1. Introduction

2. Scope

3. Beta and Feedback Data Disclaimer

4. GDPR Compliance

1. Controller Statement

2. Data Protection Officer (DPO)

Data Protection Officer

Email:[email protected]

5. Definitions

1. Personal Data: Any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
2. Data Subject: The individual to whom Personal Data relates. For the purposes of this policy, Data Subjects may include both Developers who use our tools and End Users who interact with Developer Applications.
3. Controller: The entity that determines the purposes and means of processing Personal Data. In the context of our Developer Tools, the Developer typically acts as the Controller with respect to the End User data.
4. Processor: The entity that processes Personal Data on behalf of the Controller. Avanquest acts as a Processor when handling End User data as directed by Developers who use our Developer Tools.
5. Developer: A business or individual using the SodaPDF Developer Tools to build and manage applications. Developers are responsible for complying with applicable data protection laws and ensuring that End Users’ rights are respected.
6. End User: An individual who uses the Developer Applications created by Developers. End Users are Data Subjects whose Personal Data may be processed via the Developer Applications.
7. Applicable Laws: All relevant legislation and regulations that govern the processing of Personal Data, including but not limited to Law 25 (Quebec), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and the Health Insurance Portability and Accountability Act (HIPAA).
8. Data Processing Agreement (DPA): A legally binding agreement between a Controller and a Processor that outlines the terms and conditions of data processing activities, ensuring compliance with applicable data protection laws.
9. Business Associate Agreement (BAA): An agreement required under HIPAA for entities that handle Protected Health Information (PHI) on behalf of a covered entity. The BAA outlines responsibilities for safeguarding PHI and ensuring compliance with HIPAA.
10. GDPR (General Data Protection Regulation): A comprehensive data protection law enacted by the European Union, which sets out obligations for organizations that process Personal Data of EU residents and grants rights to Data Subjects.
11. CCPA and CPRA: The California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), are state-level data protection laws that provide California residents with rights over their Personal Data and place obligations on businesses handling such data.
12. HIPAA (Health Insurance Portability and Accountability Act): A U.S. federal law that governs the privacy and security of health information. It requires safeguards to protect the confidentiality and integrity of Protected Health Information (PHI).
13. Technical and Organizational Measures (TOM): Security measures implemented by a Controller or Processor to ensure the protection of Personal Data. TOMs may include encryption, access controls, regular security assessments, and incident response plans.
14. Protected Health Information (PHI): As defined by HIPAA, PHI includes any health-related information that can be linked to an individual, such as medical records or health insurance details.

6. Data Collection

1. Website Visitors

2. Service Users and Account Holders

3. Other Relevant Data Subjects

7. Data Usage

1. Service Delivery: We use data to provide access to the Developer Tools, maintain service reliability, and address technical issues as they arise.
2. Customer Support: Data is utilized to deliver technical assistance, answer queries, and ensure a smooth and enhanced Developer experience.
3. Analytics: We analyze usage patterns to understand how our services are used, evaluate performance, and optimize the Developer Tools for efficiency.
4. Billing and Payments: Personal and payment data are processed securely to manage subscriptions, facilitate transactions, and implement fraud prevention measures.
5. Anti-Fraud and Fraud Detection: We monitor activity and use data to detect, prevent, and address fraudulent or unauthorized activity that may impact our platform or services.
6. Feedback and Feature Development: We collect feedback to improve our offerings and develop new features that align with user needs. This data informs our development roadmap and service enhancements.
7. Improvement and Delivery: Data is also used to tailor and deliver new features, updates, and improvements to the Developer Tools.
8. Monitoring: We monitor the use of our Developer Tools to ensure compliance with our terms, maintain system integrity, and improve service delivery.
9. Email Communications: With your consent, we may use your email address to send service updates, notifications, and promotional offers related to our products.
10. Other: as required for our legitimate business purposes or, as otherwise consented by you.

