Parties and roles

This agreement applies between the customer ("you", controller, or processor acting for your own client) and DeepReference ("processor", or sub-processor where you act for a client) whenever your documents, texts, glossaries or translation memories contain personal data for which you are responsible. It forms part of the Terms of Service and applies automatically. If you need a countersigned copy, write to [email protected].

Subject matter, nature and purpose

DeepReference processes the personal data only to provide the service you use: storing, translating, editing, exporting, comparing and deleting your content, giving support you request, and keeping the service secure. Duration: for as long as you use the service and until deletion under this agreement.

Types of data and data subjects

Any personal data contained in your content, as chosen by you: for example names, contact details, identification numbers, contract, employment, financial or health information of your clients, their customers, employees, patients or other people named in the documents. You decide whether special-category data (Article 9 GDPR) or criminal-offence data (Article 10) is uploaded and must have a legal basis for it; minimise or redact what translation does not need.

Your instructions

DeepReference processes the data only on your documented instructions, which are these terms and the actions you take in the service, including transfers, unless EU or Italian law requires otherwise (we then tell you, unless that law forbids it). We tell you if we believe an instruction breaches data protection law. We never use the data to train or improve our models, never sell it, and never use it for our own purposes.

Confidentiality

Everyone at DeepReference authorised to process the data is bound by confidentiality, and access is limited to what each task needs (running the service, support you ask for, security and legal obligations).

Security measures (Article 32)

TLS for all traffic and, for supported browser traffic, encryption in the browser before sending; encryption at rest for stored files where configured; translation by our own model on our own servers in the EU, with no outside AI provider; access control, multi-factor sign-in for platform administrators, per-workspace permissions and session management; upload validation; security and audit logging (180 days); backups that expire within 14 days; regular software updates. Our servers decrypt content to translate it, so this is not end-to-end encryption.

Sub-processors

Your content (documents, translations, glossaries, memories) is processed only on DeepReference's own infrastructure in the EU and is not shared with any other company. Providers that process limited account or service data: Stripe (payments), Cloudflare (network security and delivery; traffic passes through its network in encrypted form), Namecheap PrivateEmail (account email), Google (only if a user chooses Google sign-in), PayPal (only where offered). You give general authorisation for these; we inform you at least 30 days before adding or replacing a provider that would process your content, by email or in the product, and you may object. If we cannot address a reasonable objection, you may terminate the affected service with a pro-rata refund. We impose data protection obligations on each sub-processor equivalent to this agreement and remain responsible for them.

Data subject requests and assistance

The workspace lets you find, export, correct and delete content yourself. If a person contacts us directly about data in your content, we forward the request to you and do not answer it ourselves unless you instruct us to. We assist you, taking into account the nature of the processing, with security, breach notifications, data protection impact assessments and prior consultations.

Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting personal data in your content, with the information available at that moment (nature of the breach, categories and approximate number of records and people, likely consequences, measures taken), and we update you as the investigation continues.

International transfers

Your content is processed and stored in the EU. If a transfer of personal data outside the EU/EEA becomes necessary, it will take place only with an adequacy decision or the European Commission's Standard Contractual Clauses and the additional measures they require.

Deletion and return

You can export and delete your content at any time. When you delete content or your account, it is removed from the active service; backup copies expire within 14 days. We keep personal data longer only where EU or Italian law requires it.

Audits and information

We make available the information needed to show compliance with Article 28 GDPR, including this agreement and a description of our measures, and answer reasonable written questions. Where that is not sufficient, you may audit, or have an independent auditor bound by confidentiality audit, our compliance once a year, with 30 days' notice, at your cost, in a way that does not disrupt the service or expose other customers' data.

Liability and precedence

Liability under this agreement follows the Terms of Service, without limiting liability that cannot be limited under the GDPR. If this agreement and the Terms of Service conflict on the protection of personal data, this agreement prevails.

Data protection contact

Questions about this agreement or a countersigned copy: [email protected]. Privacy requests: [email protected].

法律实体: DeepReference
邮寄地址: Via Sandro Pertini 7, 00054 Fiumicino, Italy
隐私和数据权利请求: [email protected]
数据保护官联系方式: [email protected]