprocessor agreements on request, and summaries of third-party assessments once they exist, and allows audits by the Customer or a mandated auditor at most once a year on 30 days' notice, at the Customer's cost, under confidentiality, and without access to other customers' data.

4. Customer's obligations

The Customer is responsible for the lawfulness of the Customer Data it sends, for its own notices and legal bases, for the access it grants to report links, for configuring retention and access policies, and for not sending protected health information under US law or other categories the acceptable use policy excludes.

5. International transfers

Customer Data is stored and processed in the EU (Annex 1). Pressfox is established in Brazil and its personnel may access Customer Data from there to operate and support the service; some subprocessors are established outside the EEA (Annex 3). These are transfers under Chapter V GDPR.

• Where the Customer is subject to the GDPR, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) between the Customer as data exporter and Pressfox as data importer, or Module 3 (processor to processor) where the Customer is itself a processor. Annex 1 of this DPA is Annex I of the Clauses, Annex 2 is Annex II, Annex 3 is Annex III. Clause 7 (docking) applies; under Clause 9(a) Option 2 (general authorisation) applies with the notice period in section 3; Clause 11 optional language does not apply; under Clauses 17 and 18 the law and courts of the Member State where the Customer is established apply, or Ireland if that state's law does not allow third-party rights.
• Where the Customer is subject to the Brazilian Lei Geral de Proteção de Dados (Law 13.709/2018), storing and processing Customer Data in the EU is an international transfer under Art. 33 of that law. For that case the standard contractual clauses approved by the Autoridade Nacional de Proteção de Dados in Resolution CD/ANPD 19/2024 are incorporated by reference, between the Customer as exporter and Pressfox as importer, with Annexes 1 to 3 of this DPA providing the description of the transfer, the security measures and the subprocessors.
• If the European Commission adopts an adequacy decision for Brazil, transfers to Pressfox rest on it instead, for as long as it applies.
• Onward transfers to subprocessors rest on an adequacy decision or on the Standard Contractual Clauses between Pressfox and the subprocessor, as stated per subprocessor in Annex 3.
• Pressfox informs the Customer without delay of any request from a public authority for Customer Data, unless the law forbids it, and challenges requests it considers unlawful.

6. Liability and precedence

The liability provisions of the terms apply, with the higher cap for breach of this DPA, except that nothing limits a party's liability to data subjects under the Standard Contractual Clauses. In a conflict, the Standard Contractual Clauses and the ANPD standard contractual clauses, where they apply, prevail over this DPA, and this DPA prevails over the terms for data protection matters. This DPA is governed by the law that governs the terms, except where the Clauses require otherwise.

Pressfox's representative in the European Union under Art. 27 GDPR is named in the privacy notice.

Annex 1. Description of the processing

Annex 2. Technical and organisational measures

• Encryption at rest for database, object storage and backups; per-workspace data keys for payloads; TLS 1.2 or higher in transit; HSTS.
• Tenant isolation: workspace id on every tenant row, PostgreSQL row-level security, public ids only, report links by separate random token.
• A render plane with no persistent state, no network egress, Chromium with JavaScript disabled, request deadlines, and an authenticated private channel from the control plane.
• Access control: four roles, one permission matrix, per-workspace API keys stored hashed and revocable, sign-in by emailed one-time code or Google, audit log.
• No payload content in logs or error monitoring, verified by an automated redaction test.
• Immutable template versions and frozen artifacts with stored hashes.
• Deletion that reaches the database, object storage, the CDN cache and render temporaries; crypto-shredding on workspace deletion.
• Database backups by point-in-time recovery for about 4 weeks, encrypted at rest; a deleted workspace's key leaves the backups within 35 days. Deletions of workspaces, reports and files are recorded outside the database before they are carried out, and revocations within seconds after; the restore procedure re-applies them before a restored system processes Customer Data. Pressfox will test a restore every quarter, the first before general availability.
• Change management through version control, automated tests in continuous integration (including the full suite run under the restricted database role) and a staging environment before production.
• Incident response: security contact, incident template, 48-hour customer notification.
• Planned, not yet in place: dependency and licence scanning in continuous integration, periodic integrity sampling of stored artifacts, an external penetration test before general availability, a public status page, SOC 2.

Annex 3. Subprocessors

The current list, with purpose, location and transfer mechanism, is maintained at pressfox.io/legal/subprocessors and incorporated here. Changes are announced there and by email to workspace owners 30 days in advance.

Version history