Sub-processors

Pursuant to Art. 28(2) and (4) GDPR  •  LLC "DataPrime" (46215708)  •  Governing language: English  •  Translations of this document into other languages are provided for convenience. The English text is the authentic version and prevails for the purposes of interpretation. However, where a translation departs from the English text, we shall not invoke that discrepancy to the detriment of the Customer.

1. Overview

In this document, "Lingverra" refers to LLC "DataPrime" (registration number 46215708), the company operating the Lingverra service; "Lingverra" is the commercial designation under which the company provides the service.

To provide the translation service, LLC "DataPrime" engages the sub-processors listed below (third-party companies that process personal data on our behalf). The sub-processors that process data on our instruction (hosting, AI translation) are bound by data processing agreements pursuant to Art. 28 GDPR. The payment service provider (Section 4) acts as an independent controller for the payment transaction and is not an Art. 28 sub-processor; it is listed here for transparency. The processing of document content (including the AI-assisted translation) takes place exclusively within the European Economic Area. The only transfer outside the EEA concerns the payment transaction: it rests on Art. 49(1)(b) GDPR (see Section 4), because the acquiring bank is an independent controller and not a processor acting on our instruction. Neither service receives the document content. For users of the service, the payment transaction is the only transfer outside the EEA. Data of the recipients of our advertising letters (who are not users of the service) are transferred to Pingen GmbH in Switzerland on the basis of the European Commission’s adequacy decision (Art. 45 GDPR); see Section 3.

No external error, performance or analytics services are used. No external CRM, support-chat or marketing-automation services are used. All monitoring takes place on our own infrastructure.

2. AI Translation

To provide the translation service, the content of the uploaded document (image/PDF and the text extracted from it) is processed by the “Claude” language model through an EU channel. The channel in use is Opper (Sweden), a gateway through which the model runs on Amazon Bedrock in the EU/EEA; Amazon Web Services (Frankfurt region) and Google Cloud Platform (EU jurisdictional endpoint) are contracted as alternative EU channels. Only EU model routes are called, and a request that would be served outside the EEA is rejected rather than used; the document content and the machine-learning processing itself remain within the European Economic Area. This processing is an integral and necessary part of the service; without it, no translation can be provided. By uploading a document for translation, the Customer instructs and consents to this processing. The content is not used to train any models.

Sub-processor	Purpose	Location	Legal basis
Opper Technology AB Stockholm, Sweden — platform in the EU/EEA; model processing on Amazon Bedrock in the EU/EEA	Gateway to the “Claude” language model for the AI-assisted translation of the document content — the channel in use. The content is processed within the EEA and is not used to train any models. Opper keeps no copies of requests (zero-day retention); our own check deletes any copy that would nevertheless be recorded. On Amazon Bedrock, inputs and outputs of the Claude models used are not stored and are not passed to the model developer (AWS: zero operator access).	EU/EEA	Art. 28 GDPR — Opper Data Processing Agreement. Processing takes place within the EEA; no transfer to a third country occurs for the document content. The specific current processing location within the EU/EEA is available on request. Opper DPA
Amazon Web Services EMEA SARL 38 avenue John F. Kennedy, L-1855 Luxembourg — processing region: Frankfurt, Germany (eu-central-1)	Hosting of the “Claude” language model (via Amazon Bedrock) for the AI-assisted translation of the document content — contracted alternative channel. The content is processed only temporarily to produce the translation, is processed exclusively within the EEA, and is not used to train any models. For the Claude models used, Amazon Bedrock does not store inputs and outputs and does not pass them to the model developer.	Germany (EU/EEA)	Art. 28 GDPR — AWS Data Processing Addendum (GDPR DPA). Processing takes place within the EEA (Frankfurt); no transfer to a third country occurs for the document content. AWS GDPR Center
Google Cloud EMEA Limited Velasco, Clanwilliam Place, Dublin 2, D02 FP82, Ireland — processing via the EU jurisdictional endpoint (EU multi-region)	Hosting of the “Claude” language model (via Google Cloud Platform — Vertex AI) for the AI-assisted translation — contracted alternative channel. The content is processed only temporarily to produce the translation, is processed exclusively within the EEA (the EU jurisdictional endpoint keeps the machine-learning processing itself within EU member states), and is not used to train any models.	Ireland (EU/EEA)	Art. 28 GDPR — Google Cloud Data Processing Addendum (CDPA). Processing takes place within the EEA (EU jurisdictional endpoint); no transfer to a third country occurs for the document content. Google Cloud DPA

3. Infrastructure & Hosting

Sub-processor	Purpose	Location	Legal basis
netcup GmbH Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany	Server hosting; PostgreSQL database; Redis session store; file storage (uploaded documents and translations); outbound e-mail dispatch (SMTP)	Germany (EU/EEA) — Nuremberg	Art. 28 GDPR — data processing agreement pursuant to Art. 28(3) GDPR. Data centre certified to ISO 9001, ISO 27001 and ISO 27701. netcup belongs to the Anexia group and engages the following onward processors, all located within the EU: Anexia Holding GmbH (Klagenfurt, Austria — support and billing services); Anexia Cloud Solutions GmbH (Klagenfurt, Austria) and Anexia Cloud Solutions GmbH (Karlsruhe, Germany) — data-centre infrastructure and personnel. netcup operates sites in Karlsruhe, Nuremberg and Vienna; all of them, like the onward processors, are located within the EU, so no document content leaves the EEA through this chain.
Pingen GmbH Badenerstrasse 47, 8004 Zürich, Switzerland	Printing and posting of advertising letters. Concerns only the recipients of these letters, not users of the service; receives the letter file, including the recipient’s name and postal address. Onward processors: printing partners and postal operators in the destination country (list: pingen.com, or from us on request).	Switzerland — hosting in Switzerland	Art. 28 GDPR — data processing agreement. Transfer to Switzerland on the basis of the European Commission’s adequacy decision (Art. 45 GDPR).

4. Payment Service Provider (independent controller)

The payment provider below takes the payment on its own regulated/PCI surface and determines the means of that processing itself. It is therefore an independent controller for the payment leg, not our Art. 28 sub-processor. It never receives the document content.

Sub-processor	Purpose	Location	Legal basis
JSC «FUIB» — АТ «Перший Український Міжнародний Банк» (ПУМБ) internet-acquiring service hutko; ЄДРПОУ 14282829, 04070 Kyiv, vul. Andriivska 4, Ukraine	Card payments for credit packages. The card is entered on the bank’s own payment page, embedded in an isolated frame. The bank receives only the amount, our order reference and the order description — we pass it no name, e-mail address or postal address; the card number is entered on the bank’s page and never reaches us; no document content reaches the bank.	Ukraine (third country, no adequacy decision)	Independent controller for the card payment leg (not an Art. 28 sub-processor), supervised by the National Bank of Ukraine and operating under its own PCI DSS scope. Transfer basis: Art. 49(1)(b) GDPR — necessary for the performance of the contract with the data subject (executing the payment they initiated). The bank is not a processor acting on our instruction, so no Art. 28 GDPR data processing agreement is concluded here.

5. Changes to This List

Customers who have concluded a Data Processing Agreement (DPA) with LLC "DataPrime" are informed of any addition or replacement of a sub-processor at least 30 days in advance, pursuant to DPA Section 6. A version history is available on request.

The current version is available at /legal/subprocessors.

6. Contact

For questions about our sub-processors or data processing:
support@lingverra.com