Privacy Policy

Last updated: 3 April 2026

This Privacy Policy explains how PDFStore ("we", "us", or "our") collects, uses, and protects your personal data when you use the PDFStore service at pdfstore.co.uk (the "Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

• PDFStore
• Website: pdfstore.co.uk
• Contact: please use our contact form

2. What Data We Collect

Account Data

If you register for an account, we collect your name and email address. Registration is optional — you can use the Service without creating an account.

Transfer Data

When you create a file transfer, we collect:

• Sender email address
• Recipient email address(es)
• File names and file sizes
• Transfer creation date, expiry date, and download activity

Files

Files you upload are stored temporarily on our servers. They are encrypted at rest and are automatically and permanently deleted after the transfer expiry period. We do not access, view, or analyse the contents of your files, except where required by law or to investigate violations of our Acceptable Use Policy.

Technical Data

When you use the Service, we automatically collect:

• IP address
• Browser type and version
• Device information (operating system, screen resolution)
• Pages visited and access times

Cookies

We use essential cookies only — specifically, session cookies and CSRF protection tokens. We do not use tracking cookies, analytics cookies, or third-party advertising cookies. For more details, see our Cookie Policy.

3. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Legitimate interest (Article 6(1)(f)): Processing necessary to provide the Service, prevent abuse, and maintain security.
• Contract performance (Article 6(1)(b)): Processing necessary to fulfil the service you have requested (e.g., delivering your file transfer to recipients).
• Consent (Article 6(1)(a)): Where we seek your consent for specific purposes, such as marketing communications. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): Where we are required to process data to comply with a legal obligation (e.g., responding to law enforcement requests).

4. Where We Store Your Data

Your data is stored on servers located in the United Kingdom and European Union only. We use the following infrastructure:

• Cloudflare R2 — File storage (UK/EU regions)
• DigitalOcean London — Application hosting

We do not transfer your personal data outside the UK or EU. If this changes in the future, we will ensure appropriate safeguards are in place and update this policy accordingly.

5. Data Retention

We retain different types of data for different periods:

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate or incomplete data.
• Right to erasure — You can ask us to delete your personal data (the "right to be forgotten").
• Right to data portability — You can request your data in a structured, commonly used, machine-readable format.
• Right to object — You can object to processing based on legitimate interest.
• Right to restrict processing — You can ask us to limit how we use your data in certain circumstances.

To exercise any of these rights, please use our contact form. We will respond within one month of receiving your request, as required by UK GDPR.

7. Data Sharing

We do not sell, rent, or trade your personal data. We will never share your data with third parties for marketing purposes.

We may share your personal data only in the following circumstances:

• Law enforcement — Where we are legally required to do so, such as in response to a court order, legal process, or request from a law enforcement agency.
• Service providers — With the third-party processors listed below, who process data on our behalf and under our instructions.

8. Third-Party Processors

We use the following third-party services to operate PDFStore:

• Cloudflare, Inc. — CDN, security, and file storage (Cloudflare R2)
• DigitalOcean, LLC — Cloud hosting (London data centre)
• Stripe, Inc. — Payment processing (for future paid features)

Each of these providers has their own privacy policies and processes data under appropriate data processing agreements.

9. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

10. Children

PDFStore is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email (if you have an account) or by posting a notice on the Service. The "Last updated" date at the top of this page will be revised accordingly.

12. ICO Registration

PDFStore is registered with the Information Commissioner's Office (ICO), the UK's independent authority set up to uphold information rights. You have the right to lodge a complaint with the ICO if you believe your data protection rights have been violated.

• ICO website: ico.org.uk
• ICO helpline: 0303 123 1113

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

• Contact: please use our contact form
• Website: pdfstore.co.uk