Privacy Policy

Pursuant to Art. 13 and 14 GDPR (EU) 2016/679  •  LLC "DataPrime" (46215708)  •  Governing language: English  •  Translations of this document into other languages are provided for convenience. The English text is the authentic version and prevails for the purposes of interpretation. However, where a translation departs from the English text, we shall not invoke that discrepancy to the detriment of the Customer.

1. Controller

LLC "DataPrime", a company registered in Ukraine, is the company that operates the Lingverra service. "Lingverra" is the commercial designation under which the company provides the service and is not a separate legal entity; in this document "Lingverra", "we" or "us" means LLC "DataPrime".

The controller for the processing of your personal data is:

LLC "DataPrime"
vul. Yakubenkivska, bud. 1, kab. 6
04107 Kyiv
Ukraine
Registration number: 46215708
E-mail: support@lingverra.com

1a. Representative in the EU (Art. 27 GDPR)

As a controller established outside the EU offering services to data subjects in the EU, we have designated a representative in the Union pursuant to Art. 27 GDPR, who may be contacted by data subjects and supervisory authorities on all matters relating to the processing of personal data:

Prighter EU Rep GmbH
Schellinggasse 3/10, 1010 Vienna, Austria
Contact form: https://app.prighter.com/portal/14882573076

2. Scope & Roles

Lingverra is a B2B platform for the AI-assisted translation of documents for sworn or authorised translators. This Privacy Policy describes the processing of the personal data of the Customer itself (account, profile, usage and billing data), for which Lingverra is the controller.

Data in uploaded documents. With respect to the personal data contained in the documents uploaded by the Customer (the Customer’s clients, third parties named in records), the Customer is the controller and Lingverra is a processor. This processing is governed by the Data Processing Agreement (DPA), not by this Privacy Policy.

Enquiries from clients looking for a translator. Separately from the above, this website offers a form through which a person who needs a certified translation can ask to be put in touch with a sworn translator registered with us. For those contact details Lingverra is the controller, and the processing is described in Section 3.5. Apart from the advertising letters described in Section 3.7, it is the only processing in which we hold data about someone who is not our customer, and it is deliberately kept as small and as short-lived as the purpose allows.

Quotes (cost estimates). Where a translator uploads a client's document to have its volume estimated, the roles are the same as for translation: the translator is the controller, Lingverra is a processor, and the DPA applies. Unlike translation, no AI model is involved at all — see Section 3.6.

The content of uploaded documents and translations is stored only temporarily and is automatically and permanently deleted after the retention period (72 hours after delivery by default, see Section 4), or earlier where you delete it yourself in your account. After deletion, Lingverra no longer holds, controls or has access to that content and acts neither as controller nor as processor in respect of it. For disaster-recovery purposes only, encrypted backups may transiently contain a copy of recently processed content; such file backups are kept for a maximum of two days and are then deleted, and are never used to reinstate content that has already been purged. Database backups (which do not contain purged document content) are kept for up to 14 days.

Ukrainian data protection law. Lingverra is operated by a company registered in Ukraine. In addition to the GDPR, the Ukrainian Law on the Protection of Personal Data (No. 2297-VI) applies to the company’s processing activities in Ukraine.

3. What Personal Data We Process

3.1 Account & Profile Data

Data	Purpose	Legal basis
E-mail address, password hash	Account creation, authentication, password recovery	Art. 6(1)(b) GDPR — performance of a contract
Name	Personalisation of the account, display in the platform	Art. 6(1)(b) GDPR — performance of a contract
Professional details (country and registry number of the appointment, language pairs, address, certificate number, certification note)	Creation of the translator’s note and layout details for the translation	Art. 6(1)(b) GDPR — performance of a contract
Language setting, interface theme	Personalisation of the interface	Art. 6(1)(b) GDPR — performance of a contract
Letterhead details for the documents you issue to your own clients: telephone, website, VAT identification number and tax number, bank details for payment, your rate and unit of calculation, VAT rate, minimum charge, validity of a quote, lead time and payment term. Bank details are stored encrypted, as is your postal address; the certificate number, VAT identification number and tax number are stored in plain text, because they are published in public registers	Printing them on the quotes and invoices you issue on your own letterhead, and calculating the amounts shown there	Art. 6(1)(b) GDPR — performance of a contract
TOTP secret, backup codes (encrypted)	Two-factor authentication (TOTP, no SMS)	Art. 6(1)(b) GDPR — performance of a contract

