Data Processing Agreement

This DPA is between you | the customer using the Service, the “Controller” and the publisher identified in the legal notice, the “Processor”. It takes effect when you first transmit personal data through the Service and lasts as long as you do.

No signature is required. If your organisation needs a countersigned copy, write to legal@prysm.tools.

The subject matter, categories of data and categories of data subjects are set out in Annex I.

We process personal data only on your documented instructions. Your API requests and your actions in the editor are those instructions; the Terms, this DPA and the published API reference define their scope.

Where we are required by EU or member-state law to process for another purpose, we will tell you before doing so unless that law forbids it on important grounds of public interest.

We will inform you if, in our opinion, an instruction infringes data protection law, and may suspend that instruction until it is resolved.

Anyone authorised to process the data, our personnel and any contractor, is bound by an appropriate, enforceable confidentiality obligation that survives the end of their engagement. Access is granted on a need-to-know basis and withdrawn when it is no longer needed.

We implement the technical and organisational measures set out in Annex II, appropriate to the risk, in accordance with Article 32 GDPR. We may update them provided the level of protection is not reduced.

You grant us general written authorisation to engage sub-processors. The current list is published and kept up to date at Sub-processors.

• Notice of change. We will announce any intended addition or replacement at least 30 days in advance, on that page and by email to account holders who have asked to be notified.
• Your right to object. You may object on reasonable data protection grounds within that period. If we cannot accommodate the objection, you may terminate the affected part of the Service without penalty and receive a refund of the unused portion of any prepaid period.
• Flow-down. Each sub-processor is bound by data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

• Data subject requests. Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures in responding to requests to exercise data subject rights. Where a data subject contacts us directly about data you control, we will not respond substantively, we will redirect them to you and tell you without undue delay.
• Articles 32 to 36. We assist you in ensuring security of processing, in notifying breaches, in carrying out data protection impact assessments and in prior consultation with a supervisory authority, to the extent the information is within our control.
• Cost. Assistance that goes materially beyond the self-service facilities in your dashboard may be charged at a reasonable rate, agreed in advance.

We notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting data we process for you. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.

Notifying the supervisory authority and, where required, the data subjects is your obligation as controller. We will provide the information you reasonably need to meet it. Notification is not an acknowledgement of fault.

On termination, and at your election, we will delete or return the personal data we process for you. Absent an election within 30 days of termination, we delete it.

• You can export or delete your data at any time from your dashboard; that is the fastest route and needs no request.
• Deletion is applied to live systems immediately. Encrypted backups are rotated and overwritten within 30 days; data in them is not restored to production and is not otherwise processed.
• We retain data only where EU or member-state law requires it, and then only for as long as required and for that purpose alone.

We make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

How this works in practice

• First, we answer a written security questionnaire and provide the compliance reports and certifications of our sub-processors, together with the description in Annex II. For most controllers this satisfies the obligation, and it is the route we ask you to take first.
• Where that is genuinely insufficient , for example after a breach affecting your data, or where your own regulator requires it, you may conduct an on-site inspection on 30 days’ written notice, no more than once in any twelve months, during business hours, under an appropriate confidentiality undertaking, using an auditor who is not our competitor, and without access to other customers’ data or to multi-tenant systems in a way that would compromise them. You bear your own costs and our reasonable costs of assistance.
• Our sub-processors’ premises are theirs. We will pass on an inspection request and support it, but we cannot grant access to facilities we do not control.

Where processing involves a transfer of personal data outside the European Economic Area to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses of 4 June 2021 are incorporated into this DPA by reference and apply:

• Module Two (controller to processor) between you and us.
• Module Three (processor to processor) between us and our sub-processors.

For those Clauses: the optional docking clause applies; Clause 9 uses Option 2 (general written authorisation) with the 30-day notice period above; Clause 11 does not include the independent dispute resolution option; Clause 17 selects the law of France; Clause 18(b) selects the courts of France. Annex I and Annex II below serve as the Clauses’ annexes, and the list of sub-processors serves as Annex III.

Where UK or Swiss law applies to a transfer, the UK International Data Transfer Addendum, or the Swiss adaptations recognised by the Federal Data Protection and Information Commissioner, apply to the Clauses with the equivalent selections.

You warrant and undertake that:

• You have a valid legal basis for every processing operation you instruct, and the right to transfer the data to us.
• You have given data subjects the information required by Articles 13 and 14 GDPR, including that a processor renders their document.
• Your instructions comply with data protection law, and you will not instruct us to do anything that would put us in breach of it.
• You will not transmit special categories of personal data (Article 9), criminal conviction data (Article 10), payment card numbers, or government identity numbers beyond the tax identifiers our templates provide for. The Service is not designed for them and we do not accept them.
• You keep your API keys confidential and manage access to signed document URLs.

Each party is liable for its own breaches of applicable data protection law. The limitations and exclusions of liability in the Terms of Service apply to this DPA and, to the extent permitted, to claims arising under it, save that nothing here limits a data subject’s rights against either party, or either party’s liability under the Standard Contractual Clauses.

Access control and isolation

• Row-level security enforced in the database, so tenant isolation does not depend on application code being correct.
• Privileged credentials held server-side only, never exposed to the browser; no privileged key carries a public build-time prefix.
• Access to production granted on a need-to-know basis and revoked when no longer required.

Cryptography

• TLS enforced for all data in transit.
• Encryption at rest for databases and object storage.
• API keys stored only as SHA-256 digests; plaintext is displayed once at creation and never persisted.
• Stored documents served only through time-limited signed URLs; no public bucket paths.

Rendering isolation

• The renderer refuses requests to private, loopback, link-local and cloud metadata addresses.
• Remote resources load only from our own origin or allow-listed HTTPS sources, with size and time caps.
• Each render runs in an ephemeral, isolated execution context that is discarded afterwards.

Integrity of billed operations

• Credits are reserved before rendering and settled after it, under a row lock, so concurrent requests cannot oversell a quota.
• Idempotency keys prevent a retried request from producing a second document or a second charge.
• Fixed-window rate limiting per key, applied before any billed work.

Resilience, logging and deletion

• Managed, replicated database and object storage with automated, encrypted backups rotated within 30 days.
• Request metadata logged for security and quota purposes; payload content is never written to logs.
• Deletion applied to live systems on request, and reaching backups as they cycle.
• Personnel bound by confidentiality; sub-processors bound by equivalent obligations.