PRIVACY POLICY AND DATA PROCESSING TERMS

Last updated: October 12, 2026

The Privacy Policy and Data Processing Terms complement the ConvertAPI Terms of Service (Master Service Agreement) and apply to data processing by UAB ConvertAPI (further referred to as “ConvertAPI”, “we”, “us” or “our”) for the Client (further referred as “Client”, “you” or “your”).

Definitions used in this Privacy Policy shall have the following meanings:

“Data protection laws” mean Regulation (EU) 2016/679 of 25 May 2018 and any mandatory national or international regulation applicable to personal data processing.

“Document” means any information, data, file, or document the Client may upload to the Services infrastructure and/or Website for the purposes of the Services.

“Services” and “Website” shall have the meaning as defined in the ConvertAPI Terms of Service (Master Service Agreement).

Other definitions shall be understood as they are defined in the Data Protection Laws and/or the ConvertAPI Terms of Service (Master Service Agreement).

HOW WE PROCESS PERSONAL DATA

ConvertAPI offers online Document processing services, which are described and defined in ConvertAPI Terms of Service (Master Service Agreement). When using such Services and Website, the Client may upload, process, and store Documents containing personal data of the Client or third parties on the Services and/or Website.

As a general rule, ConvertAPI strictly acts as a personal data processor (as detailed in Appendix No 1, second table) and accesses, collects, acquires, receives, transfers, processes, and/or uses any personal data only for the purposes of rendering the Services and ensuring proper functionality of the Website.

ConvertAPI may act as the data controller (as detailed in Appendix No 1, first table) only when processing personal data pertinent to your Services user account on the Website, and as it is needed to perform contractual obligations under ConvertAPI Terms of Service (Master Service Agreement), as well as to process your Services orders and to get in touch with you.

More detailed information about data processing by ConvertAPI is disclosed in Appendix 1.

There is no statutory obligation for you to provide your data to ConvertAPI. However, you cannot use some of our Services if you do not provide your data to us. Your decisions to provide us with your personal data and use Services for Document processing are completely voluntary.

If appropriate, we may set out the terms of this Privacy Policy and Data Processing Terms in the individual written Data Processing Agreement. However, unless the individual Data Processing Agreement is signed the terms of this Privacy Policy and Data Processing Terms will apply to all our processing of any personal data.

CATEGORIES OF PERSONAL DATA THAT ARE PROCESSED

When acting as the data processor, we transiently process only the personal data contained in the Documents. The categories and scope of such processing are entirely dependent on you. We do not independently access, store, save, process, or perform any operations on such data without your direction.

When acting as the data controller, we process your IP address, Services session data and your user account data, including your email address and payment information. Our Website also uses web analysis tools and cookie tools, as indicated in our cookie notice. Cookies generate information about how you use the Website, and our server saves this information. You can prevent cookies from collecting this information by changing your internet browser's settings. However, if you do this, you may be unable to use all of the functions on our website.

If you pay for Services using a payment card, we do not collect and store any payment information, such as payment card numbers or verification codes. You disclose this information only to the respective payment processor used by ConvertAPI.

OUR DATA PROCESSING OBLIGATIONS

ConvertAPI processes personal data contained in the Documents on your behalf and only by following instructions made by you electronically (your action or direction on the Website), and only to the scope determined by you. Standard processing pertaining to personal data subjects, terms, purposes, procedure of personal data processing, also with categories of personal data subjects are listed in Appendix 1.

ConvertAPI ensures compliance of personal data processing with the Data protection laws and pertinent instructions by supervisory authorities. ConvertAPI has no reasonable means to, and does not verify, and has no obligation to verify that Client is a legitimate data controller for the personal data that the Client included into the Documents and processes through the Services. It is the sole responsibility of the Client to maintain the legitimacy of such data processing.

ConvertAPI may reasonably assist you in fulfilling data controller’s obligations arising from the Data protection laws, including but not limited to your obligations with respect to the data subjects rights, e.g. right of access by the data subject, right to rectification, right to erasure, right to restriction of processing.

