PDF Meet Privacy Policy

The personal data controller for the purposes of this Policy is the owner of the "PDF Meet" service, created and registered in accordance with Ukrainian legislation. Current details, contact information, address for inquiries and other identifying information may be indicated on the website, in payment documents, offers, invoices, support letters or other official service communications.

For the purposes of the Law of Ukraine "On Personal Data Protection", the service acts as the personal data owner, while certain technical contractors, hosting providers, payment providers, email providers or other engaged services may act as personal data processors within the scope of instructions and contractual relations provided to them.

For personal data inquiries, the user may use the support contact published on the website. If the service appoints a separate contact person or data protection contact, such information may be published additionally.

The Policy applies to the use of the PDF Meet website, document editor, user accounts, login and registration forms, file uploading and editing, document history storage, support inquiries, paid service arrangements if available, and other related digital services and web features under the PDF Meet brand.

The Policy does not regulate the rules of third-party services, websites, payment systems or integrations that have their own personal data processing terms. If you navigate to such a service or use it through PDF Meet, it is recommended to separately review its privacy policy.

Depending on how exactly you use the service, we may process the following categories of data:

• Registration and account data: email, username or profile name, password in protected/hashed form, account identifier, account creation date.
• Authentication and session data: access cookies, service tokens, local technical session identifiers, locale and authorization settings.
• User content: files, PDF documents, images, texts, signatures, annotations, links, document pages, editing history if such feature is provided.
• Payment and transaction data: purchase details, plan, amount, currency, date and payment status, partially masked payment details or tokens transmitted from the payment provider.
• Communication data: content of support inquiries, messages, attachments, replies to emails, data regarding complaints or data subject rights requests.
• Technical and log data: IP address, request time, user-agent, browser, operating system, interface language, time zone, errors, security logs, basic device information.
• Cookies and similar technologies: locale cookies, login cookies, security cookies, and other service identifiers needed for the website to function.

We do not require users to provide special categories of personal data unless it is necessary for a specific feature and has a legal basis. If a user uploads such data in a file on their own, they are responsible for having a proper legal basis for such upload.

We obtain data from several sources:

• directly from you when you create an account, log in, upload a document, edit a file, contact support or make a payment;
• automatically during website use through server logs, browser requests, cookies, local interface settings and other technical mechanisms;
• from payment providers or partners only to the extent necessary to confirm payment, combat fraud or fulfill financial obligations;
• from integrations or contractors to the extent they technically service the service on our behalf.

• to register an account, authenticate the user and provide access to the service;
• to store, open, process, edit, convert and export documents that the user uploads to the service;
• to maintain account security, log actions, detect abuse and prevent fraud;
• to send service notifications, emails regarding login, security, terms changes, support requests and other operational communications;
• to process payments, confirm transactions, maintain payment records, interact with payment providers and resolve payment disputes;
• to support website localization, language settings, session state and other critically necessary technical interface parameters;
• to improve service stability, diagnose technical failures and fix errors;
• to comply with legal requirements, respond to justified requests from government authorities, protect service rights and conduct claims work.

For users in Ukraine and other jurisdictions outside the EEA, we process personal data on grounds provided by applicable law, including consent of the data subject, when processing is necessary for concluding or performing a transaction or providing the requested service, for fulfilling a legal obligation, or in other cases directly permitted by law.

For persons to whom GDPR applies, we primarily rely on the following legal bases:

• contract performance or pre-contractual actions — for account creation, login, providing digital features, working with files, payments and support;
• legitimate interest — for service security, logging, abuse prevention, error diagnostics, technical administration and protection of service rights;
• legal obligation — when we have a legal duty to store, transfer or document certain data;
• consent — in cases where required, for example for certain non-mandatory communications or non-essential cookies, if they are actually used.

If processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out prior to withdrawal.

The service uses cookies and similar technologies at minimum to ensure account login, maintain the service session, remember locale and ensure correct interface operation. At the current stage, the service code directly uses cookies for authorization and locale.

If additional analytics modules, performance measurement, behavioral recording or marketing integrations are activated in the service, their use must comply with this Policy, cookie settings and applicable legislation requirements.

You may restrict or disable cookies through browser settings, but this may result in complete or partial inoperability of the service, including login, session saving, locale or document editing features.

