Data processing agreement (DPA) — AccesPub portal and API

Version 1.2 · in force from 6 November 2026 · new: detail of what is sent to the AI for each suggestion (annex, nature of the processing) · English translation; the Spanish version prevails

This agreement governs how ab serveis processes, on behalf of the client organisation, the personal data that it uploads to or generates in the AccesPub portal and API, as required by Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Parties and subject matter

  • Controller: the organisation that contracts the AccesPub portal or API (the "Client"), as identified in its contract, quote or order. If the Client processes the data on behalf of another entity (for example, a service company that remediates its clients' books), it acts as a processor and section 5 also applies.
  • Processor: Alberto Barajas González, trading as ab serveis, Spanish tax ID 46629726D, Joan Miró, 19 — 08319 Dosrius (Barcelona), Spain, info@abserveis.net ("ab serveis").

The subject matter is the provision of the accessibility remediation service for e-books (EPUB): analysis, automatic fixes, AI suggestions, human review and generation of the accessible EPUB, its reports and the accessibility ONIX.

2. European Commission standard contractual clauses

The parties incorporate into this agreement, by reference and without modification, the standard contractual clauses between controllers and processors adopted by Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (Section I, Clauses 1 to 6, and Sections II and III, Clauses 7 to 10). Those clauses meet the requirements of Article 28(3) and (4) GDPR.

To complete them, the parties choose and specify:

  • Clause 5 (docking clause): does not apply.
  • Clause 7.7 (sub-processors): Option 2, general written authorisation. The Client authorises the sub-processors on the published list. ab serveis will notify the organisation's administrators by email at least 30 days in advance of any addition or replacement and will update the list. If the Client objects on reasonable data protection grounds and no alternative is found, it may terminate the contract without penalty.
  • Clause 9 (personal data breaches): ab serveis will notify the Client of any personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
  • Annexes I to III are the following sections of this agreement. Annex IV is not used because Option 2 of Clause 7.7 applies.

In case of conflict between this agreement and the standard contractual clauses, the clauses prevail.

Clients outside the European Economic Area. If the Client is established outside the EEA, ab serveis processes the data in the EU in accordance with the GDPR. Insofar as ab serveis sends personal data to the Client (for example, when results are downloaded), the standard contractual clauses of Implementing Decision (EU) 2021/914, Module Four (processor to controller), also apply.

3. Acceptance and term

This agreement forms part of the service contract for the AccesPub portal and API, governed by its terms of service. It is accepted by signing the contract, quote or order that refers to it, or by activating the organisation in the portal. On request, ab serveis will send the Client an electronically signed copy with Annex I completed.

It remains in force while ab serveis processes data on behalf of the Client. Confidentiality obligations survive its termination.

4. End of the service: return and deletion

Before termination, the Client can download its EPUB files, reports, ONIX and manifests from the portal or the API. Within 30 days of the end of the contract, ab serveis will delete the Client's data, except what the law requires it to keep; backups are deleted when their 14-day period expires. On request, ab serveis will confirm the deletion in writing.

5. Clients processing data on behalf of third parties (sub-processing)

This section applies when the Client uses AccesPub to process personal data on behalf of another entity that is the controller (the "End Controller"): for example, a publishing services company that remediates the books of the publishers or authors that hire it.

  • Roles. The Client acts as processor of the End Controller and ab serveis as sub-processor of the Client (Article 28(2) and (4) GDPR). This agreement is the sub-processing agreement between them. In the incorporated standard contractual clauses, the Client takes the position of "controller", and its instructions to ab serveis must be consistent with those it receives from the End Controller.
  • Authorisation. Before uploading an End Controller's files, the Client must have its prior specific or general written authorisation to engage ab serveis and the sub-processors on the published list. The Client informs the End Controller of the identity of ab serveis and those sub-processors.
  • Equivalent obligations. The Client checks that this agreement imposes on ab serveis data protection obligations at least equivalent to those it has towards the End Controller. If its contract with the End Controller requires more (for example, shorter notification periods or a specific data location), the Client must tell ab serveis before uploading its files; if ab serveis cannot comply, the Client will not use the service for that data.
  • Changes of sub-processors. The Client passes on to the End Controller, without delay, the notices of new or replaced sub-processors it receives from ab serveis (clause 7.7, 30 days in advance). If the End Controller objects on reasonable grounds, the Client may stop processing its data in AccesPub or terminate the contract without penalty, under clause 7.7.
  • Relationship with the End Controller. ab serveis deals only with the Client: it receives its instructions, notifies it of personal data breaches (within 48 hours) and gives it the assistance of clauses 7 to 9 so that the Client, in turn, can assist the End Controller. ab serveis does not deal directly with the End Controller unless the law requires it or the Client has factually disappeared or ceased to exist in law; in that case, the End Controller may exercise against ab serveis the rights under this agreement, including requesting the return and deletion of its data.
  • Information and audits. Information or audit requests from the End Controller are channelled through the Client. ab serveis gives the Client the information needed to demonstrate compliance (clause 7.6).
  • Liability. The Client remains liable to the End Controller for ab serveis's performance, as set out in Article 28(4) GDPR, without prejudice to what the Client and ab serveis owe each other under this agreement and the terms of service.
  • End of an End Controller's assignment. When its relationship with an End Controller ends, the Client deletes its titles and batches in the portal or the API (deletion removes the files; backups expire after 14 days). We recommend organising batches by End Controller to make this easy.
  • List of controllers. The Client keeps the list of the End Controllers on whose behalf it processes data in AccesPub and gives it to ab serveis on request to meet a legal obligation or handle an incident.

