Effective date: 5 November 2026 · Version 2.0

This Data Processing Addendum ("DPA") forms part of the Terms of Service between M & J Tech Suits LLC, 4938 S 24th St., Omaha, Nebraska 68107, United States ("LingVata", "processor") and the customer ("controller") where LingVata processes personal data on the customer's behalf in the course of providing translation, interpretation or review services, for example when a document contains personal data. It applies where the EU GDPR, the UK GDPR, the Swiss data protection law, or a comparable law requires it.

1. Roles and scope

The customer is the controller of the personal data contained in the material it submits. LingVata is a processor for that data, and acts on the customer's documented instructions, which are: to store, transmit, and make the material available to the professional engaged for the job, and to process it to the extent needed to deliver, review and support that job.

2. Subject matter, duration and categories

Subject matter: translation, certified translation, interpretation and review services arranged through the Platform.
Duration: for the term of the job and the retention period in the Data Retention and Deletion Policy.
Categories of data subjects: the customer's employees, clients, counterparties and any other individuals appearing in the material.
Categories of personal data: as contained in the material submitted, excluding special category data unless the customer instructs otherwise in writing.

3. Processor obligations

LingVata will:

process the data only on the controller's instructions, including for transfers to a third country, unless required otherwise by law, in which case it will inform the controller unless the law forbids it;
ensure that personnel authorised to process the data are bound by confidentiality;
implement appropriate technical and organisational measures, including encryption in transit, access controls, private document storage with time-limited signed links, and audit logging;
assist the controller, taking into account the nature of the processing, in responding to data subject requests and in meeting the obligations in Articles 32 to 36 of the GDPR;
notify the controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the controller's data, with the information needed for the controller's own notification;
at the controller's choice, delete or return the data at the end of the provision of services, and delete existing copies unless the law requires storage;
make available the information needed to demonstrate compliance, and allow for and contribute to audits, including inspections, on reasonable prior notice and subject to confidentiality.

4. Sub-processors

The controller gives general written authorisation for LingVata to engage sub-processors for hosting, database, authentication, payment, file storage and email delivery. LingVata imposes data protection obligations equivalent to this DPA on each sub-processor, remains liable for their performance, and will give notice in the Platform before adding a sub-processor that processes controller data so the controller can object on reasonable data protection grounds.

5. International transfers

Where the controller's data is transferred outside the EEA, the UK or Switzerland, the parties rely on the European Commission's Standard Contractual Clauses (Module Two: controller to processor) and, for the UK, the International Data Transfer Addendum, completed as follows: the controller is the data exporter, LingVata is the data importer, the optional docking clause applies, and the competent supervisory authority is that of the controller's establishment. Supplemental measures include encryption in transit and at rest, access controls and least-privilege administration.

6. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the law of the applicable data protection framework does not permit limitation.

7. Order of precedence

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing it covers. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

8. How to put this DPA in place

A signed copy can be requested at privacy@lingvata.com before a job starts, together with our current list of sub-processors.

9. Contact

M & J Tech Suits LLC · 4938 S 24th St., Omaha, Nebraska 68107, United States · +1 531-346-6809 · privacy@lingvata.com