Privacy Policy

1. Controller & contact

The controller responsible for the processing of your personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

Our Data Protection Officer can be reached at: hello@transzlate.com

2. Data we collect and why

2.1 When you place an order

To fulfil your certified translation order we process:

• Contact data: First name, last name, email address, and optionally your telephone number. Used to communicate about your order and deliver your translation.
• Delivery address: Street, postcode, city and country, if you select postal delivery of the printed certified original.
• Document content: The document you upload for translation. This is processed solely for the purpose of producing your certified translation. It is transmitted exclusively to the assigned sworn translator and is automatically deleted from our systems after 30 days.
• Payment data: If you pay via Stripe, PayPal, or credit card, the relevant payment data is processed by the respective payment service provider under their own data protection policies. We receive only a payment confirmation and the transaction reference — not your card details.
• Order metadata: Document type, language pair, delivery option, order timestamp and order reference number. Required for contract fulfilment and statutory retention obligations (§ 257 HGB, § 147 AO).

2.2 When you contact us

When you contact us via our contact form, telephone or email, we process your name, email address, any telephone number you provide, and the content of your message. This data is used solely to respond to your enquiry and is deleted when the matter is resolved, unless retention is required by law.

2.3 When you visit our website

Our web servers automatically record standard server log files when you access our website. These contain:

• IP address (anonymised after 7 days)
• Date and time of access
• URL requested
• HTTP status code
• Browser type and version
• Referring URL

These logs are used exclusively for technical security, performance monitoring and debugging. They are not linked to individual user identities and are deleted after 30 days.

2.4 Newsletter and marketing

We do not send marketing emails without your express prior consent (opt-in). If you subscribe to our newsletter, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time by clicking the unsubscribe link in any newsletter email.

3. Legal bases for processing

All processing of personal data by Transzlate, A Linguidoor Company rests on one of the following legal bases under the GDPR:

• Art. 6(1)(b) GDPR — Contract performance: Processing of order data, document content, contact data and delivery address is necessary to perform the translation contract you have entered into with us.
• Art. 6(1)(c) GDPR — Legal obligation: Retention of invoices and transaction records for 10 years under German commercial and tax law (§ 257 HGB, § 147 AO).
• Art. 6(1)(f) GDPR — Legitimate interests: Server log processing for website security; fraud prevention.
• Art. 6(1)(a) GDPR — Consent: Newsletter subscriptions; non-essential cookies (where applicable).

4. Cookies & tracking technologies

We use only the following types of cookies:

• Strictly necessary cookies: Required for the website to function (session management, shopping cart). No consent is required for these.
• Functional cookies: Remember your language and currency preferences. Set only if you have given consent.
• Analytics cookies: We use anonymised analytics to understand how visitors use our website. IP addresses are anonymised before storage. Analytics cookies are only placed with your consent.

You may withdraw your cookie consent at any time via our cookie settings (accessible via the link in the footer). Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

We do not use advertising or profiling cookies. We do not share cookie data with advertising networks.

5. Sharing of personal data

We share personal data only where strictly necessary:

• Sworn translators: The document you upload and the relevant personal data (name, language pair, document type) are shared with the assigned sworn translator solely for the purpose of producing your certified translation. All translators in our network are bound by professional confidentiality obligations and GDPR-compliant data processing agreements.
• Payment processors: Stripe, PayPal and other payment providers process payment data under their own GDPR-compliant privacy policies. We have no access to your full card details.
• Cloud hosting and infrastructure: Our website and order management systems are hosted on servers within the European Economic Area (EEA). Our hosting provider processes data only on our instructions under a data processing agreement.
• Email delivery: Transactional emails (order confirmations, translation delivery) are sent via a professional email delivery provider within the EEA.
• Legal requirements: We may disclose personal data to law enforcement or regulatory authorities if required to do so by applicable law.

We do not sell, rent, or trade personal data to third parties.

6. International data transfers

All personal data is processed and stored within the European Economic Area (EEA). Where any transfer outside the EEA is necessary (for example, if a payment processor has infrastructure outside the EEA), such transfers are subject to appropriate safeguards pursuant to Art. 46 GDPR, including Standard Contractual Clauses (SCCs) approved by the European Commission. Details of applicable safeguards are available on request.

7. Data retention

• Uploaded documents: Automatically and permanently deleted from our servers 30 days after your order is completed.
• Order records and invoices: Retained for 10 years pursuant to German commercial and tax law (§ 257 HGB, § 147 AO). After this period, data is anonymised or deleted.
• Contact enquiries: Deleted within 6 months of resolution of the enquiry, unless the subject matter gives rise to longer retention requirements.
• Server log files: Deleted after 30 days (IP addresses anonymised after 7 days).
• Newsletter subscriptions: Retained until you withdraw consent.

8. Your rights under GDPR

As a data subject under the GDPR, you have the following rights with respect to your personal data processed by Transzlate, A Linguidoor Company:

• Right of access (Art. 15 GDPR): You may request a copy of all personal data we hold about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where there is no legitimate purpose for continued retention.
• Right to restriction (Art. 18 GDPR): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request a copy of data you have provided to us in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. In Germany, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de).

To exercise any of these rights, contact us at hello@transzlate.com. We will respond within 30 days. No fee is charged for reasonable requests.

9. Security measures

Transzlate, A Linguidoor Company is certified under ISO 27001:2013 (information security management) and ISO 9001:2015 (quality management). We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including:

• SSL/TLS encryption for all data transmission (HTTPS)
• End-to-end encryption of uploaded documents in transit and at rest
• Access controls and role-based permissions limiting data access to authorised personnel only
• Regular penetration testing and security audits
• Automatic deletion of documents after 30 days
• Data processing agreements with all processors

10. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email (if you have an active order or newsletter subscription) or by displaying a prominent notice on our website. The date of the most recent revision is shown at the top of this page. Continued use of our services after the effective date of any changes constitutes acceptance of the updated policy.

11. How to contact us