3.2 Documents & Translations

With respect to the content of uploaded documents, the Customer is the controller; Lingverra processes it solely on the Customer’s instructions as a processor (see DPA). The document content may contain special categories of personal data pursuant to Art. 9 GDPR, as well as personal data relating to criminal convictions and offences pursuant to Art. 10 GDPR (e.g. certificates of good conduct); the Customer, as controller, ensures the legal basis for this.

Data	Purpose	Legal basis
Uploaded documents (PDF, images)	Provision of the translation service	Processing on behalf, Art. 28 GDPR (Customer = controller)
Text extracted and translated by AI, document metadata	Translation, display in the comparison/post-editing editor, export	Processing on behalf, Art. 28 GDPR

To provide the translation, the document content is processed by the “Claude” language model through an EU channel (see Section 7); the request is addressed to a model route within the EEA and the content does not leave the EEA. The content of the source document and the translation is automatically deleted after expiry of the retention period (see Section 4).

3.3 Billing Data

Data	Purpose	Legal basis
Balance, number of standard pages translated, transaction history	Billing of the per-page service, balance management	Art. 6(1)(b) GDPR — performance of a contract
Payment reference, time of payment	Payment processing and tracking	Art. 6(1)(b) GDPR — contract; Art. 6(1)(f) — legitimate interest in meeting our statutory accounting obligations
Invoice data (amounts, VAT, date)	Issuance and retention of invoices	Art. 6(1)(f) GDPR — legitimate interest in meeting our statutory retention obligations
Billing details: company or trading name, billing address, country, VAT identification number, invoice language	Issuing our invoices to you and determining their VAT treatment	Art. 6(1)(b) GDPR — contract; Art. 6(1)(f) — legitimate interest in meeting our invoicing and tax obligations

3.4 Security & Technical Logs

Data	Purpose	Legal basis	Retention
IP address, user agent (login events)	Security monitoring, protection against brute-force attacks, detection of new devices	Art. 6(1)(f) GDPR — legitimate interest	sessions: 30 days after the session ends; login entries in the audit log: for the life of the account, anonymised on account deletion
Audit log (actions, timestamps)	Security audit trail, WORM-protected (immutable)	Art. 6(1)(f) GDPR — legitimate interest	anonymised on account deletion
Session data (encrypted)	Management of the login session	Art. 6(1)(b) GDPR — performance of a contract	until expiry of the session
Trusted-device token	Recognition of trusted devices in 2FA	Art. 6(1)(b) GDPR — performance of a contract	30 days; revocable
Consent records (consent/withdrawal, timestamps)	Evidence of consents given or withdrawn	Art. 6(1)(c) GDPR — accountability (Art. 7(1) GDPR)	anonymised on account deletion

3.5 Enquiries from clients looking for a translator

If you are looking for a sworn translator, you can leave an enquiry on this website. We then offer it to translators registered with us who work in the language pair you need, and the first one to accept receives your contact details and writes to you directly. We are not a party to the assignment you go on to agree with that translator, and we take no commission from it.

Legal basis: your consent, Art. 6(1)(a) GDPR, given through a double opt-in: the enquiry is created but shown to nobody until you confirm it by clicking the link we e-mail to the address you entered. Until you do, it is offered to no one. This step exists to protect people other than you: without it, anyone could enter a third party's address and that person's contact details would be passed on, on a “consent” given by someone who does not own the address.

