Data Processing Agreement
Last updated: 1 January 2025
This DPA forms part of the agreement between LingaCast and the Customer and is incorporated by reference into the Terms of Service. It governs the processing of personal data by LingaCast on behalf of the Customer in accordance with Article 28 of the GDPR.
1. Roles
- The Customer acts as the data controller of personal data contained in event audio, transcripts, and caption files.
- LingaCast acts as the data processor when processing such data to provide the service.
- LingaCast acts as the data controller for account and billing data.
2. Subject matter and nature of processing
LingaCast processes audio streams and resulting transcripts, translated text, and dubbed audio files on Customer's instructions. Processing includes: transmission, temporary storage, AI transcription, translation, and delivery of outputs. No personal data from event content is used to train models without explicit consent.
3. Duration
Processing continues for the duration of the subscription. Upon termination, event data is deleted within 30 days unless a longer retention period applies to the Customer's plan or is required by law.
4. Customer's instructions
LingaCast processes personal data only on documented instructions from the Customer (as configured in the platform) and as required by applicable law. We will inform the Customer if we believe an instruction violates GDPR.
5. Confidentiality
All LingaCast personnel with access to Customer data are bound by confidentiality obligations. Access is limited to those who need it to perform the service.
6. Security measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access control with audit logging
- Regular vulnerability scanning and patch management
- Isolated processing environments per organisation
- Annual security review
7. Sub-processors
LingaCast engages the following sub-processors. The Customer provides general authorisation for the use of sub-processors listed here. LingaCast will notify the Customer at least 14 days before adding or replacing a sub-processor.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Primary cloud infrastructure (VPS, object storage) | Germany (EU) |
| Cloudflare, Inc. | CDN, DDoS protection, video delivery (EU nodes) | Ireland (EU) |
| OpenAI Ireland Ltd. | Speech-to-text, translation (EU data residency contract) | Ireland (EU) |
| Stripe Payments Europe | Payment processing | Ireland (EU) |
| Resend Inc. | Transactional email (event notifications, invoices) | USA (SCCs in place) |
| Backblaze B2 / R2 | Caption file and recording storage (EU region) | EU |
8. International transfers
All primary processing occurs within the EEA. For sub-processors located outside the EEA (Resend Inc.), transfers are governed by Standard Contractual Clauses (Commission Decision 2021/914). Copies of SCCs are available on request.
9. Data subject rights
LingaCast will assist the Customer in responding to data subject requests (access, rectification, erasure, portability) within the platform where technically feasible. Requests can also be fulfilled via our export and deletion tools in the dashboard.
10. Data breach notification
LingaCast will notify the Customer without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach affecting Customer data. Notification will include the nature of the breach, categories of data affected, and remediation steps taken.
11. Audits
LingaCast will provide information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Customer or an authorised auditor with 30 days' written notice, at Customer's cost. LingaCast may require a confidentiality agreement before sharing audit-related information.
12. Deletion on termination
Upon termination of the service, LingaCast will delete or return all Customer personal data within 30 days of the termination date, unless applicable law requires longer retention. Confirmation of deletion is available on request.
13. Contact
DPA enquiries and sub-processor notifications: dpo@lingacast.com
LingaCast, EU