Data Processing Addendum
Last updated: July 23, 2026
Draft pending legal review. This is a plain-language summary of our intended processing terms. A countersignable DPA — with the standard contractual clauses and a completed processing schedule — is available to enterprise customers and must be reviewed by counsel before execution.
Roles of the parties
For personal data contained in the documents and account information a Customer submits, the Customer is the controller and doc cure is the processor, processing that data only on the Customer's documented instructions — which include the Customer's use of the Service and these terms.
Scope and purpose of processing
doc cure processes personal data solely to provide the Service: analyzing and remediating documents, generating reports, operating the Customer's account, and providing support. The subject matter is PDF accessibility remediation; the duration is the term of the agreement plus any retention window the Customer selects.
Confidentiality
doc cure ensures that personnel authorized to process personal data are bound by confidentiality obligations and access data only as needed to provide the Service.
Security measures
doc cure maintains appropriate technical and organizational measures, including encryption of data in transit and at rest, tenant isolation, role-based access controls, multi-factor authentication for administrative access, logging, and vulnerability management. Details are summarized on our Trust page.
Subprocessors
The Customer authorizes doc cure to engage the subprocessors listed on our sub-processors page to help provide the Service. doc cure imposes data-protection obligations on each subprocessor and remains responsible for their performance. We will provide a mechanism to notify Customers of material changes to the subprocessor list.
Data subject requests
Taking into account the nature of the processing, doc cure will assist the Customer, by appropriate technical and organizational measures, in responding to requests from individuals exercising their rights. Because the Customer controls the documents it uploads, requests relating to that content are generally handled by the Customer.
Personal data breach
doc cure will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide information reasonably necessary for the Customer to meet its own notification obligations.
Return and deletion
On termination, or at the end of the applicable retention window, doc cure deletes or returns the Customer's personal data from active systems, except where retention is required by law. Residual copies in backups age out on our normal backup cycle.
International transfers
Where doc cure or its subprocessors process personal data across borders, the parties will rely on an appropriate transfer mechanism, such as the standard contractual clauses, incorporated by reference into the signed DPA.
Audits
doc cure will make available information reasonably necessary to demonstrate compliance with this addendum and will contribute to audits as described in the signed DPA, subject to reasonable confidentiality and security safeguards.
Precedence and contact
Where a signed DPA exists, it controls over this summary. To request the countersignable DPA, email privacy@doccure.ai.