Data	Why we need it
E-mail address	The only way for the translator to reach you. We do not ask for your name, telephone number or postal address, and you should not send us your documents.
Source and target language, target country	To offer the enquiry only to translators who can actually certify for that country — a translator sworn in Austria cannot certify for Germany.
Document type (from a fixed list)	So the translator can judge the work before accepting. A list, not free text, precisely so that no more is disclosed than necessary.
Free-text comment (optional)	Only if you choose to write one. Please do not enter health data, identity-document numbers or other sensitive details — they are not needed to put you in touch with a translator.
Truncated IP address, page language	Evidence that consent was given, and the language in which to write to you. The IP is shortened, so it does not identify your connection precisely.

Who receives your contact details. Only the sworn translator who accepts your enquiry, and only at the moment of acceptance. Translators who were offered the enquiry but did not take it never see your address. Translators state the country and registry number of their appointment themselves; we do not verify these against the national register, and you are told so when you submit the enquiry. Ask the translator for proof of appointment before handing over your documents. Where we learn that a translator's details are incorrect, in particular from a complaint, we remove that translator from the distribution of enquiries. From the moment your contact details are handed over, that translator is an independent controller of them: they decide what to do with your enquiry and are your point of contact for it, and our own obligations end with the hand-over and with telling you that it happened.

How long we keep it: 72 hours. Once the enquiry is closed — taken by a translator, withdrawn by you, or expired because nobody took it — your e-mail address, your comment and the truncated IP are erased automatically within 72 hours. What remains is a content-free record (language pair, country, document type, dates) which no longer identifies you and which we need in order to show a supervisory authority how the service works. There is nothing to ask us to delete afterwards, because there is nothing left.

Withdrawing your consent (Art. 7(3)). Every e-mail we send you about your enquiry contains a link that stops its distribution immediately. No account and no login are required — withdrawing must be no harder than consenting was. Withdrawal has no effect on the lawfulness of what happened before it.

Proof that consent was given. Because your contact details are erased after 72 hours, we keep a separate record showing that consent was given: the moment, the wording you accepted, the truncated IP, and your e-mail address only as a keyed one-way fingerprint, never in readable form. We are required to be able to demonstrate consent (Art. 7(1) GDPR), and that duty outlives the contact details themselves. The record is deliberately built so that it cannot be used to reconstruct a list of people who once enquired: it can only confirm or refute a specific address that is put to us — for example, if you or an authority ask us whether we ever held your consent.

3.6 Quotes (cost estimates)

This section concerns translators using the platform. When you upload a document to have its volume estimated and a priced offer generated on your own letterhead, the personal data in that document belongs to your client: you are the controller and we are your processor under the DPA, exactly as for translation.

No AI, and no transfer to any AI vendor. The text is read out of the document by text-recognition software running on our own server. Nothing is sent to Anthropic, Google, Amazon or any other model provider — this differs from the translation function, where an AI model is used. Stated explicitly here because the difference is not obvious.

How long. The uploaded file is removed as soon as the estimate has been produced. The generated quote PDF is encrypted at rest and deleted after 72 hours; what remains in your history is your own commercial record of the offer (number, addressee, totals), from which your client's document has already gone. You can delete a quote yourself at any time before that.

3.7 Advertising letters to sworn translators

We occasionally send advertising letters by post to sworn and court-appointed translators. This section concerns people who are not, or not yet, our customers.

Source. Names, postal addresses and, where the register lists them, language pairs are taken from public registers of sworn or court-appointed translators kept by the competent authorities. We do not buy address lists.

Purpose and legal basis. Making our service known to the profession for which it is built, by letter only. Legal basis: our legitimate interest in direct marketing, Art. 6(1)(f) GDPR (Recital 47). We do not use e-mail, telephone or fax for this purpose.

What we keep. Name, form of address, postal address, country and language pairs as published, and the register they come from. Each letter carries two individual codes: one for objecting, and one leading to the registration page; for the latter we record only the time it was first used and, if an account is created through it, that account. Letters are printed and posted by our processor Pingen GmbH (Zurich, Switzerland — a country with an EU adequacy decision), which receives the letter file, including your name and address. Pingen uses printing partners and the postal operator in the destination country; Pingen publishes the list of its subcontractors (pingen.com). We will also send you the current list on request (support@lingverra.com).

