Data Processing Agreement
Standard DPA terms for Business and Enterprise customers.
ChangeMyPDF processes personal data on behalf of our customers. Our standard Data Processing Agreement reflects GDPR Article 28 requirements and Standard Contractual Clauses for international transfers.
Scope
The DPA applies to all paid plans and forms part of our Terms of Service when accepted. Free-plan use is governed by the Privacy Policy alone — we do not act as a data processor for free traffic in the GDPR sense.
Subprocessors
We use the following subprocessors:
- AWS (file storage, compute) — us-east-1, eu-west-1, ap-southeast-2
- Stripe (billing)
- Anthropic, OpenAI (AI features, zero-retention agreements)
- Postmark / Resend (transactional email)
- Sentry, Datadog (error and performance monitoring)
Customers are notified at least 30 days before any change to this list and may object via their account owner.
Sign the DPA
Business and Enterprise customers can self-sign the DPA from their billing settings. If you need a counter-signature or modifications, write to legal@changemypdf.com.