Data Processing Agreement (DPA)
1. Contracting Parties
LLC "DataPrime", a company registered in Ukraine, is the company that operates the Lingverra service. "Lingverra" is the commercial designation under which the company provides the service and is not a separate legal entity; in this document "Lingverra", "we" or "us" means LLC "DataPrime".
This Data Processing Agreement (“DPA”) is concluded between:
Processor:
LLC "DataPrime"
vul. Yakubenkivska, bud. 1, kab. 6
04107 Kyiv
Ukraine
Registration number: 46215708
E-mail: support@lingverra.com
(hereinafter the “Processor”)
Controller:
The sworn/authorised translator or translation agency that accepts the
General Terms and Conditions and has registered a user
account on the Lingverra platform (hereinafter the “Customer” or “Controller”). The
service is intended exclusively for businesses (B2B); it is not intended for consumers.
This DPA is part of and incorporated into the General Terms and Conditions. By accepting the General Terms and Conditions, the Controller also accepts this DPA. The DPA enters into force at the time the Controller accepts the General Terms and Conditions.
2. Allocation of Roles (Controller / Processor)
With respect to the personal data contained in the documents uploaded by the Customer (the Customer’s clients, persons named in records, third parties), the Customer is the controller within the meaning of Art. 4(7) GDPR and Lingverra is the processor within the meaning of Art. 4(8) GDPR. The Customer determines the purposes and means of processing this data; Lingverra processes it solely to provide the translation service on its behalf.
2.1 Documented instruction by uploading a document
Use of the platform is voluntary and is always initiated by the Customer. Before any document is processed, the Customer must register, accept the General Terms and Conditions including this DPA, and grant consent on the platform; only then is the working area of the service made accessible. Each upload of a document for translation constitutes a separate, conscious and documented instruction by the Controller to the Processor within the meaning of Art. 28(3)(a) GDPR, given with prior knowledge of the technical means described in Section 2.2 and in the list of sub-processors. The Processor does not process any document content unless and until the Controller issues such an instruction by uploading the document.
2.2 The Processor determines only the technical means of implementation
The Controller determines the purpose of the processing (whether, why and which document is translated) and remains in control of the content and of the data subjects concerned. The Processor determines only the non-essential, technical means of implementing that instruction, namely: the AI translation model used (“Claude”) and the EU channel and region through which it is reached (see the list of sub-processors), the retention period after which content is automatically deleted, the encryption scheme (a separate key for each document), and the hosting infrastructure. In accordance with the established distinction between essential and non-essential means (see EDPB Guidelines 07/2020 on the concepts of controller and processor), the determination of such technical means by a processor does not turn the processor into a controller.
The service is provided by means of a single, standardised technical configuration; the Processor does not offer, and the Customer does not select, alternative means (model, region, retention or encryption). By accepting this DPA and by uploading a document, the Controller instructs the Processor to carry out the processing using precisely these technical means. The absence of a choice between individual means reflects the standardised, tool-like nature of the service and does not confer on the Processor any decision-making power over the purposes of the processing. The decision whether to make use of the technical means offered by the Processor at all rests entirely with the Controller: the Controller freely decides whether or not to employ the Processor’s set of means to process a given document, and may at any time refrain from using the service. The means are thus made available to the Controller, and it is the Controller’s own voluntary decision to apply them to the processing; this voluntary election by the Controller, rather than any unilateral determination by the Processor, is what governs whether the processing takes place.
2.3 No own use of the content
The Processor processes the document content exclusively to perform the translation instructed by the Controller. The Processor does not use the document content for any of its own purposes, does not analyse or profile it, does not disclose it to third parties other than the sub-processors necessary to provide the service (Section 6), and the content is not used to train, fine-tune or improve any artificial-intelligence model. The Processor derives no independent benefit from the content beyond providing the contracted service.
The Customer exercises its profession on its own responsibility and decides alone whether and on what legal basis it uploads a client’s document to the platform for translation. Lingverra does not check, and is not responsible for, whether the Customer is entitled to transmit the respective data; this responsibility rests solely with the Customer as controller (see Section 13).
Lingverra acts as a processor only while it holds the relevant content. After the content has been deleted in accordance with Section 11 (72 hours after delivery by default), or earlier where the Controller deletes it in its account, Lingverra no longer processes that content and ceases to act as a processor in respect of it.
3. Subject Matter & Purpose of Processing
Lingverra operates a cloud-based Software-as-a-Service platform for the AI-assisted translation of official and other documents for sworn or authorised translators. The Processor processes personal data on behalf of the Controller solely to the extent necessary to provide this service.