How long. For the campaign for which the data were taken from the register; they are then deleted or refreshed from the register. If you object, we keep only a one-way fingerprint of your identifiers on a suppression list — no name and no address — so that you are not written to again after a future update of the register.

Your right to object. You may object to this processing at any time, without giving reasons and free of charge (Art. 21(2) GDPR): through the code printed in the letter, or by e-mail to support@lingverra.com. After an objection we do not write to you again. Every letter also contains this information (Art. 14 GDPR).

4. Retention

Personal data is retained only for as long as necessary for the respective purpose or required by law. On account deletion, personal data is anonymised; identifiable account data is not retained thereafter.

Two records outlive the account, neither of them in readable form: the record that a free trial has been granted, so that it is granted only once per e-mail address, and the record of consent to our terms (Art. 7(1) GDPR). Each holds the e-mail address only as a keyed one-way fingerprint (HMAC-SHA-256); without the key, which is not stored in the database, the fingerprint cannot be linked to an address. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in granting the free trial only once; Art. 6(1)(c) GDPR — the duty to demonstrate consent.

Deletion of document content is cryptographic, not only physical. Each document and each quote has its own encryption key, and when the retention period expires that key is destroyed along with the file. Any copy of the content that still exists anywhere — in a short-lived backup, in a copy made by the hosting layer, or in parts of the physical disk that were never overwritten — is from that moment permanently unreadable, to us as much as to anyone else. See Section 8.

Category	Retention
Account and profile data (name, e-mail, professional details)	anonymised on account deletion
Unverified registrations (e-mail never confirmed and no login)	deleted in full after 7 days; without confirmation of intent there is no basis to keep the e-mail and password hash. The verification e-mail states this in advance. Re-registration is unrestricted.
Source document & translation	automatic deletion after expiry of the retention period (72 hours after delivery by default), or earlier when you delete them yourself in your account, together with that document's encryption key; only a dated entry remains in your history, recording that a document was processed — without the document or any of its text
Client enquiry — e-mail address, comment, truncated IP (Section 3.5)	erased automatically within 72 hours of the enquiry being closed (taken, withdrawn or expired); a content-free record without identifying data remains
Proof that consent to an enquiry was given (Art. 7(1))	kept beyond the contact details, and on a different legal basis: the address is held only as a keyed one-way fingerprint, never in readable form
Quote: uploaded source file	removed as soon as the estimate has been produced
Quote: generated PDF	encrypted at rest, deleted after 72 hours together with its encryption key (you can delete the quote or the invoice yourself at any time before that); the translator's own record of the offer (number, addressee, totals) remains
Audit logs (WORM-protected)	anonymised on account deletion
Security/login logs	sessions: 30 days after the session ends; login entries in the audit log: for the life of the account, anonymised on account deletion
Consent records	anonymised on account deletion
Record that the free trial has been granted	kept permanently, also after account deletion, as a keyed fingerprint of the e-mail address only (Section 4), so that the trial is granted once
Advertising letters — name, address and language pairs from public registers (Section 3.7)	for the campaign for which they were taken from the register; then deleted or refreshed from the register
Objection to advertising letters (suppression list)	kept permanently, as a one-way fingerprint only (no name or address), so that the objection is honoured after any future update of the register
Invoices from Lingverra to the Customer	retained for the period required by the applicable statutory accounting and tax rules; not deleted on account deletion (statutory retention obligation)

5. Recipients of Personal Data

We do not sell personal data. We disclose data only to sub-processors bound to data protection by corresponding contracts:

