This data processing agreement (“DPA”, in German: Auftragsverarbeitungsvertrag, AVV) governs how we process personal data on behalf of our customers when they use Heylingo, in accordance with Art. 28 of the EU General Data Protection Regulation (GDPR). It forms part of our terms of service.
1. Parties, conclusion and scope
This DPA is concluded between you, the customer, as controller (“you”), and Jermaine J. Ernst, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany, as processor (“we”, “us”).
This DPA becomes part of your contract for Heylingo automatically when you accept the terms of service, normally by completing the Stripe Checkout. No separate signature is needed. The DPA is concluded in electronic form (Art. 28(9) GDPR). You can view, save and print it at heylingo.io/dpa at any time.
This DPA applies to all personal data that we process on your behalf when we provide Heylingo (“customer data”). The details of the processing are set out in Annex 1, our technical and organisational measures in Annex 2 and the approved sub-processors in Annex 3.
This DPA does not apply to personal data that we process as a controller for our own purposes, in particular to conclude, perform and bill the contract with you (for example your name, checkout email address, billing details and our correspondence with you), to operate heylingo.io and to meet our legal obligations. Our privacy policy covers this processing. Stripe processes payment data as an independent controller and is not our sub-processor.
2. Subject matter and duration
The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.
The processing lasts for the term of the contract under the terms of service and ends once we have deleted the customer data in accordance with section 12.
3. Your instructions
We process customer data only on your documented instructions, including with regard to transfers to a third country, unless EU or member state law requires us to process it. In that case, we inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
Your instructions are documented in the terms of service, this DPA and the way you use and configure Heylingo, for example the pages on which you integrate the script, the languages you choose and the corrections you make.
You may give further instructions in text form (for example by email). They must stay within the scope of the service described in the terms of service and must be technically feasible and reasonable for us. Section 11 applies to the costs. If we cannot reasonably carry out an instruction, we will tell you; you may then terminate the contract.
If we believe that an instruction infringes data protection law, we will inform you without undue delay. We may suspend carrying out the instruction until you confirm or change it. We are not obliged to carry out a comprehensive legal review of your instructions.
4. Your responsibilities as controller
You are responsible for the lawfulness of the processing of customer data and for safeguarding the rights of data subjects. In particular, you are responsible for:
- having a legal basis for the processing, including the transfer of your website’s text to us and our sub-processors,
- informing the visitors of your website and other data subjects about the processing, in particular in your privacy policy, including the use of Heylingo, our sub-processors and transfers to third countries,
- assessing whether storing the chosen language in the visitor’s browser requires consent under the rules that apply to you, for example § 25 TDDDG,
- the content of your website, including any personal data it contains,
- responding to requests from data subjects.
You decide which pages and content Heylingo translates. You must not have the following data translated with Heylingo and must exclude it from translation:
- special categories of personal data (Art. 9 GDPR) and personal data relating to criminal convictions and offences (Art. 10 GDPR),
- passwords, access data, payment card or bank account details, official identification numbers and similar confidential data,
- personal data that your website shows only to individual logged-in users, for example in customer accounts, order details or messages.
You can exclude content by not integrating the script on a page, or by marking the content with the attribute translate="no", the class notranslate or the attribute data-heylingo-skip.
You must inform us without undue delay if you notice errors or irregularities in the processing of customer data.
5. Confidentiality
We ensure that all persons authorised to process customer data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after their work for us ends.
6. Security of processing
We implement the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).
The measures are designed for the processing of website content as described in Annex 1. It is your responsibility to check, before you use Heylingo, whether these measures are appropriate for the customer data you have translated. If you need a higher level of protection for certain data, you must not have that data translated with Heylingo.
The measures are subject to technical progress and development. We may adapt them, provided the level of security is not reduced. Annex 2 always describes the current measures.
7. Sub-processors
You give us general authorisation to engage sub-processors (Art. 28(2) GDPR). The sub-processors listed in Annex 3 are approved.
We inform you by email at least 30 days in advance of any intended addition or replacement of a sub-processor. You may object to the change in text form within this period on reasonable grounds relating to data protection. If you do not object in time, the change is deemed approved. We will point this out specifically in our notice.
If you object, we will try to find a solution. If we cannot offer one that is reasonable for both parties, either party may terminate the contract with effect from the date the change takes effect.
If a sub-processor has to be replaced at short notice for reasons beyond our control, for example because it stops providing its service, or for urgent security reasons, we may engage a new sub-processor immediately. We will inform you without undue delay. Your right to object then applies accordingly, and the period starts when you receive our notice.
We engage sub-processors only under a contract that imposes on them data protection obligations that offer the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). Where a sub-processor offers only standard terms, we engage it only if these terms meet the requirements of Art. 28 GDPR.
We are responsible to you for our sub-processors’ compliance with their data protection obligations (Art. 28(4) GDPR). Section 14 applies to our liability.