Cost estimates (quotes). The same applies where the Controller uploads a document in order to have its volume estimated and a priced offer produced on the Controller's own letterhead. One difference is material and is recorded here for the avoidance of doubt: no artificial-intelligence model is involved in this function and no data is transferred to any model provider. The text is read out of the document by text-recognition software running on the Processor's own infrastructure within the EU/EEA. The uploaded file is deleted as soon as the estimate has been produced; the generated PDF is encrypted at rest and deleted after 72 hours (Section 11).
Invoices to the Controller’s own client. The same applies where the Controller generates an invoice from a saved quote. The name and address of the Controller’s client, entered by the Controller for that purpose, are processed by the Processor solely in order to render them on the invoice; the address is stored encrypted. The invoice is issued on the Controller’s letterhead and in the Controller’s name: the Processor is neither its issuer nor a party to it, assigns no invoice numbers and does not transmit the invoice to the recipient. The generated PDF and the client’s address are deleted after 72 hours; before that, the Controller may delete the quote or the invoice at any time in its account; retaining the invoice for the statutory periods applicable to the Controller is the Controller’s own obligation.
Outside this Agreement: enquiries from prospective clients. The Processor separately operates a form on its public website through which a person seeking a certified translation may ask to be put in touch with a translator. For those contact details the Processor acts as an independent controller on the basis of that person's consent, not as the Controller's processor, and this Agreement does not apply to them. Where the Controller accepts such an enquiry, the Controller likewise becomes an independent controller of the contact details received and determines alone what to do with them; the Processor gives no instructions in that respect and receives no share of any assignment that follows. This processing is described in the Privacy Policy, Section 3.5.
The Processor processes personal data solely on the documented instructions of the Controller, unless required to process by Union or Member State law. In such a case, the Processor informs the Controller of these legal requirements before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).
4. Nature, Scope & Categories of Data
4.1 Nature and Purpose of Processing
The Processor processes personal data for the following purposes on behalf of the Controller:
- storage and management of the documents and files uploaded by the Controller;
- AI-assisted translation of the document content. To provide the translation service, the document content is processed by the “Claude” language model through an EU channel listed in the list of sub-processors; the provider of that channel acts as a sub-processor pursuant to Section 6. The processing remains within the EEA whichever listed channel carries the request. This processing is an integral and necessary part of the service; without it, no translation can be provided. By uploading a document for translation, the Controller issues a documented instruction (Art. 28(3)(a) GDPR) that covers this sub-processing. The document content remains within the EEA, is processed only temporarily for the translation, and is not used to train any models;
- provision of the translated document and of a two-column comparison/post-editing editor for review by the Controller;
- temporary storage of the source document and translation for the duration of the retention period (see Section 11), so that the Controller can reopen the result;
- keeping logs (audit logs) of security-relevant events in the Controller’s account;
- estimation of the volume of a document and generation of a priced quote on the Controller's letterhead. The text is read out of the document by text-recognition software on the Processor's own infrastructure within the EU/EEA; no AI model and no model provider is involved, unlike the translation function above;
- generation of an invoice from a saved quote, on the Controller’s letterhead and in the Controller’s name, using the name and address of the Controller’s client entered by the Controller for that purpose; the Processor renders those data on the invoice and does nothing else with them.
4.2 Categories of Personal Data
The data contained in the uploaded documents is determined by the Controller and may by its nature comprise special categories of personal data pursuant to Art. 9 GDPR (e.g. health data in medical certificates, data revealing religious or philosophical beliefs, biometric data in identity documents) as well as personal data relating to criminal convictions and offences pursuant to Art. 10 GDPR (e.g. certificates of good conduct / police clearance certificates). Lingverra has no knowledge of the specific content of the documents and makes no assessment of their content.
| Category | Data elements |
|---|---|
| Document data (content) | Uploaded files (PDF, images), text extracted and translated by AI, document metadata. May contain special categories of data (Art. 9 GDPR): health data, religious/philosophical data, biometric data from identity documents; and data relating to criminal convictions and offences (Art. 10 GDPR): e.g. certificates of good conduct. |
| Identity data of the data subjects | Names, dates of birth, addresses, record and file numbers, signatures named in the documents |
| Account and profile data of the Customer | E-mail address, name, professional details (appointment, languages, certification note) |
| Technical data | IP addresses, user agent, session identifiers, audit log entries |
| Billing data | Number of standard pages translated, balance, payment history |
Note: account, profile, technical and billing data of the Customer itself is processed by Lingverra as its own controller (performance of a contract, Art. 6(1)(b) GDPR); the Privacy Policy applies in this respect. The subject matter of this DPA is the data of third parties contained in the documents, for which the Customer is the controller.