ConvertAPI will implement all appropriate technical and organisational data security measures (as detailed in Appendix No 1) to ensure security and confidentiality of data processing in accordance with the Data protection laws. ConvertAPI will not perform any action, which would cause the Client to act in violation of the Data protection laws.

ConvertAPI will not transfer or otherwise disclose any personal data or other information relating to personal data processing to any other third party, other than third-party sub-processors as described below, or authorized government institutions. ConvertAPI will notify you about situations, where it must disclose personal data processed on your behalf in order to fulfil obligations stipulated in the Data protection laws, unless this is precluded by the applicable law.

THIRD-PARTY SUB-PROCESSORS

The Services and Website are hosted on a secure third-party cloud platform, with data processing locations determined based on your configuration. For example, if you configure the API to use EU-based servers, data will be processed and stored within the EU. To deliver our Services, we may engage third-party providers for data storage and processing, ensuring compliance with applicable data protection standards. ConvertAPI is responsible for all sub-processing of personal data by such third parties.

You agree and consent that such third parties, which are indicated in Appendix 1 or otherwise clearly disclosed, will be engaged by ConvertAPI as sub-processors of personal data. Before engaging new or changing the existing third-party sub-processors of personal data, we will communicate and/or disclose this to you by providing third-party details and other pertinent information.

ConvertAPI undertakes to execute its best efforts to ensure that all third-party sub-processors observe all applicable data protection laws and are bound by privacy rules that meet all applicable requirements required by data protection laws.

You have the right to object, at any time, to the processing of your personal data based on our legitimate interests or for direct marketing purposes.

• Legitimate Interests: If our processing of your personal data is based on our legitimate interests, you may object to this processing by providing a specific reason related to your particular situation. Upon receiving your objection, we will evaluate your request and cease processing your data unless we have compelling legitimate grounds to continue or if the processing is necessary for the establishment, exercise, or defense of legal claims.
• Direct Marketing: You have the absolute right to object to the processing of your personal data for direct marketing purposes at any time without providing any specific reason. If you object, we will stop using your personal data for such purposes immediately.

To exercise your right to object, please contact us at privacy@convertapi.com. We will respond to your request within the applicable legal timeframes.

TRANSFER OF PERSONAL DATA OUTSIDE THE EEA

For clients using proper domain (REST API endpoint) configuration in the European Economic Area (EEA) and for clients in the rest of the world except the United Kingdom (UK), ConvertAPI will not transfer personal data beyond the EEA without prior written consent of the Client. Upon receipt of the consent of the Client to transfer the personal data but before sending that data beyond the EEA, ConvertAPI must enter into a valid personal data transfer agreement complying with the provisions of Chapter V of Regulation (EU) 2016/679 and/or applicable international law.

For clients in the UK, ConvertAPI will process personal data only within the UK, as detailed in Appendix 1.

DATA SECURITY AND DATA BREACH NOTIFICATIONS

ConvertAPI uses and maintains appropriate technical and organizational measures to ensure the security of personal data processing and to protect personal data from accidental loss, destruction, damage, theft, alteration, unauthorized disclosure or unauthorized access, and from any forms of unlawful processing. These measures shall be appropriate to the harm that might result from any unauthorized or unlawful processing, accidental loss, destruction, damage, or theft of the personal data and having regard to the nature of the personal data. Technical and organizational security measures employed are based on the regular risk assessment, as well as the nature, scope, context, and purposes of the processing, damage likelihood, and risk severity for the rights and freedoms of the data subjects.

ConvertAPI shall ensure the reliability and confidentiality obligations of all personnel who may have access to the processed personal data. Furthermore, ConvertAPI shall ensure that in each case the access to personal data is strictly limited to those individuals who need to know or access the relevant personal data, as strictly necessary for the purposes of the Services, and in compliance with the applicable Data protection laws.

ConvertAPI undertakes to timely perform all obligations under the Data protection law to assist the Client in case of a personal data breach in order to reduce negative consequences of such a breach, also to immediately notify the Client about any incident relating to personal data and unauthorised access to personal data as required by the Data protection laws.

ConvertAPI ensures that these requirements apply to all third-party sub-processors.

