Data Processing Agreement

1. When this applies

Translation, transcription, subtitling, interpreting and creative work often involves personal data, for example names in certificates, recordings of people, or medical and legal files. This agreement applies when a member who decides why and how that data is used (the “Controller”, usually the client or agency) shares it with another member who does the work (the “Processor”, usually the linguist, creative or agency), through the Platform or as a result of a job found on it.

It forms part of the Terms of Service. Members may agree their own data-processing terms instead. If they do, those terms take precedence between them.

2. Processor commitments

• Process the personal data only to complete the agreed job and only on the Controller’s documented instructions.
• Keep it confidential and make sure anyone who helps (for example, a reviewer or subcontractor) is bound by confidentiality.
• Use appropriate security: protected devices, strong passwords, encrypted storage or transfer where possible, and no public or unsecured sharing links.
• Don’t use sub-processors (including other linguists, or online tools that store or reuse content, such as public machine-translation or AI services) without the Controller’s prior permission.
• Help the Controller respond to data-subject requests and security incidents, and tell the Controller without undue delay (within 48 hours) of any personal-data breach.
• Delete or return all personal data when the job ends, unless the law requires keeping it, and confirm this on request.
• Don’t transfer the data outside the EU/EEA or UK unless the Controller agrees and appropriate safeguards are in place.
• Provide the information the Controller reasonably needs to show compliance.

3. Controller commitments

• Have a lawful basis for sharing the data and share only what the job needs. Anonymise or minimise files where possible.
• Clearly flag special categories of data (health, criminal records, biometric and similar) in the job before it is awarded.
• Give clear instructions on handling, retention and deletion.

4. TranslatorPub’s role

For files and messages exchanged on the Platform, TranslatorPub acts as a processor for both members: it only stores and transmits them to provide the service, with the security measures described in the Privacy Policy. TranslatorPub is not a party to the work itself and doesn’t access job files except to provide support, investigate abuse, or where the law requires it.

5. Standard Contractual Clauses

If a Controller in the EU/EEA or UK shares personal data with a Processor in a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2, controller to processor), with the UK addendum where relevant, apply between them and are incorporated by reference, with this agreement providing the required annex details (subject matter and duration: the job; data: as contained in the job files; security: section 2 above).