Data Processing Addendum

This Data Processing Addendum (Addendum) forms part of the Terms when you submit content that contains personal data about people other than yourself. You are the controller of that personal data. GlotEO processes it as a processor on your instructions.

It does not apply to personal data we collect about you as an account holder, website visitor, or person who contacts us. For that data we are the controller, as described in the Privacy Policy.

1. Instructions

We process Customer Personal Data only to:

1. provide, maintain, secure, and support the translation, localization, and publishing services you request;
2. follow your settings in the product, including deletion; and
3. comply with law, or with a binding request from a competent authority, in which case we will tell you first unless the law prohibits that notice.

We do not use Customer Personal Data to train or fine-tune AI models unless you give separate, explicit permission. We require our AI providers, including OpenAI, Google Gemini, and Verbalate, not to use that content for model training unless you have given that permission. This is the same rule as the Privacy Policy and the Security page.

2. Your responsibilities

You are responsible for:

1. having a lawful basis to collect and submit the data;
2. telling the people concerned whatever notice the law requires;
3. not sending sensitive information unless you have a lawful basis and we have agreed in writing that the service may be used for it; and
4. the accuracy and legality of the content.

Connecting a website can cause us to process personal data that is already on the pages, even if you did not intend to upload it.

3. Confidentiality

We limit access to Customer Personal Data to people who need it to perform the services, and we require them to keep it confidential.

4. Security

We maintain the safeguards described in the Terms and on the Security page, including access controls, HTTPS for the website and application, and hashed passwords. We review those measures as the platform develops. No system is completely secure, and this Addendum does not promise a particular certification.

5. Subprocessors

You authorize the subprocessors listed at /subprocessors, including OpenAI and Google (Gemini API) where a feature sends content to them to generate a translation or localization. We remain responsible for their processing of Customer Personal Data to the extent the Terms make us responsible for the services.

Their published API terms describe default limits on model training and temporary retention for abuse monitoring or service operation. Those terms do not make the service zero retention, and they do not certify GlotEO. A provider may keep a copy after the response is generated, as the register describes. That retention is not permission to train a model on the content.

If we add or replace a subprocessor that will process Customer Personal Data, we will update the register first, or as soon as practicable afterwards if the change is required for security. You may object on reasonable data-protection grounds by contacting us within 14 days of the update. We will discuss a practical alternative. If we cannot agree, you may stop using the affected feature or cancel the subscription as the Terms allow.

6. International transfers

Customer Personal Data may be processed in Australia and in other countries named in the subprocessor register, including the United States. Where a transfer from the UK or EEA requires a transfer tool, we use the European Commission’s standard contractual clauses or another lawful mechanism. Contact us if you need a copy of the relevant module.

7. Incidents

If we become aware of a confirmed incident that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Customer Personal Data, we will notify you without undue delay. The notice will describe, so far as we know them, the nature of the incident, the categories of data affected, and the measures we have taken or propose.

This notice is our notice to you as controller. It is separate from any duty you or we may have to notify a regulator or affected people. We will reasonably cooperate with your investigation and with notices you are required to give.

8. People exercising privacy rights

If we receive a request from a person seeking to exercise a right in Customer Personal Data, we will direct them to you unless the law requires us to respond. We will reasonably assist you to respond, taking into account the nature of the processing and the information available to us.

9. Deletion and export

You can export project data while the subscription is active and during the cancellation period in the Terms. After the agreement ends, or after you delete a project, we delete Customer Personal Data from active systems within 30 days, except records we must keep for law, tax, or security. Backup copies expire within 90 days under our backup rotation.

Deletion from GlotEO does not remove copies of pages you have already published, including copies held by search engines or other third parties.

10. Audits

On written request, and no more than once in any 12-month period unless a confirmed incident justifies another request, we will provide information reasonably necessary to demonstrate compliance with this Addendum. A broader audit, including on-site review, is available only if we agree the scope in writing. You bear your own costs unless the audit shows a material breach of this Addendum.

11. Order of documents

If this Addendum conflicts with the Terms on the processing of Customer Personal Data, this Addendum prevails. The Terms still govern liability, fees, and termination.

Related: Security · Privacy Policy · Subprocessors · Terms · Contact