GDPR compliance
Last updated: April 2026
AbsolutePDF operates from Spain and processes personal data under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
Your rights under GDPR
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten")
Ask us to delete your data when there's no legitimate reason to keep it.
Right to restrict processing
Pause our processing of your data while a dispute is investigated.
Right to data portability
Receive your data in a structured, machine-readable format and transmit it elsewhere.
Right to object
Object to processing based on legitimate interest, including profiling.
Rights related to automated decision-making
We don't take decisions about you that have legal effect using only automation.
Right to withdraw consent
If we rely on consent, you can withdraw it at any time.
How to exercise these rights
Email support@absolutepdf.com or by post at C/ creueta, 08870 Barcelona, Spain from the address tied to your account. We respond within 30 days. If we need more time (complex requests), we'll tell you within the first 30 days and explain why.
We may ask for additional verification if the request comes from an address we don't recognise — we don't want to hand your data to someone else.
Data Protection Officer
AbsolutePDF is below the threshold that legally requires appointing a DPO. For any privacy matter, write to support@absolutepdf.com.
Right to complain
If you believe we mishandle your data, you can complain to the Spanish Data Protection Agency (AEPD) or to the supervisory authority of your EU country of residence.
International transfers
All personal data is processed inside the EU/EEA. We don't transfer it outside.
Subprocessors
Stripe (payments), Resend (transactional email), Cloudflare (CDN), OVH (hosting). All are GDPR-compliant and bound by data processing agreements. Website analytics run on a self-hosted, cookieless Plausible instance, so no third-party analytics processor is involved. Ad-campaign attribution is sent to Google Ads server-to-server via its API.
Data breach notification
If a breach poses a risk to your rights and freedoms, we notify the Spanish Data Protection Agency (AEPD) within 72 hours and you directly without undue delay.