PDF Expert Privacy Notice for App

Last updated: August 5, 2022 (view archived versions)

We are Readdle Limited ("Readdle" or "we"), and we provide you with our application "PDF Expert" ("App" or "PDF Expert") under the Terms of Service.

We understand you care about your privacy, and we appreciate the trust you place in us. To justify that trust, we embed the latest data security standards, improve our awareness of privacy matters, and comply with the General Data Protection Regulation and other privacy laws.

This Privacy Notice describes how your personal data is collected, stored, and used and what happens when you use PDF Expert.

We do not collect, track or store any personal data over what we need to provide and improve our products and services.

For us, you can be:

Data subject	Description
User	any natural person or legal entity who uses the App.
Free User	User that uses the App with certain functionality limits on a free basis.
Paying User	User that uses the App on a paid basis or via trial of the paid version.

Table of content

1. Purpose and scope of this Privacy Notice
2. Who we are
3. Personal data in PDF Expert
   • Personal data by source
     • Data we can get from the users
     • Data assigned to the users
     • Automatically-collected, technical, and received by the third parties data
   • Personal data by features
     • App usage
     • Registration of the account
     • Subscription or trial
     • Conversion of the files
     • Login via third-party services
     • Support request
     • Receiving marketing data
     • Invoice history
     • Push notifications
4. Age limitation
5. Term of storage
   • General
   • Backup storage
6. Data transfer outside the European Economic Area
7. Data sharing with third parties
   • Details
   • Data received from third parties
8. Security measures
9. Data subjects rights
   • EU residents
   • U.S. residents
10. Do-not-track requests
11. Privacy Notice update

Purpose and scope of this Privacy Notice

This Privacy Notice is our (data controller) statement to you (data subject) that describes how we collect, use, retain and disclose personal data.

This Privacy Notice applies to the App, available on the App Store.

You own and control the personal data we collect about you. You can choose not to provide certain information or disable it and prevent us from collecting, storing, and processing it.

Please be aware you will not be able to take advantage of some of the PDF Expert’s features in this case.

Who we are

We are the controller of the personal data for the Users from the moment of the User’s consent to the Terms of Service.

This means we determine the amount, purpose, and means of personal data processing when you use the App.

For details about our role as controller and as processor of personal data, please contact us at dpo@readdle.com. You can also send us a letter.

Data Controller	Readdle Limited
Registration number	630281
VAT	IE 3560869EH
Address	Glandore Business Centre, Grand Canal House, 1 Grand Canal Street Upper, Dublin 4, D04 Y7R5, Ireland.
Email	dpo@readdle.com — for privacy questions rdsupport@readdle.com — for other questions

Personal data in PDF Expert

We collect your personal data according to this Privacy Notice when you use the App.

Please note: not every piece of data we receive and store. Even more, mainly the data is stored locally on your device, and we see pseudonymised or even anonymised data.

Mainly, we process technical data and the data you give to us. Some of it you see in your interface, and some of it is processed on the backend.

Client-Side is the part of the App displayed or takes place on the users’ devices Backend is an invisible crucial part of our App, where algorithms operate on the variables and data points.

We can process personal data based on the following legal bases:

• performance of the contract — for processing that is strictly necessary for service provision as written in Terms of Service, technical and customer support;
• legitimate interest — for processing that is reasonable for the user and required for the development of the service;
• consent — for additional processing for specific purposes.

Personal data by source

The data we process is divided into categories by its source:

• data we can get from the Users;
• data assigned to the Users;
• automatically-collected, technical, and received by the third parties data.

Personal data by features

We understand that you might wish to know the details about our privacy practices. We grouped our data privacy processes by features. Please click on each feature to read more.

App usage

Here, we described the data you see in our App.

Pay attention to the fact that we collect your device’s name for security purposes.

Registration of the account

Subscription or trial

Receipt is an electronic document provided by Apple, Stripe, or other charging platform about your payment. It is stored on your device. We receive only a hash (electronic value) to verify the transaction.

Conversion of the files

We provide you with the functionality for the conversion of the files into the different formats.

To convert your files, we use Convert API. The Convert API does not read or collect file content, metadata, or other data from the uploaded files.

Login via third-party services

One of the main parts of our services is designed to make your experience with PDF Expert more comfortable and easy. So we provide you with the possibility to link accounts from 3rd-party services (Apple or Google) for integration and synchronisation of data.

Support request

We may collect your detailed log files to help you with your problem. These log files may contain sensitive personal information and are attached to you.

Pay attention to our practice on the log files:

• iOS or iPadOS – when you address your support request, you can choose whether to add detailed log files or not;
• macOS – when you address your support request, we collect your log files by default.

Receiving marketing data

We may send you marketing data only if you agree to receive it.

Invoice history

To track and issue invoices on time, we process your receipt. We also keep the history of payments, as this is a legal requirement, and we cannot delete this information until the filing of the annual accounts expires.

