Data Processing Agreement
Last updated: 17 May 2026
This DPA forms part of the agreement between LingaCast B.V., a private limited company registered in the Netherlands ("LingaCast"), and the Customer, and is incorporated by reference into the Terms of Service. It governs the processing of personal data by LingaCast on behalf of the Customer in accordance with Article 28 of the GDPR.
1. Roles
- The Customer acts as the data controller of personal data contained in event audio, transcripts, and caption files.
- LingaCast acts as the data processor when processing such data to provide the service.
- LingaCast acts as the data controller for account and billing data.
2. Subject matter and nature of processing
LingaCast processes audio streams and resulting transcripts, translated text, and dubbed audio files on Customer's instructions. Processing includes: transmission, temporary storage, AI transcription, translation, and delivery of outputs. No personal data from event content is used to train models without explicit consent.
3. Duration
Processing continues for the duration of the subscription. Upon termination, event data is deleted within 30 days unless a longer retention period applies to the Customer's plan or is required by law.
4. Customer's instructions
LingaCast processes personal data only on documented instructions from the Customer (as configured in the platform) and as required by applicable law. We will inform the Customer if we believe an instruction violates GDPR.
5. Confidentiality
All LingaCast personnel with access to Customer data are bound by confidentiality obligations. Access is limited to those who need it to perform the service.
6. Security measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access control with audit logging
- Regular vulnerability scanning and patch management
- Isolated processing environments per organisation
- Annual security review
7. Sub-processors
LingaCast engages the following sub-processors. The Customer provides general authorisation for the use of sub-processors listed here. LingaCast will notify the Customer at least 14 days before adding or replacing a sub-processor.
| Category | Sub-processor | Purpose | Location |
|---|---|---|---|
| Infrastructure | OVH SAS | Hosts the LingaCast platform | EU |
| Cloudflare Ireland, Ltd. | Object storage, CDN delivery, DDoS protection, video streaming, bot protection | EU | |
| GPU compute | OVH SAS | Primary GPU instances for live transcription, translation, and dubbing pipelines | EU |
| RunPod, Inc. | Backup GPU capacity when our primary OVH GPU pool is full — EU pods only | EU | |
| AI — Speech-to-Text | Google Ireland Ltd. | Google Cloud Speech-to-Text V2 (Chirp) and Gemini API | EU |
| Microsoft Ireland Operations Ltd. | Azure Speech (speech-to-text) | EU | |
| AI — Translation | Google Ireland Ltd. | Gemini API and Google Cloud Translation v3 | EU |
| Microsoft Ireland Operations Ltd. | Azure Translator | EU | |
| AI — Text-to-Speech | Google Ireland Ltd. | Google Cloud TTS (Neural2, Studio, WaveNet) and Gemini TTS | EU |
| Microsoft Ireland Operations Ltd. | Azure Speech (text-to-speech) | EU | |
| Microsoft Ireland Operations Ltd. | Microsoft 365 SMTP — transactional email (invoices, notifications) | EU (Microsoft 365 EU Data Boundary) |
“AI” sub-processors are routed per event; a single event typically uses one speech-to-text, one translation, and one text-to-speech provider — not all of them. The full set is disclosed for transparency. Default routing prefers EU-resident providers where the requested language is supported.
8. International transfers
All Customer personal data is processed within the European Union. Every sub-processor listed above operates from an EU region or — for global providers — under its EU subsidiary with data residency pinned to the EU. No Standard Contractual Clauses are required because no Customer data leaves the EEA.
9. Data subject rights
LingaCast will assist the Customer in responding to data subject requests (access, rectification, erasure, portability) within the platform where technically feasible. Requests can also be fulfilled via our export and deletion tools in the dashboard.
10. Data breach notification
LingaCast will notify the Customer without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach affecting Customer data. Notification will include the nature of the breach, categories of data affected, and remediation steps taken.
11. Audits
LingaCast will provide information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Customer or an authorised auditor with 30 days' written notice, at Customer's cost. LingaCast may require a confidentiality agreement before sharing audit-related information.
12. Deletion on termination
Upon termination of the service, LingaCast will delete or return all Customer personal data within 30 days of the termination date, unless applicable law requires longer retention. Confirmation of deletion is available on request.
13. Contact
DPA enquiries and sub-processor notifications: dpo@lingacast.com