4.3 Categories of Data Subjects
- the Customer’s clients (natural persons);
- third parties named in the documents (e.g. persons listed in records, signatories, issuing persons);
- the Customer itself, insofar as personal data is contained in its documents.
4.4 Duration of Processing
Processing takes place for the duration of the contractual relationship. In addition, the content of the source document and translation is automatically deleted after expiry of the retention period (see Section 11). Upon termination of the Agreement, personal data is deleted or anonymised pursuant to Section 11.
5. Obligations of the Processor
The Processor undertakes:
- to process personal data only on the documented instructions of the Controller;
- to ensure that the persons authorised to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR);
- to take appropriate technical and organisational measures pursuant to Art. 32 GDPR (see Section 7);
- to comply with the conditions for engaging sub-processors pursuant to Section 6;
- to assist the Controller by appropriate technical and organisational measures in fulfilling its obligations under Art. 32–36 GDPR;
- at the Controller’s choice, to delete or return all personal data after the end of processing (see Section 11);
- to make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR;
- to inform the Controller without delay if, in the Processor’s opinion, an instruction infringes the GDPR or other data protection provisions.
6. Sub-processors
The Controller hereby grants the Processor general written authorisation to engage sub-processors. The Processor informs at least 30 days in advance in text form of any intended addition or replacement of a sub-processor. The Controller may object within 30 days of the information. If the Processor cannot remedy the objection, the Controller is entitled to terminate the Agreement with 30 days’ notice without disadvantage.
The current list of sub-processors — including the provider of the AI translation channel and the infrastructure/hosting provider — is publicly available at /legal/subprocessors.
When engaging sub-processors, the Processor imposes on them, by contract, equivalent data protection obligations (Art. 28(4) GDPR). The Processor is liable to the Controller for the sub-processor’s compliance with its obligations.
7. Technical & Organisational Measures (TOMs)
The Processor takes the following technical and organisational measures pursuant to Art. 32 GDPR:
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.2+ for every data transfer; HTTPS enforced on all endpoints |
| Encryption at rest | A separate AES-256-GCM key for every individual document and quote (not merely one key per user), so that no single key unlocks more than the item it belongs to. The same key covers the uploaded file, the translated text stored in the database and the quote PDF; encrypted session storage; encrypted backups |
| Cryptographic erasure | On expiry of the retention period, and on deletion by the Controller, the key of that document is destroyed in the same transaction as the deletion. Any copy of the ciphertext outside the reach of the application — a short-lived backup, a hosting snapshot, flash cells retired by the drive — thereby becomes permanently undecryptable, by the Processor as much as by anyone else. Per-document keys are excluded from the database dump: the dump is retained longer than the file backup, and a key outliving the document it unlocks would render the measure nominal |
| Key management | The master key wrapping the per-user keys (which in turn wrap the key of each individual document) is held in a managed key service within the EU (AWS KMS), not on the application server or in the database; every decryption is an explicit key-service call recorded in an audit trail (CloudTrail). A database or disk compromise alone does not disclose content, and access to content cannot occur without leaving a log record |
| No routine access (access on exception only, always logged) | The Processor has no functional need to read document content and does not do so in normal operation; decryption is technically gated by the key service and organisationally unused (development never uses customer documents). Administrators do not read content; with full server privileges access would be technically possible, but decrypting a document requires a call to the key service, which records it in its audit trail; a developer cannot decrypt a document without leaving an audit record |
| Owner-session-bound decryption | Document access is bound in code to the data owner (every document route filters by the owner's user id); a per-user key is unlocked in normal operation only within the owner's authenticated session. Each key unlocking is recorded with both the data owner and the initiating actor. Any unlocking initiated by a non-owner (e.g. staff) is flagged as an exception and raises an internal alert; the only expected non-owner access is a data-subject export requested by the subject, which is logged with its reason. This makes it demonstrable that, in the normal course, the key is requested by the data subject and not by personnel |
| Pseudonymisation / anonymisation | Personal data is anonymised on account deletion; document content is automatically deleted after expiry of the retention period (a dated entry remains in the history, without the document or any of its text) |
| Access control | Role-based access control (translator / administrator / accountant); strict tenant separation at user level; principle of least privilege |
| Authentication | Password hashing; two-factor authentication (TOTP); trusted-device tokens; session expiry |
| Malware protection | Virus scanning of uploaded files; checking of file type and signature before processing |
| CSRF protection | CSRF token on all state-changing requests |
