Data Processing Agreement

For business customers who need a data processing agreement under Article 28 GDPR. This page is the agreement we offer; a countersigned copy is available on request once the operating company is incorporated.

Last reviewed — 2026-09-12

These documents were drafted by the operator and checked against the running system. They do not constitute legal advice and remain subject to review by a qualified practitioner.

1. Who is controller and who is processor

For the content of the documents you upload, your glossaries, and the translations produced from them, you are the controller and we are your processor: we process that content only on your instruction, and using the service constitutes that instruction.

For your own account data — the identity and contact details of the person who signs up, authentication records, billing and credit accounting, security and abuse records, and our usage and cost telemetry — we are the controller. We decide to collect it, we decide why, and we are answerable for it under our Privacy Policy.

Our merchant of record is an independent controller for the payment, tax and fraud data it collects from you at checkout, under its own terms.

2. Subject matter, duration, nature and purpose

Subject matter and purpose: machine translation of documents you submit, preserving their layout, and delivery of the translated file back to you. Nature of processing: storing, extracting text from, optically recognising text in, transmitting to the subprocessors listed on our Subprocessors page, translating, re-rendering, and deleting.

Duration: for the life of your account, except that document content is deleted 24 hours after upload as described in the Privacy Policy.

Categories of data subject and of personal data: whatever your documents contain. We do not control that and cannot restrict it, which is why you must not upload categories of data you are not permitted to send to processors in the United States. Special category data, if present in your documents, is processed as ordinary content — we apply no additional safeguards for it beyond those described here.

3. Our obligations as processor

We process content only on your documented instruction, including for transfers, unless required otherwise by law, in which case we will tell you before processing unless the law forbids it. We ensure that people authorised to process content are bound by confidentiality.

We implement the technical and organisational measures described in the security section of our Privacy Policy, and we will tell you without undue delay after becoming aware of a personal data breach affecting your content, with enough information for you to meet your own notification duties.

We assist you, taking into account the nature of the processing, with data subject requests, with data protection impact assessments and with prior consultation, and we make available the information needed to demonstrate compliance with this agreement.

4. Subprocessors

You give general authorisation for the subprocessors listed on our Subprocessors page. We impose data protection obligations on each of them no less protective than these, and we remain fully liable to you for their performance. We will announce any new subprocessor on that page before it starts processing customer content, and you may object on reasonable data protection grounds as described there.

5. International transfers

Content is processed outside the European Economic Area, principally in the United States. Those transfers rely on the Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, as set out in the data processing terms we hold with each subprocessor. We do not offer EU-only processing.

6. Return and deletion

Document content is deleted automatically 24 hours after upload, so in normal operation there is nothing left to return at the end of the agreement. On termination, deleting the account erases the remaining content and records as described in the Privacy Policy, except for the payment and accounting records we are required to keep, which are pseudonymised.

7. Audits

On reasonable notice, and no more than once a year unless a supervisory authority requires otherwise, we will answer a written audit questionnaire and provide the information reasonably needed to demonstrate compliance. We are a small operation and do not hold third-party certifications such as ISO 27001 or SOC 2.

8. How to put this in place

Using the service on these terms puts this agreement in place between us. If your procurement process needs a signed copy, or a specific clause set, write to the legal contact address and Velniq Ltd will countersign as processor.

Downloadable copy

If your procurement process needs a file rather than a web page, download the agreement below. It is generated from the same source as this page every time it is requested, so it can never be an outdated copy, and it carries the same visible gaps for values that do not exist yet.

Download the Data Processing Agreement (Markdown)