We do not sell user personal data as a separate product. Data may only be transferred to the following categories of recipients:

• hosting, server and infrastructure contractors that ensure service operation;
• payment providers and banking intermediaries — to the extent necessary for payment processing and fraud prevention;
• email and communication providers — if necessary for service emails, access recovery or responding to inquiries;
• technical contractors engaged in service maintenance, support, security or administration;
• analytics, measurement or diagnostic providers — only if corresponding modules are actually activated in the service and to the extent needed for their lawful purpose;
• government authorities, law enforcement, courts or other authorized entities — if required by law or proper legal process;
• a successor or asset acquirer — in case of merger, acquisition, restructuring or other corporate transaction to the extent permitted by law.

Where possible and reasonable, we limit the volume of transferred data to the minimum necessary to achieve the specific lawful purpose.

Since digital infrastructure, hosting providers, email services, CDN, payment or other technical contractors may operate in different countries, personal data may be transferred outside Ukraine and/or the user's country of residence.

If GDPR applies to the user and personal data is transferred to a third country without an adequacy decision, we aim to rely on appropriate safeguards, including standard contractual clauses (SCC), contractual protection mechanisms, technical and organizational security measures or other permissible mechanisms under GDPR.

We retain personal data no longer than necessary to achieve the processing purpose, perform the contract, ensure security, resolve disputes, comply with legal obligations or protect service rights.

• account data — generally for the duration of the account and a reasonable period after its closure for dispute resolution, security and legal compliance;
• files and processing results — for the period necessary to provide service features, document history or technical storage, if such feature is available;
• payment data and accounting confirmations — for the periods required by financial, tax and accounting legislation;
• security logs and technical journals — for the period necessary to protect the service, investigate incidents and diagnose errors.

When data is no longer needed, we delete it, anonymize it or convert it to a format that does not allow identification of the individual, unless otherwise required by law.

In accordance with the Law of Ukraine "On Personal Data Protection", the user as a personal data subject has, among others, the right to:

• know about the sources of collection, location of their personal data, the purpose of their processing and the location of the owner or processor;
• receive information about the conditions for granting access to personal data;
• access their personal data;
• demand correction of inaccurate, incomplete, outdated or unlawfully processed data;
• demand deletion or destruction of data in cases provided by law;
• object to the processing of their personal data in cases provided by law;
• protect their personal data from unlawful processing, accidental loss, destruction or damage;
• file complaints with the Ukrainian Parliament Commissioner for Human Rights or with a court.

To exercise these rights, you may contact the service through published contact details. We may request additional identity verification if this is objectively necessary to protect your data from unauthorized disclosure.

If GDPR applies to you, you may additionally have the right to:

• access personal data and information about purposes, categories, recipients and retention periods;
• rectification of inaccurate data;
• erasure of data in cases provided by GDPR;
• restriction of processing;
• data portability in a structured, machine-readable format where technically feasible and lawful;
• object to processing based on legitimate interest, as well as to direct marketing;
• withdraw consent at any time if processing is based on consent;
• lodge a complaint with the competent supervisory authority in your country of residence, work or place of alleged violation.

We will endeavor to respond to requests within the timeframe required by applicable law. If a request is excessive, repetitive, technically impossible to fulfill or contradicts mandatory law, we may refuse in whole or in part, but will explain the reason.

We apply reasonable technical and organizational security measures appropriate to the nature of the service and processing risks, including access control, logging, role separation, credential protection, server restrictions and other technical means that are available and appropriate at any given time.

However, no method of data transmission or storage on the Internet guarantees absolute security. Therefore, we cannot promise complete and unconditional protection from all possible incidents, especially those that depend on the user themselves, their device, browser, network, malware or third parties.

The service is not intended for knowingly collecting personal data from children without a proper legal basis or consent of a legal representative, if such consent is required by applicable law. If you believe that a child has provided us with personal data without proper grounds, contact us for verification and possible deletion of the relevant information.

We may periodically update this Policy if service functionality, personal data processing composition, legislative requirements or the set of engaged technical contractors changes. The current version is published on the website with the update date.

If changes are material and the law requires separate notification, we may notify users by email, through a banner or other prominent means.

If you have questions about this Policy, exercising data subject rights, account deletion, data correction, access requests or privacy complaints, please contact the current support contact published on the website or in other official service channels.

To help us correctly identify your request, please indicate the account email, a brief description of the issue, the essence of the request and, if possible, the date or context of interaction with the service.