Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between Extract API OÜ ("Processor") and the business entity that registers for Extract API ("Controller", "Customer").

It implements Article 28(3) GDPR. By registering for an API key, you enter into this DPA. Our role as controller for your account data is in the Privacy Policy. Technical data-flow details: Data processing docs.

1. Parties

1.1 Processor

1.2 Controller

The Customer identified at registration (company name and email).

2. Subject matter and duration

Subject matter: Provision of PDF document extraction via REST API, including storage of uploaded files during processing, webhook delivery, and related support.

Duration: From registration until account deletion, plus statutory retention for billing records.

3. Nature and purpose of processing

Processing personal data contained in PDF documents uploaded by the Controller for the purpose of extracting structured fields and returning results via API or webhook.

Processing may include:

• Local text extraction (Poppler) on Processor infrastructure in the EEA
• Optical character recognition and structured extraction via authorised sub-processors (Mistral AI, OpenAI) when enabled and required by document type
• Temporary storage of uploaded PDFs during extraction
• Caching of extraction results per Controller account (see §8.1)

4. Types of personal data

• Names, addresses, contact details appearing in freight documents
• Financial amounts, invoice numbers, payment references
• Signatures and delivery confirmation data in POD/CMR documents
• Any other personal data the Controller uploads in PDF form

5. Processor obligations

• Process only on documented instructions from the Controller
• Ensure confidentiality of personnel with access
• Implement appropriate technical and organisational measures (encryption in transit, access controls)
• Assist with data subject requests where feasible
• Delete or return data after processing unless law requires retention
• Notify Controller of personal data breaches without undue delay
• Make available information necessary to demonstrate compliance

6. Sub-processors

Controller authorises use of sub-processors listed at /subprocessors, including cloud OCR and structured-extraction providers that may receive document content when the pipeline requires it.

We notify Controller at least 30 days before adding or replacing sub-processors. Controller may object on reasonable data protection grounds within 14 days.

Controller acknowledges that disabling cloud OCR/LLM stages (via Processor deployment configuration) may reduce extraction quality for scanned documents.

7. International transfers

Transfers outside the EEA use SCCs (Module 2 or 3 as applicable) or adequacy decisions.

8. Deletion and return

8.1 Result cache

Processor caches extraction results (field values, not PDF files) in Redis for up to 30 days, keyed by file hash, document type, and Controller account ID. Cache entries are not shared between customers. Cached data expires automatically or may be deleted earlier on verified request to dpa@extract.example.com .

8.2 Termination

Upon termination, Processor deletes uploaded PDFs, cached results, and extraction request data within 30 days , except where retention is required by law or for dispute resolution.

9. Audits

Controller may audit compliance once per year on reasonable notice, or request SOC 2 / ISO reports when available: security@extract.example.com .