Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Syed Mohammad Amaan ("Processor") and business customers ("Controller") using CraftMyDocs, and reflects the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR where applicable.

1. Subject Matter and Duration

The Processor will process personal data on behalf of the Controller for the duration of the Controller's subscription to the Service, and as otherwise necessary to comply with legal obligations.

2. Nature and Purpose of Processing

Personal data is processed to provide the resume/cover-letter builder, AI assistance, document storage and export, and account/billing administration described in our Terms of Service.

3. Categories of Data and Data Subjects

Account holders' name and email; resume/cover-letter content which may include the Controller's employees' or end-users' career history, contact details, and education.

4. Sub-Processors

The Processor uses the following categories of sub-processors:

• Authentication provider (Firebase)
• Cloud hosting / database providers
• AI processing providers (for AI-assisted features)
• Payment processors (e.g. Paddle as Merchant of Record, Razorpay)

The Processor will ensure sub-processors are bound by data protection obligations consistent with this DPA and will notify the Controller of material changes to this list upon request.

5. Security Measures

The Processor implements appropriate technical and organizational measures, including encryption in transit and at rest, access controls, and authenticated session management, to protect personal data against unauthorized access, loss, or destruction.

6. Data Subject Requests

The Processor will assist the Controller in responding to data subject requests (access, deletion, portability) relating to data processed under this DPA, as described in our Privacy Policy.

7. International Transfers

Where personal data is transferred outside the EEA/UK, the Processor relies on appropriate safeguards such as Standard Contractual Clauses.

8. Requesting a Signed Copy

Business customers requiring a signed copy of this DPA for their records should contact support@craftmydocs.com.