| Content Security Policy | Strict Content-Security-Policy without unsafe-inline (script-src and style-src limited to 'self' plus a per-request nonce); no inline scripts or styles, mitigating cross-site scripting (XSS) and injection on the frontend |
| Logging | WORM-protected audit logs (database triggers prevent modification and deletion); separation of access and business logs |
| Backup & recovery | Regular automated backups; encrypted backup storage; documented recovery procedure |
| Resilience | Operation on a dedicated server with per-service resource limits; application-level error handling and monitoring |
| Vulnerability management | Regular security updates of the operating system, dependencies and application |
| Personnel & training | All persons with access to personal data are committed to confidentiality; access rights are reviewed regularly |
| Secure deletion | Personal data is deleted by anonymisation or secure overwriting; backup retention aligned with the deletion policy |
| Separation of environments | Production and test/development environments are strictly separated; no real personal data in test environments |
| Incident response | Procedures for detecting, escalating and reporting personal data breaches; notification of the Controller without undue delay after becoming aware (Art. 33(2) GDPR) |
8. Audit and Inspection Rights
The Controller has the right to verify compliance with this DPA and Art. 28 GDPR through audits, subject to the following conditions:
- Frequency: no more than once per calendar year, unless there is justified cause (e.g. a data breach or official investigation);
- Notice: at least 30 days in advance in text form, stating the scope and purpose;
- Costs: at the Controller’s expense, unless the audit reveals a material breach by the Processor;
- Confidentiality: the auditor must sign a confidentiality agreement before accessing systems or data;
- Evidence: the Processor may fulfil the audit obligation by providing current certificates or audit reports (e.g. under recognised standards); an on-site audit remains possible insofar as specific concerns are not dispelled by the reports.
9. Rights of Data Subjects
The Processor assists the Controller by appropriate technical measures in fulfilling data subject rights pursuant to Chapter III GDPR (Art. 15–22). The Controller is responsible for responding to data subject requests. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.
10. Notification of Data Breaches
The Processor notifies the Controller of any personal data breach without undue delay after becoming aware of it (Art. 33(2) GDPR), and in any event within 24 hours. This deliberately undercuts the Controller's own 72-hour deadline towards the supervisory authority (Art. 33(1)): that deadline runs from the moment the Controller becomes aware, so a notification arriving at hour 72 would leave the Controller no time at all to act on it. Where the full picture is not yet established, the Processor notifies on the facts available and supplements them as they emerge, rather than delaying the first notification. The notification contains, insofar as known to the Processor:
- the nature of the breach, including the categories and approximate number of data subjects and records concerned;
- the name and contact details of the Processor’s data protection contact point;
- the likely consequences of the breach;
- the measures taken or proposed to remedy it.
The notification to the competent supervisory authority and the communication to data subjects pursuant to Art. 33 and 34 GDPR rest with the Controller.
11. Deletion & Return of Data
The content of the source document and translation is stored only temporarily and is automatically and permanently deleted after expiry of the retention period (72 hours after delivery by default), or earlier where the Controller deletes it in its account; only a dated entry remains in the history, recording that a document was processed — without the document or any of its text. The exact retention period is stated in the Privacy Policy. Once the content has been deleted, the Processor no longer holds, controls or has access to it, and processing of that content by the Processor ends; the Processor’s obligations under this DPA in respect of deleted content are thereby discharged (Art. 28(3)(g) GDPR).
Deletion is cryptographic as well as physical: the bytes are overwritten where the application can reach them, and the key belonging to that document is destroyed. The statement above — that the Processor no longer has access to deleted content — therefore does not rest on the completeness of the overwrite across backups, snapshots and storage hardware, but on the absence of any key with which the content could be read.
Cost estimates. The document uploaded for an estimate is deleted as soon as the estimate has been produced — it is not retained for the 72-hour window that applies to translations, because nothing in the workflow requires it afterwards. The generated quote PDF is encrypted at rest and deleted after 72 hours, leaving the Controller's own commercial record of the offer (number, addressee, totals), which no longer contains the client's document. The Controller may delete a quote at any time before that.
Upon termination of the Agreement, the following applies:
- Deletion (default): personal data is anonymised or securely deleted. Before termination, the Controller may use the platform’s self-service export functions to retrieve its data;
- Return (on request): formal return of all personal data in a machine-readable format upon request in text form made before termination.
The Processor retains a minimal deletion record (date, trigger, confirmations) as evidence of GDPR-compliant deletion pursuant to Art. 28(3)(g) GDPR; this record contains no personal data of the Controller’s data subjects.
