Data processing agreement

This Data Processing Agreement ("DPA") applies when [LEGAL ENTITY: OPEN] ("LgTranslate", "we") processes personal data on behalf of a customer ("you") while providing the service under the Terms of Service. It is part of those terms and applies automatically from the day you start using the service; you do not need to sign it separately. If you need a countersigned copy for your records, write to [OPEN: mailbox].

1. Roles

• For personal data contained in the content you submit (page text, page addresses, glossaries) and for the visitors of your translated website, you are the controller (or a processor acting for your own customer) and we are the processor.
• For our own account, billing, security and website data we are a controller. That is covered by our Privacy Policy.
• Words such as "personal data", "controller", "processor", "processing" and "supervisory authority" have the meaning they have in the EU General Data Protection Regulation (GDPR) and, where it applies, the UK GDPR.

2. What we process, for whom and why (Annex I)

3. Our instructions from you

We process personal data only on your documented instructions: this DPA, the Terms, and your use of the dashboard, API, plugin and settings. We tell you if we think an instruction breaks data-protection law. If the law requires us to process data in another way, we tell you first unless the law forbids it.

4. Confidentiality

Everyone at LgTranslate who can access your data is bound by a duty of confidentiality, and access is limited to what the person needs. Support staff access your account only with a recorded reason, and read-only impersonation is time-limited and shown in your audit log.

5. Security

We apply the technical and organisational measures described in our Security overview, which form Annex II of this DPA. We may update them as long as the overall level of protection is not reduced.

6. Sub-processors

You give us general authorisation to use the sub-processors on our sub-processor list. We have a written contract with each that requires protection no weaker than this DPA, and we remain responsible for them. We tell you at least 30 days before we add or replace a sub-processor that processes your content, by e-mail to the account owner and by updating the list. You can object on reasonable data-protection grounds within that time. If we cannot offer a reasonable alternative, you may end the affected service and we will refund the unused part of your prepaid fees for it.

7. Help with data-subject requests

If a person asks you to access, correct, delete, restrict, move or object to the processing of their data, we help you with appropriate technical and organisational measures, as far as possible. Site translations can be exported by you at any time. If a request reaches us directly, we pass it on to you without answering it ourselves, unless the law requires otherwise.

8. Breaches and assistance

We tell you without undue delay and in any case within 72 hours after we become aware of a personal-data breach affecting your data. The notice states what we know: the nature of the breach, the data and people affected, likely consequences and the measures taken. We then keep you informed. We also help you, as far as the information available to us allows, with security, breach notices, data-protection impact assessments and consultation with authorities.

9. Return and deletion

When the agreement ends, you can export all your translations. After the period set out in the Terms (published translations stay served for at least 12 months after a lapse, and the export stays available), we delete your content from our systems or return it to you, at your choice, unless the law requires us to keep it. Backups are overwritten in their normal cycle. Published translation files on CDNs are removed within the retention period stated in the Terms, or earlier on request. Copies already on your own site are yours to delete.

10. Audit and information

We give you the information you need to check that we meet this DPA, such as this document, our Security overview and our sub-processor list. If that is not enough, you may, on 30 days' written notice and not more than once a year, ask us reasonable questions in writing or have an independent auditor you appoint (bound by confidentiality) review our compliance, at your cost, without disrupting our operation or exposing other customers' data.

11. International transfers (Annex III)

We process data in the locations of the providers on the sub-processor list, which include the United States. Where the GDPR or UK GDPR requires a transfer mechanism, the EU Standard Contractual Clauses (module 2, controller to processor, and module 3 where you are a processor) and, for the UK, the UK International Data Transfer Addendum are incorporated by reference. Annex I of the clauses is section 2 above, Annex II is the Security overview and Annex III is the sub-processor list. Section 4 (Docking clause) does not apply; the governing law and courts are those of [GOVERNING LAW: OPEN] unless the clauses require otherwise. We carry out transfer assessments with our providers and use supplementary measures where needed. The data region for stored content is [DATA REGION: OPEN].

12. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, as far as the law allows. If this DPA conflicts with the Terms about personal data, this DPA applies. The standard contractual clauses prevail over both where they apply.

13. Contact points (Annex IV)

Data-protection and security contact: [OPEN: mailbox]. Postal address: [LEGAL ENTITY NAME, registered address, registration number: OPEN].

Change log