Privacy Policy

1. Controller

Top Team GmbH is the controller within the meaning of Art. 4 No. 7 GDPR for the processing activities described in this Privacy Policy.

For privacy-related enquiries, data subject requests, or complaints about data processing, you can contact us using the contact details listed above.

Controller

Top Team GmbH

Address

Hofwiesen 1, 94154 Neukirchen vorm Wald, Germany

Register Court

Amtsgericht Passau

Email

info@pdfcustom.com

Phone

+49 8504 9567738

2. Hosting (Hostinger)

We host pdfcustom.com through Hostinger. When you access the website, Hostinger processes server log data including IP address, date and time of access, requested URL, referrer URL, browser type, operating system, and technical error information.

This processing is required to deliver the website, ensure system security, prevent abuse, and maintain technical stability.

• Purpose: website delivery, infrastructure security, fault analysis, and abuse prevention.
• Legal basis: Art. 6(1)(f) GDPR.

3. Email Services (Zoho Mail)

We use Zoho Mail for business communication, including legal communication, support replies, and responses to privacy requests.

When you send us an email or when we reply to you, Zoho Mail processes sender and recipient addresses, message content, attachments, metadata, and delivery logs.

• Purpose: communication handling, customer support, and legal correspondence.
• Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR, and Art. 6(1)(f) GDPR.

4. Account Registration

When you create an account, sign in, reset a password, or manage account settings, we process account data such as your email address, encrypted authentication credentials, account status, profile data, language settings, billing-related profile fields, and security events connected with account use.

This processing enables user authentication, account administration, saved workspace features, and account security.

• Purpose: account creation, login, account administration, password reset, and security.
• Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

5. PDF Processing

When you use the PDF tools, we process the files and instructions that you actively provide in order to perform the selected operation, such as merging, splitting, compressing, rotating, converting, cropping, or reordering files.

For signed-in users, we also process job metadata such as tool type, title, status, file names, result file names, settings, and timestamps when saved history is enabled for the account.

Normal PDF processing does not permanently store PDF file contents as part of the standard processing workflow.

• Purpose: execution of requested PDF operations and optional display of job history for signed-in users.
• Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

6. Browser-Side Processing

Most PDF processing takes place directly in the browser on the user device. During normal processing, the PDF content remains in the browser session and in local device memory required for the selected operation, previews, and download preparation.

PDF contents are not permanently stored on our systems as part of normal browser-side processing. Temporary local browser storage, in-memory objects, and downloaded result files are created on the user device as part of the technical workflow.

• Purpose: local execution of PDF operations with minimal server-side file persistence.
• Legal basis: Art. 6(1)(b) GDPR.

7. Contact Forms

When you use the contact form, we process your name, email address, message content, source page, submission time, and related communication data in order to respond to your request and document the communication.

Contact form submissions are stored in the application and forwarded through our communication systems for support and legal handling.

• Purpose: processing of enquiries, support requests, and legal/privacy communication.
• Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR, and Art. 6(1)(f) GDPR.

8. Analytics

Product analytics is currently not active on PDFCustom.

If analytics is activated later, this Privacy Policy and the consent controls will be updated to match the live setup before analytics processing begins.

• Purpose: no active analytics processing at this time.
• Legal basis: not applicable until analytics is activated.

9. Error Monitoring (Sentry)

We use Sentry to detect application errors, trace crashes, analyse technical faults, and maintain the stability and security of the service.

Sentry processes technical error data such as stack traces, request context, browser and device information, timestamps, and event identifiers. This processing supports debugging, incident response, and technical maintenance.

• Purpose: error analysis, technical maintenance, service security, and service reliability.
• Legal basis: Art. 6(1)(f) GDPR.

10. Advertising Technologies

The free plan can contain advertisements. Premium plans remove advertisements. Advertising-related storage and advertising cookies are used only after the user has given consent through the consent banner or account consent settings, unless a specific technology is strictly necessary under applicable law.

Advertising technologies process consent choices, device identifiers, browser information, ad delivery data, and measurement data needed for displaying advertisements and limiting or evaluating ad delivery. Advertising placements are limited to eligible public content pages and do not appear inside active PDF processing or editor workflows, account areas, authentication flows, checkout, or privacy and legal pages.

• Purpose: financing of the free plan through advertising and measuring ad delivery.
• Legal basis: Art. 6(1)(a) GDPR for non-essential advertising storage and cookies; Art. 6(1)(f) GDPR for strictly necessary anti-abuse and delivery-security measures.

11. Google AdSense and Future Advertising Providers

When Google AdSense is configured for PDFCustom and you have given the required advertising consent, Google AdSense can be used to display advertisements on eligible public pages in the free plan. Google AdSense or a similar future provider can process advertising identifiers, browser information, IP-related delivery data, consent signals, and interaction data required for ad delivery, reporting, and fraud prevention.

Premium plans are ad-free and do not display Google AdSense ad units as part of the subscribed service experience.

• Purpose: advertisement display, ad performance reporting, and fraud prevention in the ad-supported free plan.
• Legal basis: Art. 6(1)(a) GDPR for advertising cookies and similar technologies.

12. Payment Processing and Paid Plans

Paid checkout is not currently active on pdfcustom.com.

If paid billing is activated later, Stripe will process payment and subscription data for checkout, recurring billing, invoice generation, payment confirmation, fraud prevention, and financial recordkeeping. At that point, the live checkout flow, billing settings, and this Privacy Policy will be updated to match the active payment setup.

• Purpose: payment processing, subscription administration, invoicing, fraud prevention, and financial compliance.
• Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR, and Art. 6(1)(f) GDPR.

13. Data Retention

We retain personal data only for as long as required for the relevant processing purpose or for statutory retention obligations.

• Account data: stored until account deletion, unless statutory retention obligations require longer storage for specific billing or tax-related records.
• Saved job metadata: stored until deletion by the user, deletion of the account, or completion of a valid deletion request.
• PDF contents from normal browser-side processing: not permanently stored as part of standard processing.
• Contact messages and privacy requests: stored for as long as required to process the request, document the response, and comply with legal obligations.
• Analytics and advertising consent data: stored according to the configured consent and platform retention settings.
• Billing and tax records: stored for the retention periods required under German commercial and tax law once paid billing is activated.

14. International Transfers

Some service providers process personal data outside the European Union or the European Economic Area. In those cases, we use transfer mechanisms recognised under the GDPR, including adequacy decisions or the European Commission Standard Contractual Clauses where required.

International transfers occur in connection with infrastructure, analytics, monitoring, advertising, email, and future payment services if the relevant provider processes data from locations outside the EU/EEA.

15. GDPR Rights

You have the rights provided by the GDPR, including the right of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR, restriction of processing under Art. 18 GDPR, data portability under Art. 20 GDPR, and objection under Art. 21 GDPR.

If processing is based on consent, you can withdraw that consent at any time with effect for the future under Art. 7(3) GDPR.

16. Account Deletion Requests

You can submit an account deletion or personal data deletion request through the account settings area or by contacting info@pdfcustom.com.

When we receive a deletion request, we verify the request, process deletable account data, and retain only the data that must continue to be stored under statutory retention obligations or for the establishment, exercise, or defence of legal claims.

17. Complaints to Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR if you believe that the processing of your personal data violates the GDPR.

You can contact, in particular, the supervisory authority responsible for your habitual residence, your place of work, or the place of the alleged infringement.