Data Processing Agreement (DPA)

This Data Processing Agreement (DPA) forms part of the Terms of Service between WFA Support Ltd ("Processor", company number 11535469) and the Customer ("Controller").

Processing Details

Item	Details
Subject matter & Duration	Digital form creation, workflow, signature capture and PDF generation services for the term of the agreement.
Nature & Purpose	Receiving, storing, processing and returning form submissions as instructed by the Controller.
Types of Personal Data	Any personal data included in forms (names, contact details, signatures, photos, addresses, financial or health data, etc.), and the GPS location and time the mobile app records as each answer is completed and when a form is submitted, where the app user allows location access.
Categories of Data Subjects	Controller's employees, customers, clients and other individuals whose data appears in the uploaded forms.

Customers should avoid uploading special-category or highly sensitive personal data unless it is necessary, lawful, and appropriate for their use of the service.

The Controller is responsible for having a lawful basis for the location recorded by the mobile app, and for telling its staff and other app users that their location is recorded when they complete forms.

Processor Obligations

• Process personal data only on documented instructions from the Controller (unless required by UK law).
• Ensure confidentiality of all personnel with access to the data.
• Implement appropriate technical and organisational security measures.
• Not engage sub-processors without appropriate authorisation and safeguards. Current sub-processors are listed on our Sub-processors page.
• Assist the Controller with data subject rights requests and security breach notifications.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data.
• Delete or return all personal data at the end of the contract (at the Controller's choice), unless UK law requires retention. Export, deletion, backups and operational copies are handled in line with our Data Retention Schedule.
• Make available information reasonably necessary to demonstrate compliance, subject to reasonable notice, scope, confidentiality and use of remote evidence where appropriate.

Security Measures

• Access to customer areas requires authenticated accounts.
• Role and permission checks are used to restrict access to customer-specific data.
• HTTPS is always used to protect data in transit.
• Session cookies are configured with security-focused settings.
• Application and access logs may be used to monitor security and diagnose issues.
• Core hosting is provided in the United Kingdom.
• Uploaded files and generated documents are access-controlled through account and permission checks.
• Backups and operational copies may be used for resilience and recovery, subject to retention controls.

Sub-processor changes

We maintain the current sub-processor list at /sub-processors. Where a material new sub-processor is introduced, we will update the list and provide notice where required by applicable law or contract.

International Transfers

Core infrastructure is hosted in the UK by 24host.uk. Limited transfers may occur where sub-processors process data outside the UK. Current sub-processors and transfer context are listed on our Sub-processors page.

Liability

Processor liability is subject to the limitations set out in the main Terms and Conditions.

By using Straight2PDF, the Customer agrees to this DPA. For any custom amendments, please contact privacy@straight2pdf.co.uk.