12. Transfers to Third Countries
The processing of document content (the data the Processor handles on the Controller's behalf, including the AI-assisted translation step) takes place on servers within the EU/EEA and is not transferred to any third country. It is encrypted at rest under a key held within the EU, so administration of the infrastructure does not, in itself, disclose the content. The AI translation runs through an EU channel listed at /legal/subprocessors; the request is addressed to a model route within the EU/EEA and is not routed to the United States. The choice of channel and route is validated fail-closed: a non-EU region, endpoint or route is rejected rather than served.
- Payment processors: transfer of payment data only (never the document content). Card payments are processed by the Ukrainian acquirer ПУМБ (hutko), an independent controller; only the amount and an order reference are transmitted, on the basis of Art. 49(1)(b) GDPR.
The Processor is established in Ukraine, a third country without an EU adequacy decision. This does not affect the document content, which remains encrypted in the EU as described above. Account and billing data of the Customer are accessible from Ukraine to the Processor's own staff on a need-to-know basis. Document content is not routinely accessible from Ukraine. Access to it is possible only in an exceptional case, on a documented reason (in particular at the Customer's own request, e.g. a support request concerning a specific document); each such access requires use of the encryption key held in the EU, which is recorded by the key service (AWS CloudTrail). The Processor processes billing/invoice data for statutory accounting on the basis of Art. 6(1)(b) and Art. 6(1)(f) GDPR (performance of the contract and the legitimate interest in meeting its statutory bookkeeping obligations). The Processor's statutory bookkeeping is performed either by its management or by an external provider of accounting services established in Ukraine. Where such a provider is engaged, it is supplied with accounting records stripped of direct identifiers — a non-descriptive reference code in place of the customer name, with no name, e-mail address or postal address — and it holds neither the Processor's database nor the key from which the codes are derived. It therefore receives no personal data, is not a sub-processor within the meaning of Art. 28 GDPR, and no transfer of personal data arises from this arrangement. Access to the underlying billing data within the Processor's systems is read-only and logged. The Processor does not otherwise transfer personal data to third countries without ensuring an adequate level of protection pursuant to Chapter V GDPR.
13. Obligations of the Controller
The Controller warrants and undertakes that:
- it has a valid legal basis pursuant to Art. 6 GDPR for all personal data uploaded to the platform;
- insofar as special categories of personal data pursuant to Art. 9 GDPR are processed (in particular health data, religious/philosophical data, biometric data from identity documents), it has a valid legal basis pursuant to Art. 9(2) GDPR and has implemented appropriate safeguards;
- insofar as personal data relating to criminal convictions and offences pursuant to Art. 10 GDPR are processed (in particular certificates of good conduct / police clearance certificates), such processing is carried out under the control of an official authority or is authorised by Union or Member State law providing appropriate safeguards;
- it is solely responsible for the lawfulness of the processing instructions given to the Processor;
- it has fulfilled its information obligations towards its own data subjects pursuant to Art. 13 and 14 GDPR;
- it uses the platform only for lawful purposes in accordance with applicable data protection law;
- it is solely responsible for managing the accesses in its account;
- it informs the Processor without delay of changes affecting compliance with this DPA.
14. Liability
Each party is liable for the breaches of applicable data protection law for which it is responsible. If the Processor is held liable for a breach based on an instruction or conduct of the Controller, the Controller shall indemnify the Processor to the extent that the Processor is not at fault.
The Processor’s contractual liability under this DPA is subject to the limitation of liability agreed in the General Terms and Conditions. The Processor’s statutory liability towards data subjects pursuant to Art. 82 GDPR remains unaffected. Fines pursuant to Art. 83 GDPR are borne by the party against which they are imposed by the supervisory authority; they cannot be shifted by contract.
15. Governing Law & Jurisdiction
This DPA is governed by the law of the country in which the processor is registered (Ukraine). The courts of that country have jurisdiction over disputes arising from this DPA, unless mandatory provisions at the Controller’s location provide otherwise. This jurisdiction clause does not affect the right of data subjects to bring proceedings before the courts referred to in Art. 79(2) GDPR.
National data protection law of the Processor. In addition to the GDPR, the Ukrainian Law on the Protection of Personal Data (No. 2297-VI) applies to the Processor’s processing activities in Ukraine.
16. Contact
LLC "DataPrime"vul. Yakubenkivska, bud. 1, kab. 6
04107 Kyiv
Ukraine
E-mail: support@lingverra.com
EN · CS · DE · ES · FR · HU · IT · NL · PL · PT · RO · SK · UK
Version: v1.2 · As of: 2026-10-15 · EN