Retention Period

8. Data Sharing and using third-party tools and services

1. Service Providers and Processors.We engage trusted third-party service providers ("Processors") to help us deliver our services. These include:
   • ● Payment Processors: These partners manage billing, process transactions, and handle refunds securely, ensuring financial information is protected and PCI-compliant.
   • ● Cloud Storage and Hosting Providers: We use cloud services for data storage, backup, and system reliability, ensuring your data is accessible yet secure through redundancy and disaster recovery measures.
   • ● Database and Infrastructure Providers: They support our database management, system performance, and network security to ensure efficient and safe data handling.
   • ● Customer Support Platforms: These tools enable effective communication and manage support tickets, helping us resolve issues and maintain high-quality service.
   • Analytics Providers: We use analytics services to collect and analyze usage patterns, which help us optimize service performance, improve the user experience, and make informed business decisions.
   • Each Processor is subject to contractual obligations to use the data only as instructed, maintain strict confidentiality, and implement robust security measures.
2. Affiliated Companies. We may share Developer data with our Affiliated Companies for purposes consistent with this Privacy Policy, such as enhancing service offerings, providing joint customer support, or conducting internal analysis. These affiliates are bound by similar privacy and security requirements.
3. Legal Requirements and Protection. We may disclose Developer data if we believe it is necessary to:
   • ● Comply with legal obligations: Such as responding to subpoenas, court orders, or other legal processes.
   • ● Protect rights and safety: To defend against legal claims, and protect the rights, property, or safety of Avanquest, our users, or the public.
4. Licensors: We may share data with our licensors or partners as necessary to ensure compliance with licensing agreements or to enable them to support our services.
5. Mergers and Acquisitions (M&A): In the event of a merger, acquisition, asset sale, or other corporate transaction, Personal Data may be transferred to or shared with the acquiring or merging entity. We will ensure that the receiving party upholds the same level of data protection and privacy commitments outlined in this policy.
6. Law Enforcement and Legal Requirements: We may disclose Personal Data to law enforcement agencies, regulators, or other authorities if we are legally required to do so or if we believe in good faith that such disclosure is necessary to comply with legal obligations, protect our rights, investigate fraud, or ensure the safety of our users.
7. Business Partners: On occasion, we may share aggregated, anonymized, or non-personally identifiable information with business partners for research, marketing, or other purposes that support the growth and improvement of our services.
8. Protecting Our Platforms: We may share data as necessary to protect the integrity and security of our platforms. This includes:
   • ● Monitoring and Auditing: Using data to monitor for compliance, conduct audits, and maintain system integrity.
   • ● Automation Tools: Leveraging automated systems to detect and prevent unauthorized access or activities.
   • ● Authorization and Authentication: Using data to authenticate users and manage access controls securely.
   • ● Security Tools: Implementing advanced security measures, such as firewalls, intrusion detection systems, and encryption, to safeguard data and prevent breaches.
9. Protecting Our Interests: We reserve the right to share Personal Data to protect the rights, property, or safety of Avanquest, our users, or the public. This includes sharing information to prevent fraud, reduce credit risk, or secure our network.
10. Consent-Based Sharing. If we need to share your data for purposes not covered in this section, we will obtain your explicit consent. This includes sharing information with partners for marketing or additional service integrations.

Developer Responsibilities

1. Privacy Policy Requirement. Developers are obligated to create and maintain a comprehensive Privacy Policy that is easily accessible to End Users. This Privacy Policy must clearly and transparently outline:
   • ● Data Collection: A detailed description of the types of Personal Data collected from End Users, specifying what information is gathered and for what purposes.
   • ● Data Use: An explanation of how the collected data is processed, stored, and shared, including any third-party data sharing or integration.
   • ● User Rights: Information on End Users' rights under applicable data protection laws, such as the GDPR and Law 25 in Quebec. This should cover the right to access, rectify, or delete Personal Data, and how users can exercise these rights.
2. Consent and Transparency. Developers are required to obtain valid and informed consent from End Users where necessary, ensuring compliance with laws such as the GDPR. This involves:
   • ● Clear Consent Mechanisms: Implementing straightforward options that allow End Users to easily give, withhold, or withdraw their consent for data processing activities. Consent requests should be unambiguous and specific to the intended purposes.
   • ● Transparency: Developers must communicate data processing practices in a way that is easy for End Users to understand. This includes providing clear information about how data is collected, used, and shared, in a format that is accessible and free from complex legal jargon.

10. Compliance and Rights

1. Developer: As Data Subjects, Developers have several rights concerning their Personal Data, including:
   • ● Right of Access: You have the right to request access to the Personal Data we hold about you, including information about how we use and share it.
   • ● Right to Rectification: You can request that we correct or update any inaccurate or incomplete Personal Data.
   • ● Right to Deletion: Also known as the “right to be forgotten,” you can request the deletion of your Personal Data, subject to legal or contractual restrictions.
   • ● Right to Restriction: You may request that we limit the processing of your data under certain conditions.
   • ● Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transfer it to another data controller.
2. End Users: Developers who use the SodaPDF Developer Tools are responsible for addressing Data Subject rights requests from their End Users. This includes requests for access, correction, deletion, or data portability. As a Data Processor, Avanquest will assist Developers in fulfilling these requests to the extent required by law, and in accordance with our contractual obligations. Developers must notify us promptly if they receive such a request from an End User.