Recipient	Purpose	Location
Opper Technology AB	Gateway to the “Claude” language model for AI-assisted translation — the channel in use; the model runs on Amazon Bedrock in the EU/EEA; processed within the EEA; not used to train the models	EU/EEA — Opper Data Processing Agreement; no third-country transfer of document content. The specific current processing location within the EU/EEA is available on request.
Amazon Web Services EMEA SARL	Hosting of the “Claude” language model (Amazon Bedrock) for AI-assisted translation — contracted alternative channel; processed within the EEA; not used to train the models	Germany (EU/EEA), Frankfurt region — AWS GDPR Data Processing Addendum; no third-country transfer of document content
Google Cloud EMEA Limited	Hosting of the “Claude” language model (Google Cloud Platform — Vertex AI) — contracted alternative channel; processed within the EEA; not used to train the models	Ireland (EU/EEA), EU jurisdictional endpoint — Google Cloud Data Processing Addendum; no third-country transfer of document content
JSC «FUIB» (АТ «Перший Український Міжнародний Банк», ПУМБ) — internet-acquiring service hutko	Card payment when purchasing credit packages	Ukraine (third country) — a bank supervised by the National Bank of Ukraine, acting as an independent controller for the payment leg, not an Art. 28 sub-processor. It receives only the amount, our order reference and the order description — never your name, e-mail, IP, card number or document content. The card is entered on the bank’s own page. Transfer basis: Art. 49(1)(b) GDPR — necessary to perform the payment you asked for.
netcup GmbH	Hosting: server, database, file storage; our own mail server runs on it	Germany (EU/EEA) — data processing agreement pursuant to Art. 28 GDPR
Prighter EU Rep GmbH / Prighter GmbH	Our EU representative (Section 1a): receives what you submit through its contact portal and forwards your request to us	Austria (EU/EEA) — processes requests on our behalf and deletes them 30 days after the request is closed
Pingen GmbH	Printing and posting of advertising letters — recipients of these letters only, not users of the service; printing partners and postal operators in the destination country (list: pingen.com, or from us on request)	Switzerland — EU adequacy decision (Art. 45 GDPR); data processing agreement pursuant to Art. 28 GDPR

The sworn translator who accepts your enquiry (Section 3.5) is not a sub-processor and is not listed above: on accepting, they become an independent controller of your contact details, acting on their own responsibility and not on our instructions. Your details are disclosed to that one translator only, with your consent, and only at the moment they accept.

This is a representative overview. The complete and authoritative list is available at /legal/subprocessors.

6. Cookies & Browser Storage

We use only strictly necessary cookies and browser storage:

• Session cookie (strictly necessary): maintains your login session. Legal basis: Art. 6(1)(b) GDPR; setting it requires no consent under Art. 5(3) sentence 2 of the ePrivacy Directive 2002/58/EC, as it is strictly necessary.
• Interface theme: your choice of light or dark appearance is stored by your own browser, on your device. It never reaches our servers and is not used to track you. The same applies to the view you last used on the result screen of a translation. Your browser also remembers a cost estimate that is still being calculated and that you postponed the offer to switch on notifications; the full list is in the Cookie Policy.
• Push notifications (translators, optional): if you switch on notifications about client enquiries, your browser registers a service worker and a push subscription. We store the subscription address in order to notify you. The notification is delivered through your browser's own push service (for example that of Google, Mozilla or Apple, depending on your browser), which may be located outside the EEA; it receives the subscription address and the notification in encrypted form, never the enquirer's contact details. Legal basis: Art. 6(1)(b) GDPR, at your request. The push services of Google and Microsoft are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); for other push services the delivery rests on Art. 49(1)(b) GDPR, as it is necessary to deliver the notifications you asked for. You can switch notifications off at any time in your settings or in your browser; a subscription that the push service reports as no longer valid is deleted.

We use no analytics, tracking or advertising cookies.

7. Transfers to Third Countries

The processing and storage of document content take place on servers within the EU/EEA. The document content — including the AI-assisted translation step — is processed exclusively within the EEA and is not transferred to any third country. It is encrypted at rest under a key held within the EU, so access to the infrastructure does not, in itself, disclose the content. Card payments are processed by the Ukrainian acquirer ПУМБ (hutko); only the amount and an order reference are transmitted, never the document content.