Push notifications

We can send you small notifications to inform you about changes or updates via pushes from the App. You can allow or disable push notifications in the App Settings on your device.

Age limitation

The services are not directed at individuals under 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information. If you become aware that a child has provided us with personal data, please contact us.

Term of storage

General

After the above respective periods expire, we anonymise the data and store it for statistical and analytical purposes.

We process your personal data based on your consent during the provision of services, during the term of storage (as defined above) or until you withdraw your consent.

You can exercise your right to request us to delete your personal data. In this case, we will delete your personal data from our servers within 30 days of your request.

However, you can exercise your right to delete your data. In this case, we will delete your data from our servers within 30 days of your request.

Storage limitation
Data that are processed on the basis of a performance of the contract	Stored for 3 years after completion of services OR 1 year from the last communication
Data that are processed on the basis of a legitimate interest	Stored for 1 year after the completion of services/unsubscribe OR 1 year from the last communication

Backup storage

We store your data in the backups of databases. We regularly back up our databases: at least once a day and store them 1 week.

Data transfer outside the European Economic Area

The personal data we collect is stored on servers in the USA. The data is stored in the USA by default, but we may need to process your personal data in another country. We also share some data with our service providers in Ukraine.

There is no adequate decision by the European Commission regarding neither the US nor Ukraine. This means that the USA and Ukraine are not deemed to provide an adequate level of protection for your personal data. We use adopted Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

You can read more detailed measures to protect your personal data here and in our Data Processing Agreement.

However, if a data transfer is required to perform a contract or provide you services, we have the right to do so without your consent.

Data sharing with third parties

We use your personal data on the basis of the performance of the contract to provide services and communicate with the users.

We share your personal data with our contractors in the scope we need to provide services and technical and customer support. Also, we can share your data on the following grounds: consent, compliance with the law, and legitimate interest.

Details

Consent. We share your personal data based on your explicit consent.

Compliance with the law. We will disclose your personal data to third parties to the extent that it is necessary:

• to comply with a government request, court order, or applicable law;
• to prevent unlawful use of our App or violation of the Terms of Service and our policies;
• to protect against claims of third parties;
• to help prevent or investigate fraud.

Legitimate interest or performance of the contract: We share your personal data with third parties based on a public offer for processing on our behalf, subject to technical and organisational measures to protect your personal data. We may transfer your personal data to certain companies, consultants, and contractors, as a part of our core team that is hired to provide certain services on our behalf.

We will ask for your consent unless data transfer is part of the contract performance.

Data received from third parties

Also, we can collect some data from third parties.

We share your data with the service providers who, for example, help us:

• operate, develop, and improve the features and functionality of our Website;
• provide you with their services;
• complete your payment transactions;
• fulfil your support requests;
• convert your files;
• communicate with you as described elsewhere in this Privacy Notice.

The scope of the data collected, the purposes, and the legal basis for the processing is determined by the respective privacy documents of these parties:

Security measures

We regularly perform Data Protection Impact Assessments to ensure that we use an appropriate level of technical and organisational measures to prevent accidental or unlawful destruction, loss, alteration, and unauthorised disclosure of or access to personal data transmitted, stored, or otherwise processed. We follow ISO 27001 Standard to put all security controls in place as a basis.

To be more specific, to protect your personal data, we use HTTPS and encryption, divided group and individual access (where appropriate), an alarm system, corporate VPN, and written approved internal policies (like password policy and physical access policy).

Moreover, we systematically monitor our technologies’ state of the art and never forget about the backups. All our contractors are under contractual obligations compliant with the GDPR requirements.

Here you can find information about the steps we mentioned above:

Data subjects rights

EU residents

You, as a data subject, have the right to interact with your data directly or through a request to us. This section describes these rights and how you can exercise them:

If your request is not satisfied, you can file a complaint with the regulatory body — The Data Protection Commission (DPC).

U.S. residents

You, as data subjects, have some special privacy rights. To use them, please contact us.

Note: Depending on the state and legislative requirements, we have from 30 to 60 days to exercise your request with the right to postpone it for 30 days more.

If your complaint is not satisfied, you can file a complaint with the Federal Trade Commission.

Your rights vary depending on the laws that apply to you, but may include:

Do-not-track requests

California residents visiting our websites may request that we do not automatically gather and track information pertaining to their online browsing movements across the Internet.

Such requests are typically made through web browser settings that control signals or other mechanisms that allow consumers to exercise choice regarding collecting personal data about an individual consumer's online activities over time and across third-party websites or online services.

We currently do not have the ability to honour these requests. We may modify this Notice as our abilities change.

Privacy Notice update

This Privacy Notice and the relationships falling under its effect are regulated by the GDPR.

Existing laws and requirements for the processing of personal data are subject to change. In this case, we will publish a new version of the Privacy Notice in the App.

If significant material changes are made that affect your privacy and confidentiality, we will notify you by displaying information in the App and ask for your consent.