11. Legal Bases for Processing

1. Contractual Necessity: Processing is necessary to fulfill our contractual obligations to Developers. This includes providing access to the Developer Tools, managing accounts, delivering customer support, and processing payments. Without this data, we would be unable to perform these services.
2. Legitimate Interests: We process data to pursue our legitimate business interests, provided that such processing does not override the rights and freedoms of data subjects. Examples include improving our services, ensuring platform security, fraud prevention, and conducting business analytics.
3. Legal Obligations: We may process Personal Data to comply with legal requirements, such as financial reporting regulations, responding to legal requests from authorities, or enforcing our terms of service.
4. Consent: Where required by law, we rely on explicit consent from data subjects to process their Personal Data. This basis is often used for activities like sending promotional communications or collecting data that is not necessary for service delivery. Consent must be freely given, specific, informed, and revocable at any time.
5. Compliance with Data Protection Regulations: We adhere to laws like the GDPR and Law 25, ensuring that all data processing activities are lawful, fair, and transparent.

12. Security Measures

Key Security Measures

1. Data Encryption: All sensitive data is encrypted using advanced encryption protocols, both when transmitted across networks and when stored on our servers. This ensures that data remains secure and protected from unauthorized access.
2. Access Controls and Authentication: We enforce stringent access control mechanisms to limit access to Personal Data. Only authorized personnel are granted access based on the principle of least privilege, and multi-factor authentication is used to enhance security further.
3. Secure Software Development: Our development processes include secure coding practices, regular vulnerability assessments, and thorough code reviews to identify and mitigate potential security threats.
4. Regular Security Audits and Assessments: We perform regular security audits and risk assessments to evaluate the effectiveness of our security practices and ensure ongoing protection of Personal Data.
5. Incident Response Plan: We have a well-defined incident response plan to address and mitigate any data breaches or security incidents promptly. This includes notifying affected parties and regulatory authorities, as required by law.

13. Data Retention

1. Criteria for Retention: Data retention periods depend on the type of data and the reason for its collection. We consider factors such as legal obligations, the duration of our relationship with Developers, and the need to comply with financial or contractual requirements.
2. Developer Data: Account information, billing records, and communications are retained for the duration of the service relationship and may be kept for a limited period thereafter for legal, accounting, or audit purposes.
3. End User Data: Data processed on behalf of Developers is retained as per instructions from the Developer, and we comply with requests to delete or anonymize data as required.

14. International Transfers

Transfers from the European Economic Area (EEA) and Switzerland

• ● Standard Contractual Clauses (SCCs): For data transfers outside of the EEA and Switzerland, we use SCCs approved by the European Commission. These are legally binding agreements that ensure the same level of data protection as guaranteed under the GDPR.
• ● Adequacy Decisions: Where possible, we rely on adequacy decisions from the European Commission, which confirm that a country outside the EEA provides an adequate level of data protection.
• ● Supplementary Measures: We may implement additional safeguards, such as encryption and data pseudonymization, to ensure data remains protected during and after the transfer.

Transfers from Quebec and Canada

• ● Compliance with Law 25: Transfers from Quebec must ensure that the recipient country offers an equivalent level of data protection. We evaluate the legal framework of the destination country and, where necessary, use measures like SCCs or binding corporate rules.
• ● PIPEDA and Cross-Border Transfers: For data transfers under the Personal Information Protection and Electronic Documents Act (PIPEDA), we ensure contractual protections are in place to maintain privacy and security standards.

Third-Party Service Providers

Data Subject Rights in Cross-Border Transfers

15. Updates to the Policy

1. Review and Updates: The Privacy Policy is reviewed periodically, and significant changes will be communicated to users through the Developer Console, email, or other appropriate means. The “Last Updated” date will be revised accordingly.
2. User Notification: When changes materially affect your rights or how your data is processed, we will provide notice and, if required by law, obtain your consent before implementing changes.

16. Contact Information

• ● Email: [email protected]
• ● Data Protection Officer (DPO): To contact our DPO, please email [email protected]