Annex I — List of parties

Controller: the Client (name, tax ID, address, contact person and position, as stated in its contract). Signature and date: in the contract, quote or order, or in the signed copy of this agreement. If the Client processes data on behalf of third parties, it acts as a processor and keeps the list of End Controllers itself (section 5).

Processor: Alberto Barajas González (ab serveis), Spanish tax ID 46629726D, Joan Miró, 19 — 08319 Dosrius (Barcelona), Spain. Contact: Alberto Barajas González, owner, info@abserveis.net.

Annex II — Description of the processing

Categories of data subjects

  • People who appear in the content of the books: authors, translators, illustrators, photographers and people mentioned or portrayed.
  • The Client's users of the portal and API: its own staff and reviewers, including external reviewers invited by the Client.

Categories of personal data

  • Whatever the book contains: names, images, biographical texts, dedications and any other data the Client includes in its files.
  • About users: name, email, role, review decisions with their author and date, and support messages.

Sensitive data. AccesPub does not search for or classify special categories of data. If a book's content includes them (for example, a memoir), they are processed with the same measures and only for the purpose of the service.

Nature of the processing

  • Storage, automatic analysis and conversion of the EPUB.
  • Sending to the AI (Google Gemini, paid API) what each suggestion needs, only when the Client asks for it (a user requests a suggestion, or the Client turns on AI suggestions for a batch or a title): for alternative text, the image, the text around it in the book (at most about 300 characters before and 300 after, or its caption) and the language; for a table caption, the table text and the text around it; for the description and subjects, an excerpt of the book (about 4,000 characters) with its title. The AI suggests; a person decides.
  • Human review in the portal or through the API.
  • Generation of the accessible EPUB, its reports and the accessibility ONIX.
  • Sending service emails to users.
  • Sending automatic notifications (webhooks) with the title or batch data to the addresses the Client itself configures, and portal sign-in links requested by its integration.

Purpose. Providing the Client with the accessibility remediation service and the associated outputs. ab serveis does not use the data for any other purpose or to train AI models.

Duration and retention

  • EPUB files of finalised or failed titles: deleted after 30 days.
  • Titles under review: until they are finalised or the Client deletes them.
  • Reports, validations and decisions: for the term of the contract.
  • Daily backups: 14 days.
  • At the end of the contract: deletion within 30 days (section 4).

Annex III — Technical and organisational measures

  • Encryption in transit: all access is over HTTPS (TLS); outgoing email uses an encrypted connection to the provider.
  • Encryption at rest: the server's data volume is encrypted by the hosting provider.
  • User access: passwords stored as salted PBKDF2 hashes; sessions with HttpOnly and Secure cookies expiring after 12 hours of inactivity and, at most, after 7 days; cross-site request forgery (CSRF) protection; limits on failed sign-in attempts.
  • Permissions: roles (administration, batch management, review, external review limited to one batch) and strict separation of each organisation's data in every query.
  • API keys: stored as hashes; the secret is shown only once; keys can be revoked.
  • Internal administration: separate console with password and two-factor authentication (TOTP), accessible only to the owner.
  • Content integrity: the books' HTML is never inserted as-is into the portal; previews show text only.
  • Availability and recovery: daily volume backups (14 days) and a documented restore procedure.
  • Minimisation: service emails are notices without the content of books or requests (everything is consulted in the portal); only what each suggestion needs is sent to the AI; EPUB files are deleted automatically 30 days after finalisation.
  • Logging and traceability: each review decision records who and when; anomalous review patterns are flagged.
  • Organisational: processing is carried out only by the owner, who is bound by confidentiality; sub-processors are contractually bound to equivalent measures.

Sub-processors

The current list, with locations and the safeguards for international transfers, is in Sub-processors.

Contact

For any matter relating to this agreement, to request the signed copy or to report an incident: info@abserveis.net.

Back to contents