Services that we use as ancillary services, for example telecommunications services, postal services or the maintenance of hardware or software where no access to customer data is intended, are not sub-processing within the meaning of this section.
8. Transfers to third countries
The translation service and the translation memories run on servers in Germany.
Some sub-processors process customer data in countries outside the European Union and the European Economic Area, as shown in Annex 3. You instruct us to make these transfers. We and our sub-processors make them only if the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified recipients (Art. 45 GDPR), or of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
If the legal basis for a transfer ceases to apply, we will switch to another legal basis or another sub-processor within a reasonable period. If this is not possible, either party may terminate the contract.
9. Data subject rights
Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures, where possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR.
Heylingo does not create profiles of the visitors to your website. You can correct translations yourself in the edit mode on your website. At your request, we delete specific entries or the entire translation memory of your website.
If a data subject contacts us directly with a request that relates to your website, we forward it to you without undue delay. We do not respond to the request ourselves unless you instruct us to.
10. Further assistance and personal data breaches
Taking into account the nature of the processing and the information available to us, we assist you in meeting your obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority).
We notify you without undue delay after becoming aware of a personal data breach affecting customer data. Our notification contains the information under Art. 33(3) GDPR that is available to us at that time. We provide further information as soon as it becomes available. We take reasonable measures to contain the breach and mitigate its possible consequences. A notification is not an acknowledgement of fault or liability.
We send notifications to the email address you gave at checkout or that you have given us later in text form. You must keep this address up to date.
11. Costs
We may charge reasonable compensation for our effort in assisting you under sections 9 and 10, for carrying out further instructions under section 3 and for inspections under section 13, as far as the effort goes beyond what is minor. We will tell you the expected costs in advance.
This does not apply to notifications of personal data breaches, or where the assistance is necessary because we have breached this DPA or data protection law.
12. Deletion and return
After the contract ends, we delete the customer data 30 days after the end of the contract, as set out in section 8 of the terms of service, unless EU or member state law requires us to keep it.
Until then, you can ask us in text form to return the customer data instead. We then provide your website’s translation memory, including your corrections, in a common machine-readable format of our choice and delete it afterwards. The original text of your website remains available to you on your website.
Customer data in backups and logs is deleted when these are overwritten or deleted in the regular cycle. Until then, it remains protected under this DPA and is not actively used.
At your request, we confirm the deletion in text form.
We make available to you all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, and we allow for and contribute to audits, including inspections, by you or an auditor mandated by you.
We primarily demonstrate compliance through this DPA, the description of our measures in Annex 2, written information on request and, where available, certificates and audit reports of our sub-processors, for example ISO 27001 certificates or SOC 2 reports.
If this information is not sufficient in a specific case, you may carry out an inspection under the following conditions:
- you notify us in text form at least 30 days in advance, stating the reason, scope and proposed date,
- the inspection takes place during normal business hours, without disrupting our operations, and no more than once per calendar year, unless there are concrete indications of a breach of this DPA or a supervisory authority requires it,
- the inspection is carried out by you or by an independent auditor who is bound to confidentiality and is not our competitor,
- the inspection is limited to the processing of customer data and does not cover data of other customers or our trade secrets.
As our servers are operated by sub-processors in their data centres, inspections generally take place by reviewing documentation, configurations and processes, and may take place remotely. Inspections of sub-processors are governed by the audit rights in their contracts, which we exercise on your behalf where necessary.
You bear your own costs of an inspection. Section 11 applies to our costs, unless the inspection reveals a material breach of this DPA by us.
14. Liability and indemnity
Liability towards data subjects is governed by Art. 82 GDPR.
Between you and us, our liability under or in connection with this DPA is governed by section 10 of the terms of service (Liability). This also applies to claims between the parties under Art. 82(5) GDPR, as far as permitted by law. This DPA does not create any separate or additional liability.
You indemnify us against claims by third parties, in particular by data subjects, and against the reasonable costs of our legal defence, including in proceedings before supervisory authorities, as far as these are based on your breach of this DPA or of your obligations as controller under data protection law. Examples include processing without a legal basis, insufficient information to data subjects, unlawful instructions and content that you must exclude from translation under section 4. This does not apply if you are not responsible for the breach.
15. Term
This DPA applies for as long as the contract under the terms of service is in force and, after that, until we have deleted or returned all customer data. It cannot be terminated separately. Sections 5, 12 and 14 continue to apply after the end of the DPA as far as necessary.
16. Changes to this DPA
We may change this DPA in accordance with section 11 of the terms of service. Changes to Annex 2 are governed by section 6 and changes to Annex 3 by section 7 of this DPA.
We may also change this DPA without that procedure where the change is necessary to comply with mandatory law, a decision of a court or supervisory authority, or new standard contractual clauses, and does not reduce the protection of customer data. We inform you of such changes by email.