DATA SUBJECT RIGHTS

Data subjects shall have the right to information about personal data that we process. If data subjects requests for information are not signed by a certified electronic signature, we will require original identity documents to be presented in person. Data subjects also have a right to rectification or deletion or restriction of processing, as it is applicable under the applicable Data processing laws. Furthermore, in accordance with legal requirements, data subjects have the right to object to us against the processing of specific data. Data subjects also have the right to data portability, as well as the right to lodge a complaint about the processing of personal data to a competent data protection authority. All rights shall be executed in a reasonable and economical way. ConvertAPI will ensure that data subjects rights requests are addressed free of charge at least once within each twelve (12) month period.

DATA PROCESSING AUDIT

ConvertAPI undertakes to provide reasonable disclosures, which would be sufficient for the Client to perform data processing risk assessment and ensure that personal data processing by ConvertAPI complies with the requirements of the Data protection laws.

At Client's reasonable written request provided no less than four (4) weeks in advance and subject to advance payment of reasonable costs, ConvertAPI shall allow the Client to audit processing of the personal data of the Client. The audit shall be conducted in a way that the audit would not interfere with normal operation of the Services, Website, ConvertAPI and other clients of ConvertAPI.

Audits may be initiated by mutual agreement if there are justified causes or if a court or data protection authorities mandate them. The audit shall be conducted by a competent and independent auditor whose candidacy must be communicated in advance to ConvertAPI and allow ConvertAPI to reasonably object to unsuitable candidates.

DATA PROCESSING PERIOD AND TERMINATION OF PROCESSING

This Privacy Policy is applicable for as long as ConvertAPI processes the personal data of or on behalf of the Client. We delete all your registration data either within 24 months following the last usage of the ConvertAPI service, as soon as you delete your user account with us, or once the statutory retention period expires. Data processing shall be terminated if there are no legal grounds for processing according to the applicable laws and/or the Client requests the termination of such processing.

You can delete your user account yourself in your user account or by requesting it in writing.

Upon termination of Services, the data processing may continue in the scope required by the applicable laws.

Upon termination of the data processing, ConvertAPI shall delete and destroy all Documents and personal data provided by the Client, except data required according to the applicable law. ConvertAPI shall ensure that all third-party sub-processors comply with the data processing termination.

LIABILITY

ConvertAPI's liability for any losses resulting from the breach of the Data protection laws caused through the fault of ConvertAPI or third-party sub-processors is established according to the applicable law and in no event shall be greater than 5 (five) times the aggregate amount paid by the Client to ConvertAPI for Services during the last twelve (12) months. ConvertAPI liability is limited to direct damages.

In addition, where liability is covered under ConvertAPI’s insurance policy, liability shall extend to the applicable policy limits, provided such liability is not otherwise excluded by the terms of the Master service agreement or this policy.

DISPUTES

Any disputes resulting from data protection matters shall be settled in the Republic of Lithuania courts. The parties shall seek complete confidentiality of the information about applying to a court, information about a process of examination of a case, and a judgement confidential. Laws of the Republic of Lithuania shall apply.

CONTACT INFO AND COMMUNICATION

Data processing is done by ConvertAPI, UAB, a company registered in the Republic of Lithuania, address Lauksargio g. 111, Vilnius LT-10105, Lithuania, company code 304461332.

For all further inquiries about personal data processing by ConvertAPI, please contact ConvertAPI DPO at privacy@convertapi.com.