Our company is established in Ukraine, a third country for which the EU has not issued an adequacy decision. Account and billing data are accessible from Ukraine to our own staff on a need-to-know basis. Document content is not routinely accessible from Ukraine. Access to it is possible only in an exceptional case, on a documented reason (in particular at your own request, e.g. a support request concerning a specific document); each such access requires use of the encryption key held in the EU, which is recorded by the key service (AWS CloudTrail). We process billing/invoice data for statutory accounting on the basis of our legitimate interest in meeting our statutory bookkeeping obligations (Art. 6(1)(f)) and performance of the contract (Art. 6(1)(b)). Our statutory bookkeeping is kept either by our management or by an external provider of accounting services established in Ukraine. Where such a provider is engaged, it receives accounting records without direct identifiers: each customer appears as a non-descriptive reference code instead of a name, and no name, e-mail address or postal address is disclosed to it. The provider holds neither our database nor the key from which those codes are derived, and therefore has no means of relating the records to you. Access to the underlying billing data within our systems is read-only and every access is logged. No document content is transferred to Ukraine or to any other third country.

8. Security Measures

We take appropriate technical and organisational measures, in particular:

• TLS encryption for all data in transit;
• encrypted session storage;
• a separate encryption key for every single document (AES-256-GCM), not merely one key per user — so no one key unlocks more than the one file it belongs to;
• the master key is held in a managed key service within the EU (AWS KMS), not on our servers, and every use of it is logged;
• two-factor authentication (TOTP, no SMS);
• virus scanning of uploaded files;
• CSRF protection on all state-changing requests;
• a strict browser security policy that blocks any script we did not ourselves place on the page — the standard defence against code injected by a third party (technically: Content-Security-Policy without inline scripts, against cross-site scripting);
• WORM-protected audit logs (database triggers prevent modification and deletion);
• automatic deletion of expired document content and logs, including destruction of that document's encryption key (see below).

What happens when a document is deleted. Deleting a file usually means the system stops pointing at it — and copies can linger where the application cannot reach: in a backup, in a snapshot taken by the hosting layer, or in flash memory cells that solid-state drives silently retire instead of overwriting. We overwrite the bytes we can reach, but we do not rely on that alone.

Because every document has its own key — covering the uploaded file, the translated text held in our database, and any quote generated from it — deletion also destroys that key. From that moment the content cannot be decrypted by anyone — including us — no matter which copy of it survives or where. Modern encryption offers no way in without the key, so the guarantee stops being “we overwrote it” and becomes “there is nothing left to decrypt with”. The keys are deliberately kept out of our database backups, since a key that outlived the document it unlocks would defeat the whole point.

This applies to expiry after 72 hours and to deletion you carry out yourself, and it covers both translated documents and quotes.

We do not need, and do not use, access to your document content. Translation is performed automatically; no member of our staff reads your documents in normal operation. Because the decryption key sits in the EU key service and not on the server, holding server or administrator access does not by itself make the content readable — any decryption is an explicit action that is recorded in an audit log. Development never uses your documents.

Your content is decrypted only within your own authenticated session. In normal operation the decryption key for your documents is unlocked only when you are logged in and open your own data — every document access is bound, in code, to its owner. Our system records, for each unlocking of a key, both the owner of the data and who initiated the action. If the initiator is ever someone other than the owner (for example a staff member), this is treated as an exception: it is logged and raises an internal alert. The only routine, expected non-owner access is when you ask us to export your data (a data-subject request), which is itself logged with its reason. In short: in the normal course, the key is requested by you, not by our staff — and any deviation leaves an alert-raising trail.

The complete list of technical and organisational measures (TOMs) can be found in the DPA Section 7.

The time at which you accept our terms does not rest on our own record alone: the fingerprint (SHA-256) of the accepted text is submitted to an independent timestamping authority (tsa.belgium.be, operated by the Belgian Federal Public Service BOSA; tsa.swisssign.net as standby), which certifies that this fingerprint existed no later than that moment. Only the fingerprint is transmitted — it does not allow the text or any person to be reconstructed.

