Data Processing Agreement (DPA)

The Processor shall process Personal Data only:

• As necessary to provide the Service (PDF-to-ESX conversion platform)
• In accordance with Controller’s documented instructions (these Terms and this DPA)
• As required by applicable law
• As necessary to operate an authorized OEM, Reseller, or API Partnership (including generating a native ESX file from structured JSON submitted through the ESXPress API)
• Not for AI model training, product-improvement datasets, or advertising. ESXPress does not use Personal Data to train AI models, and does not use proof-of-concept, test, or evaluation data for training or product improvement.

• Controller’s employees and authorized users
• Property owners and insured parties identified in uploaded documents
• Other individuals whose data appears in uploaded PDFs

• Identifiers: Name, email address, IP address
• Property information: Addresses, claim numbers
• Insurance information: Carrier names, policy references (if present in PDFs)
• Financial data: Subscription and billing records (Stripe customer ID only)

Personal Data is processed for the duration of the Service agreement and retained as follows:

• Conversion records and metadata: retained for the life of the account (this powers History and re-download). There is no automated schedule that erases database records after account deletion.
• Uploaded source PDFs and generated ESX files: removed according to the account’s configurable retention window (1–30 days) when Ephemeral Privacy Mode is enabled on the account; uploaded source PDFs more than 30 days old are also removed by a scheduled platform cleanup. Database records and metadata are retained.
• Deleted conversions: soft-deleted; underlying files and records are then handled under the retention practices above. No separate 90-day purge is performed.

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country.

The Processor ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Processor implements appropriate technical and organizational measures, including:

• Encryption in transit (TLS 1.2+)
• Encryption at rest: W-9 tax identifiers encrypted with Fernet (AES-128-CBC); database storage-layer encryption provided by the hosting provider; ESX output files use the ESX container format's standard wrapping required for import compatibility
• Access controls (JWT authentication, MFA, role-based access)
• Append-only audit logging of administrative actions
• Multi-tenant data isolation
• Regular security reviews and risk assessments

Authorized Sub-Processors

Sub-Processor Engagement

The Controller provides general authorization for the Processor to engage the Sub-Processors listed above. The Processor shall:

• Inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors
• Provide the Controller with an opportunity to object to such changes
• Impose data protection terms on Sub-Processors that are no less protective than this DPA
• Remain liable for the acts and omissions of its Sub-Processors

OEM / API Partners: Where ESXPress provides conversion services through an OEM, Reseller, or API Partnership (for example, generating ESX files from JSON submitted by a partner’s application), ESXPress acts as a sub-processor on behalf of the partner, and the partner is responsible for notifying the relevant data controllers (for example, insurers or policyholders) of that processing. Data submitted through an API or partnership is subject to the same no-AI-training and retention commitments in this DPA.

The Processor shall assist the Controller in fulfilling obligations to respond to Data Subject requests under GDPR/CCPA, including:

• Right of access (data export endpoint: POST /api/v1/privacy/export)
• Right to erasure (data deletion endpoint: POST /api/v1/privacy/delete)
• Right to rectification (profile update)
• Right to data portability (JSON export format)

The Processor shall notify the Controller without undue delay and, where feasible, within 72 hours upon becoming aware of a Security Incident affecting Personal Data. The notification shall:

• Describe the nature of the incident
• Identify the categories and approximate number of Data Subjects concerned
• Describe the likely consequences
• Describe measures taken or proposed to address the incident

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities.

Upon termination of the Service, the Processor shall, at the Controller’s choice:

• Return all Personal Data in a structured, commonly used, machine-readable format, or
• Delete all Personal Data, except where retention is required by law

For transfers of Personal Data from the EEA, UK, or Switzerland to the United States, the parties rely on the EU Standard Contractual Clauses (SCCs), Module Two (Controller-to-Processor), as incorporated by reference.

• Commission Implementing Decision (EU) 2021/914 of 4 June 2021
• Module Two: Transfer Controller to Processor
• Governing law: Ireland (Clause 17)
• Dispute resolution: Courts of Ireland (Clause 18)

The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA, including security documentation, self-assessments, and audit logs. A formal SOC 2 attestation is not currently available; the Processor’s most recent security self-assessment can be provided on request.

Upon reasonable notice (minimum 30 days) and no more than once per year, the Controller or its authorized auditor may conduct an on-site audit of the Processor’s data processing facilities, subject to:

• Confidentiality obligations
• Minimization of business disruption
• Controller bearing the costs of the audit
• Scope limited to Personal Data processing

Alternative: The Processor may provide an independent security assessment, or a third-party audit report if one becomes available, in lieu of an on-site audit.