Skip to content
PaperJSX
Sign inEvaluate PaperJSX

Document control · current published version · owner: PaperJSX legal

Data Processing Agreement

Data processing terms for PaperJSX hosted features and customer-controlled personal data.

Last updated: 2026-05-10

PaperJSX Data Processing Agreement

Effective: May 10, 2026

Summary

PaperJSX is primarily local-first. If you only install or run PaperJSX packages locally or in CI and do not send Customer Content to PaperJSX systems, this DPA generally does not apply to that local package use because we do not process Customer Personal Data in your documents or code. This DPA applies when we process Customer Personal Data on your behalf through hosted PaperJSX features, support uploads, enterprise services, or other services where we act as your processor.

This summary is not legally binding. The full DPA below controls.

1. Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Customer," "you") and The Plain Works Co., Ltd. (주식회사 더플레인웍스) ("Company," "PaperJSX," "we," "us," or "our").

This DPA applies when we process Customer Personal Data on your behalf as a processor or subprocessor in connection with PaperJSX, including hosted features, support uploads, enterprise services, or other services where you instruct us to process Customer Personal Data.

This DPA does not apply to:

  • local or CI package execution that does not transmit Customer Personal Data to us;
  • Account Data, billing-administration data, license records, license-validation logs, Service Data, and relationship data that we process as a controller;
  • data processed independently by Paddle, GitHub, npm, customer-controlled CI/CD providers, package registries, or integrations under their own terms;
  • open-source package use governed only by an open-source license.

Capitalized terms not defined in this DPA have the meanings given in the Terms or applicable data protection law.

2. Roles

For Customer Personal Data, Customer is the controller and PaperJSX is the processor. If Customer acts as a processor for another controller, PaperJSX acts as Customer’s subprocessor.

Customer determines the purposes and means of processing Customer Personal Data. PaperJSX processes Customer Personal Data only on Customer’s documented instructions, including the Terms, this DPA, the product configuration, support requests, Order Forms, and written instructions Customer provides.

3. Processing details

Element Description
Subject matter Processing Customer Personal Data submitted to hosted PaperJSX features, support uploads, enterprise services, or other PaperJSX services where Customer instructs processing
Duration The term of the Terms or applicable Order Form, plus the period until Customer Personal Data is deleted or returned
Nature and purpose Receiving, hosting, rendering, transforming, exporting, troubleshooting, securing, backing up, deleting, and supporting Customer Content and hosted PaperJSX workflows
Categories of data subjects Customer’s users, employees, contractors, developers, contributors, clients, end users, document recipients, and any individuals whose personal data appears in Customer Content submitted to PaperJSX systems
Types of personal data Data configured or submitted by Customer, which may include names, emails, job titles, company names, document text, source snippets, templates, metadata, support attachments, generated documents, images, and other personal data included in Customer Content
Sensitive data Not expected. Customer must not submit special-category data, protected health information, payment card data, government identifiers, secrets, credentials, or regulated sensitive data unless a signed Order Form expressly permits it and appropriate safeguards are in place
Frequency As initiated by Customer through hosted features, support uploads, enterprise services, or integrations
Retention As stated in the Privacy Policy, product configuration, Order Form, or Customer instruction

4. Customer responsibilities

Customer will:

  • comply with applicable data protection laws;
  • provide all required notices and obtain all required consents, authorizations, and lawful bases;
  • ensure that Customer Personal Data submitted to PaperJSX is lawful, accurate, and appropriate for the Service;
  • avoid submitting sensitive data unless expressly permitted in writing;
  • configure hosted features, support uploads, access controls, integrations, and retention settings appropriately;
  • respond to data-subject requests where Customer is the controller, with assistance from PaperJSX as required by this DPA.

5. PaperJSX processor obligations

PaperJSX will:

  • process Customer Personal Data only on Customer’s documented instructions, unless applicable law requires otherwise;
  • notify Customer if we believe an instruction infringes applicable data protection law;
  • ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations;
  • implement appropriate technical and organizational measures described in this DPA and the Security Overview;
  • assist Customer with data-subject requests, security obligations, data protection impact assessments, prior consultations, and compliance documentation, taking into account the nature of the processing and information available to us;
  • notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data;
  • delete or return Customer Personal Data at the end of processing as described in Section 10;
  • make available information reasonably necessary to demonstrate compliance with this DPA as described in Section 11.

6. CCPA/CPRA service-provider terms

Where the CCPA/CPRA applies and Customer is a business disclosing personal information to PaperJSX, PaperJSX acts as a service provider or contractor for Customer Personal Data.

Customer discloses Customer Personal Data to PaperJSX only for the following limited and specific business purposes:

  • providing hosted PaperJSX features requested by Customer;
  • rendering, transforming, exporting, storing, securing, troubleshooting, and deleting Customer Content submitted to hosted features;
  • providing support and incident response for Customer-submitted files, logs, or examples;
  • maintaining access controls, abuse prevention, security monitoring, and service integrity;
  • complying with Customer’s documented instructions and applicable law.

PaperJSX will not sell or share Customer Personal Data. PaperJSX will not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than the limited and specific business purposes above, unless permitted by the CCPA/CPRA. PaperJSX will provide the same level of privacy protection required by the CCPA/CPRA for service providers and contractors, will notify Customer if we determine we can no longer meet those obligations, and will help Customer respond to consumer requests as required by applicable law.