9. Your Rights

Under Art. 15–22 GDPR, you have the following rights:

Right	Description
Access (Art. 15)	Request a copy of the personal data stored about you
Rectification (Art. 16)	Request correction of inaccurate data
Erasure (Art. 17)	Request erasure — we anonymise on account deletion
Restriction (Art. 18)	Request restriction of processing under certain conditions
Data portability (Art. 20)	Receive your data in a structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interest (Art. 6(1)(f))
Withdrawal of consent (Art. 7(3))	Withdraw consent given at any time with effect for the future

To exercise your rights, use any of these channels: our contact form (no account needed) or e-mail support@lingverra.com. If you have an account, you may also open a ticket in the “Support” area — your identity is then already established by your login.

You have the right to lodge a complaint with the competent data protection supervisory authority of your EU/EEA member state (in particular the authority of your habitual residence, place of work or place of the alleged infringement, Art. 77 GDPR). You may also contact our EU representative (see Section 1a) on data protection matters.

Objection to direct marketing. Where we process your data for direct marketing (Section 3.7), you may object at any time, free of charge and without giving reasons; we then stop processing it for that purpose (Art. 21(2) and (3) GDPR).

Ukrainian supervisory authority. As our company is established in Ukraine, you may also lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, who supervises compliance with the Law of Ukraine on the Protection of Personal Data.

If you left an enquiry but have no account with us (Section 3.5), you can exercise the same rights by writing to the contact address in Section 14. Two points are worth knowing before you do. First, the fastest route to stopping the processing is the withdrawal link in our e-mail to you — it takes effect at once and requires nothing from us. Second, 72 hours after the enquiry closes there is normally nothing left to give you or to erase: your address and comment have already gone. What we can still do at that point is confirm, from the consent record described in Section 3.5, whether consent was ever given for a specific address — which is the question that actually arises if you believe your details were passed on without your agreement.

10. Automated Decisions

We do not use automated decision-making or profiling that produces legal effects concerning individuals or similarly significantly affects them (Art. 22 GDPR). The AI-assisted translation merely supports the Customer and makes no autonomous decisions about individuals.

11. Minors

Lingverra is a B2B platform intended exclusively for professional use by businesses. We do not knowingly collect personal data from minors and are not directed at them.

12. Accountability & Data Protection Governance

We operate a documented data protection programme and can demonstrate compliance to the competent supervisory authority on request (accountability, Art. 5(2) GDPR). In particular, we maintain the following internal records and procedures, which are made available to the supervisory authority upon request:

• Records of Processing Activities (Art. 30 GDPR) — purposes, data categories, recipients and legal bases.
• Sub-processor agreements (Art. 28 GDPR) — list of sub-processors, the data processing agreements behind them, and a controller change-notification procedure.
• Technical and Organisational Measures (Art. 32 GDPR) — including per-document AES-256-GCM encryption of document content, role-based access control enforced in the application, transport encryption (TLS), and tamper-evident billing records.
• Data Protection Impact Assessment (Art. 35 GDPR) — carried out for the AI-assisted processing of document content, including potential special-category data.
• Legitimate Interests Assessment (Art. 6(1)(f) GDPR) — for security, fraud prevention and audit logging, service messages to registered users, and advertising by post to sworn translators listed in public registers.
• Personal Data Breach procedure (Art. 33 and 34 GDPR) — detection, assessment, 72-hour notification and a breach register.
• Data Subject Request procedure (Art. 12–22 GDPR) — identity verification, statutory time limits and fulfilment of your rights (see Section 9).
• EU representative mandate (Art. 27 GDPR) — the written appointment of our representative in the Union (see Section 1a).
• Retention and erasure policy (Art. 5(1)(e), 17 GDPR) — including automatic deletion of uploaded document content (see Section 4).

These records may also be obtained by the supervisory authority through our representative in the Union (Art. 27 GDPR; see Section 1a).

13. Changes to This Privacy Policy

Material changes are notified to registered users by e-mail or via a notice in the platform. The current version is available at /legal/privacy.

14. Contact

LLC "DataPrime"
E-mail: support@lingverra.com
https://lingverra.com/