Appendix No 1

1. Personal data related to contract management (where we act as data controllers):

Personal data is transferred to ConvertAPI for the following purposes:	To manage contracts with Clients while providing Services by ConvertAPI
Categories of personal data being transferred:	Contract-related Personal Data may include personal contact information such as full name, phone number, and email address; details including employer name, job title and function, and business contact details; payment card-related data; IP addresses; and interest data.
Categories of data subjects:	Data subjects may include Client representatives and end users, such as employees, contractors, collaborators, partners, and Clients.
Personal data processing operations carried out by ConvertAPI:	Data deletion, storage, systematization, analysis, transfer, making copies. All these operations can be done only to provide Services.
Place of Personal data processing operations:	At ConvertAPI UAB head office in Vilnius, Lithuania. IBM data centers: for customers using the EEA domain (REST API endpoints) located within EEA; for customers using the US domain (REST API endpoints) located within the US; for customers using UK domain (REST API endpoints) within UK. For specific IBM data center locations within each domain, please refer to https://www.convertapi.com. Designated EEA business locations of third parties, indicated below.
Technical and organizational measures for storage of personal data:	access to Personal Data is restricted, controlled and recorded; access to personal data has been allowed to only those employees, who require the personal data to perform their functions and only to the extent required to perform their functions. access of unauthorized persons to premises where the personal data have been stored is strictly restricted; upon expiry of the personal data storage period, secure destruction of the personal data is ensured; persons, having access to the personal data, use at a minimum password of at least 10 characters long and containing uppercase letters, lowercase letters and digits and passwords are changed at least every year or if compromise is suspected. only encrypted communication channels are utilized to transfer personal data.
Third Parties:	IBM Cloud Services, as Personal Data could be stored encrypted at IBM Cloud Services data centres, so IBM engineers can impact physical security and availability of physical equipment and computer networks. Google Ireland Ltd. provides email and the support mailbox for ConvertAPI (Google Workspace), where personal data can be processed through e-mail communication with the client and the resolution of client requests. Paddle.com - payment processor. Mezmo Inc. is used for operational log storage, analysis, and alerts. Cloudflare, Inc. provides DNS, content delivery, web application firewall and DDoS protection for the Website and Services, so IP addresses and request metadata pass through its network. Postmark (ActiveCampaign, LLC) sends ConvertAPI's transactional e-mail (account, billing and support notifications), so recipient e-mail addresses and message content are processed. GitHub, Inc. hosts ConvertAPI's support case records, so client contact details and the content of support requests are processed.

2. Personal data processed during Document conversion (where we act as data processors):

Personal data is transferred to ConvertAPI for the following purposes:	To provide Services by ConvertAPI to the Client.
Categories of personal data being transferred:	While using the ConvertAPI service, the Client may upload Documents containing Personal Data, which are processed using automated methods, and no persistent storage is utilized. ConvertAPI does not access the contents of Documents while Document is processed so in this case categories to be maintained by Client, and Personal Data may include personal contact information such as full name, phone number, email address; details including employer name, job title and function, business contact details; IP addresses and interest data.
Categories of data subjects:	Data subjects may include Client representatives and end users, such as employees, contractors, collaborators, partners, Clients.
Personal data processing operations carried out by ConvertAPI:	Data deletion, storage, systematization, analysis, transfer, making copies. All these operations can be done only to provide services.
Place of Personal data processing operations:	IBM data centres: for customers using EEA domain (REST API endpoints): located within EEA; for customers using US domain (REST API endpoints) located within US; for customers using UK domain (REST API endpoint) within UK. For specific IBM data centre locations within each domain, please refer to https://www.convertapi.com/.
Technical and organizational measures for storage of personal data:	access to Personal Data is restricted, controlled and recorded; access to personal data has been allowed to only those employees, who require the personal data to perform their functions and only to the extent required to perform their functions. access of unauthorized persons to premises where the personal data have been stored is strictly restricted; upon expiry of the personal data storage period, secure destruction of the personal data is ensured; persons, having access to the personal data, use at a minimum password of at least 10 characters long and containing uppercase letters, lowercase letters and digits and passwords are changed at least every year or if compromise is suspected. only encrypted communication channels are utilized during the transfer of personal data. personal data is encrypted while (if) stored;
Third Parties:	IBM Cloud Services, as Personal Data could be stored encrypted (non-persistent, only temporarily storage up to 3 hours, depending on configuration used by Client) at IBM Cloud Services data centres, IBM engineers can impact physical security and availability of physical equipment and computer networks but not access Personal Data, during processing or short-term storage (if applicable). Cloudflare, Inc. provides network security (web application firewall, DDoS protection) and traffic routing in front of the REST API endpoints, so Documents pass through its network in transit. GitHub is used for application source code repositories. Mezmo Inc. is used to store operational logs, analyses, and alerts.