7. Subprocessors

Customer gives general authorization for PaperJSX to engage subprocessors. The current list is maintained at paperjsx.com/legal/subprocessors.

We will impose written data-protection obligations on subprocessors that are no less protective than those in this DPA for the relevant processing. We remain responsible for subprocessors’ performance of their obligations.

We will provide at least 30 days’ notice before adding or replacing a subprocessor that processes Customer Personal Data, unless urgent security, legal, or service-continuity reasons require faster action. Customer may object on reasonable data-protection grounds within 14 days after notice. If the parties cannot resolve the objection, Customer may terminate the affected hosted feature or service and receive a prorated refund for the unused prepaid portion of that affected service.

8. International transfers

Customer authorizes PaperJSX and its subprocessors to process Customer Personal Data in Korea, the United States, the European Economic Area, and other locations where the Service and subprocessors operate.

Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country that does not benefit from an applicable adequacy decision, the following apply as appropriate:

  • EU transfers. The EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference. Module 2 applies where Customer is a controller and PaperJSX is a processor. Module 3 applies where Customer is a processor and PaperJSX is a subprocessor. Clause 7 docking is not used unless the parties agree. Clause 9 Option 2 applies with the subprocessor notice period in Section 7. Clause 11 optional language is not used. Clause 17 is governed by Irish law. Clause 18 disputes are before the courts of Ireland. Annex I.A and I.B are completed by the party details and processing details in this DPA. Annex I.C is determined by the data exporter’s competent supervisory authority under Clause 13. Annex II is Section 12. Annex III is the Subprocessors page.
  • UK transfers. The UK International Data Transfer Addendum to the EU SCCs, or the UK International Data Transfer Agreement if selected in an Order Form, applies to restricted transfers from the UK.
  • Swiss transfers. The EU SCCs apply with adaptations required under Swiss law, including references to the Swiss FADP, the FDPIC as the supervisory authority where applicable, and protection for Swiss legal persons where required by Swiss law.
  • Korea. Transfers to Korea may rely on applicable adequacy decisions where available. For onward transfers from Korea to non-adequate jurisdictions, we will use appropriate safeguards where required.

If a transfer mechanism is invalidated or no longer available, the parties will work in good faith to implement a replacement lawful transfer mechanism.

9. Government and law-enforcement requests

If we receive a legally binding request for Customer Personal Data from a public authority, we will, where legally permitted, notify Customer, redirect the authority to Customer where appropriate, and challenge or limit the request where we have reasonable grounds to do so.

We will not voluntarily provide public authorities with direct, unfettered access to Customer Personal Data.

10. Deletion and return

At Customer’s written request, or at the end of the applicable service term, we will delete or return Customer Personal Data within 30 days unless applicable law requires retention or the data is retained in backups, security logs, legal holds, or accounting records.

Backups are protected under this DPA and deleted on a rolling schedule. We will not restore deleted Customer Personal Data from backups except as required for disaster recovery, security, legal, or compliance purposes.

11. Audits and compliance information

Upon reasonable written request, we will provide information reasonably necessary to demonstrate compliance with this DPA, such as security documentation, subprocessor information, retention details, and written responses to security or privacy questionnaires.

If that information is insufficient to meet Customer’s legal obligations, Customer may request an audit by an independent auditor who is not our competitor. Audits require at least 30 days’ notice, must occur during normal business hours, must be limited to systems and records relevant to Customer Personal Data, must preserve confidentiality and security, and may occur no more than once every 12 months unless required by a regulator or following a Personal Data Breach affecting Customer Personal Data. Customer bears audit costs unless the audit confirms a material breach by PaperJSX.

12. Technical and organizational measures

PaperJSX maintains technical and organizational measures designed to protect Customer Personal Data, including:

  • encryption in transit using TLS;
  • encryption at rest through hosting and storage providers where supported;
  • role-based access controls and least-privilege administrative access;
  • multi-factor authentication for administrative systems where supported;
  • logging and monitoring of production access and security-relevant events;
  • vulnerability monitoring and dependency review;
  • network, DDoS, and bot protection through infrastructure providers;
  • incident response procedures;
  • subprocessor review and contractual controls;
  • backup and recovery procedures;
  • separation between local package execution and hosted processing;
  • restricted access to license, entitlement, support, and hosted Customer Content data.

13. Personal Data Breach

We will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include information reasonably available to us, such as the nature of the breach, affected data categories, likely consequences, measures taken or proposed, and a contact point.

We will provide reasonable cooperation to help Customer meet breach-notification obligations. Notification is not an admission of fault or liability.

14. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where the SCCs or applicable law require otherwise.

If this DPA conflicts with the Terms about Customer Personal Data, this DPA controls. If the SCCs, UK Addendum, IDTA, or mandatory transfer terms conflict with this DPA, those transfer terms control for the transfer matters they cover.

15. Term

This DPA takes effect when Customer accepts the Terms, signs an Order Form that incorporates this DPA, or transmits Customer Personal Data to PaperJSX for processing on Customer’s behalf, whichever occurs first. It continues until we stop processing Customer Personal Data.

16. Contact

DPA and privacy requests: privacy@paperjsx.com Legal: legal@paperjsx.com

The Plain Works Co., Ltd. (주식회사 더플레인웍스) Cheonan, Chungcheongnam-do, Republic of Korea