17. Final provisions
If this DPA and the terms of service conflict on the protection of personal data, this DPA prevails. In all other respects, the terms of service apply, in particular their provisions on liability, governing law and place of jurisdiction.
Notices and instructions under this DPA must be given in text form, for example by email. Our address for this is info@heylingo.io.
If any provision of this DPA is or becomes invalid, the remaining provisions remain valid. The invalid provision is replaced by the statutory provisions.
Annex 1: Details of the processing
Subject matter and nature
Heylingo translates the content of your website(s) as described in section 2 of the terms of service. The processing comprises receiving page text and technical request data from the browsers of your website’s visitors, translating new text with AI, storing translations in a translation memory for your website, delivering translations to visitors, storing your corrections, limiting excessive use, transferring data to sub-processors and deleting data.
Purpose
Providing Heylingo to you under the terms of service, including the security and stability of the service and the prevention of misuse. Your usage is measured as the number of translated characters, which contains no personal data.
Types of personal data
- Website content: personal data contained in the text of your website that is translated, for example names, job titles, contact details, quotes or reviews of people mentioned on your website.
- Request data of visitors: IP address, date and time, the address of the page and technical information sent by the browser, such as the user agent and the preferred language. In our databases, IP addresses are stored only as a one-way hash and only for the current day, to limit excessive use.
- Language choice: the language chosen by the visitor, which the Heylingo script stores in the visitor’s browser.
- Your authorised users: email address, login and session data (such as time of login and browser) and the corrections made in edit mode, with time stamps.
No special categories of personal data are processed. You must not have them translated (section 4).
Categories of data subjects
- visitors to your website(s),
- persons mentioned in the content of your website(s), for example your employees, customers, business partners or authors,
- your authorised users, such as the site owner and editors.
Duration
The term of the contract plus the deletion period (section 12).
Places of processing
Germany (translation service and translation memories), Cloudflare’s global network (delivery of the script, API, database and email) and the USA (AI translation). Details are listed in Annex 3.
Annex 2: Technical and organisational measures
Confidentiality
- Physical access control: all systems run in the data centres of our sub-processors (Annex 3), which have their own physical access controls. We do not operate any servers on our own premises.
- System access control: the server of the translation service accepts no incoming connections other than SSH. SSH access requires a personal key; password logins and logins as root are disabled. Login attempts are rate-limited, and repeated failed attempts are blocked. Web traffic reaches the server only through an encrypted Cloudflare Tunnel that the server opens outbound and that is protected by Cloudflare Access.
- Data access control: the translation service only accepts requests from our edge service, authenticated with a secret token. The deployment account accepts only the key of the automated deployment and has restricted rights. Edit mode is available only to authorised users of the respective website. Login codes and session tokens are stored only as hashes. Secrets are kept outside the source code.
- Separation: customer data is stored per website and processed only for that website. Development and testing take place in separate environments.
- Pseudonymisation and data minimisation: the script sends only the text to be translated and the technical data needed for the request. It sets no cookies and creates no visitor profiles. IP addresses are stored only as a hash and only for the current day. Translations are stored in the translation memory, so text that has already been translated is not sent to the AI provider again. Under its commercial terms, the AI provider does not use the transmitted data to train its models.
Integrity
- Transfer control: all transfers over public networks are encrypted (HTTPS/TLS): between visitors’ browsers and Cloudflare, between Cloudflare and the translation service (Cloudflare Tunnel) and to the AI provider.
- Input control: corrections made in edit mode are logged with the user, the time and the previous and new value. Changes to our systems are deployed through a versioned, automated deployment process.
Availability and resilience
- Protection against overload and attacks through Cloudflare’s network, including DDoS protection.
- Automatic installation of security updates for the server’s operating system.
- Limits on excessive use per website and per network.
- If the translation service is unavailable, your website shows its original language and remains available.
Regular review
- We review the measures regularly and whenever the service changes significantly, and adapt them to technical progress.
- We select sub-processors with regard to their data protection and security measures.
- Persons with access to customer data are committed to confidentiality.
- Personal data breaches are assessed, documented and reported in accordance with section 10.
Annex 3: Sub-processors
Cloudflare, Inc.
101 Townsend St., San Francisco, CA 94107, USA
- Service: delivery of the Heylingo script, edge service and API, database for website settings and edit mode, sending emails with login codes, protection against attacks, encrypted tunnel to the translation service
- Location: global network, including the USA
- Transfer safeguard: EU-U.S. Data Privacy Framework (Art. 45 GDPR); otherwise standard contractual clauses (Art. 46(2)(c) GDPR)
netcup GmbH
Karlsruhe, Germany
- Service: server for the translation service and the translation memories
- Location: Germany
- Transfer safeguard: not required (processing in the EU)
Anthropic PBC
San Francisco, USA
- Service: AI translation of text that is not yet in the translation memory
- Location: USA
- Transfer safeguard: standard contractual clauses (Art. 46(2)(c) GDPR)
Last updated 16 October 2026