This Data Processing Agreement (“DPA“) forms part of the service agreements between Linguise by DXT ONE (“Processor“) and the customer (“Controller“) using Linguise’s website translation services.

1. Definitions

• “Applicable Data Protection Law” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including the General Data Protection Regulation (EU) 2016/679 (“GDPR“), the Swiss Federal Act on Data Protection (“nFADP“), and the UK Data Protection Act 2018 / UK GDPR.
• “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• “Personal Data” means any information relating to an identified or identifiable natural person as defined in the GDPR and equivalent provisions of the Swiss nFADP.
• “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means.
• “Standard Contractual Clauses” (“SCCs”) means the Standard Contractual Clauses approved by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, incorporated herein under Module 2 (Controller-to-Processor).
• “Sub-processor” means any third-party processor engaged by Linguise to Process Personal Data in connection with the services.

2. Parties and Scope

2.1 Parties

Data Processor: Linguise by DXT ONE, EIN: 922291269, registered at 32565 B Golden Lantern St, Suite 191, Dana Point CA 92629, United States.
Data Controller: The customer subscribing to or utilizing Linguise’s translation services.

2.2 Subject Matter and Duration

This DPA applies to the Processing of Personal Data by Linguise when providing automatic website translation and content delivery services. It remains in force for the duration of the service agreement between the parties.

3. Processing Details

3.1 Purpose of Processing

Linguise processes website content solely for the purpose of providing automatic machine translation, neural translation, and AI-assisted linguistic localization services to the Controller.

3.2 Types of Personal Data

The Personal Data processed may include any personal information contained within the Controller’s website HTML content submitted for translation. Controllers may configure Linguise URL patterns and DOM selectors to exclude private or sensitive areas (such as user accounts, carts, checkout forms, and credit card fields).

3.3 Categories of Data Subjects

Data subjects may include the Controller’s website visitors, customers, end-users, employees, or any individuals whose personal information appears on the Controller’s public or designated website pages.

3.4 Sub-processor List

The Controller authorizes Linguise to engage the following sub-processors for service infrastructure, business administration, and automated translation activities:

4. Obligations of the Processor

4.1 Linguise shall:

• a) Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country;
• b) Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• c) Implement appropriate Technical and Organizational Measures (TOMs) to ensure a level of security appropriate to the risk, including:
  • Encryption of Personal Data during transmission (TLS 1.2 / TLS 1.3 with strict modern cipher suites);
  • Encryption of cached translations and persistent databases at rest using AES-256;
  • Access controls, least-privilege principles, and mandatory multi-factor authentication (MFA);
  • Automated firewalls, rate limiting, and regular evaluation of security effectiveness;
• d) Respect the conditions for engaging Sub-processors as set forth in Section 5;
• e) Assist the Controller by appropriate technical and organizational measures in responding to requests from data subjects exercising their rights under Applicable Data Protection Law;
• f) Assist the Controller in ensuring compliance with security obligations, data breach notifications, and data protection impact assessments;
• g) Delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless applicable statutory law requires retention;
• h) Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for audits.

5. Sub-processor Conditions & AI Inference Commitments

5.1 The Controller hereby provides general written authorization to Linguise to engage Google Cloud Platform, Fireworks AI, and the service sub-processors listed in Section 3.4.

5.2 Linguise shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least 14 days in advance via dashboard notices or email, giving the Controller the opportunity to object to such changes on reasonable data protection grounds.

5.3 Linguise shall impose data protection obligations on any Sub-processor that are at least as protective as those set out in this DPA.

6. Data Transfers, SCCs & Swiss Addendum

6.1 Linguise may transfer Personal Data to countries outside the European Economic Area (EEA) or Switzerland only with adequate safeguards in place and in strict compliance with Applicable Data Protection Law.

6.2 For transfers of Personal Data from the EEA to Linguise by DXT ONE or third-party sub-processors located in third countries, the parties agree to be bound by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914, Module 2: Controller-to-Processor), which are hereby incorporated by reference with the following specifications:

• Clause 7 (Docking Clause): The optional docking clause is incorporated;
• Clause 9 (Use of Sub-processors): Option 2 (General written authorization) applies with a 14-day notice period;
• Clause 11 (Redress): The optional independent dispute resolution mechanism is omitted;
• Clause 17 (Governing Law): The laws of the EU Member State in which the Controller is established, or the laws of France if established outside the EU;
• Clause 18 (Choice of Forum): The competent courts of the jurisdiction designated under Clause 17.

6.3 Swiss Addendum (Transfers Subject to the Swiss nFADP):
For transfers of Personal Data governed by the Swiss Federal Act on Data Protection (nFADP), the EU SCCs are adopted with the amendments recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC / PFPDT):

• References to the GDPR are interpreted to include the Swiss nFADP;
• The term Member State includes Switzerland, ensuring data subjects in Switzerland can exercise and enforce their rights before competent Swiss courts;
• The competent supervisory authority under Annex I.C is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

7. Data Breach Notification

7.1 Linguise shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a confirmed Personal Data breach.

7.2 The notification will at a minimum:

• Describe the nature of the breach, including categories and approximate numbers of data subjects and records concerned;
• Communicate the name and contact details of the data protection contact;
• Describe the likely consequences and potential risks of the breach;
• Describe the measures taken or proposed to address and mitigate the breach.

8. Data Subject Rights

8.1 Linguise shall, to the extent legally permitted, promptly notify Controller if it receives a request from a data subject to exercise their rights under Applicable Data Protection Law.

8.2 Linguise shall provide reasonable technical assistance to the Controller to facilitate the Controller’s response to such requests.

9. Data Retention and Deletion

9.1 Translation Memory Cache: Translated strings are stored on Linguise cache servers (hosted on Google Cloud Platform) until the Controller updates the content in the original language, flushes the translation cache via the dashboard, or until the Controller’s membership expires.

9.2 AI Inference Discard: Data routed to AI inference models operates under Zero Data Retention and is wiped from volatile memory immediately upon completion of the translation call.

9.3 Termination Deletion: Upon termination of services, Linguise shall delete or return all Personal Data and cached translations to the Controller within thirty (30) days and delete existing copies unless statutory law mandates retention.

10. Audit Rights

10.1 The Controller may audit Linguise’s compliance with this DPA, with reasonable advance written notice (minimum 30 days) and subject to appropriate confidentiality obligations, during normal business hours and without disrupting operational systems.

11. Liability

11.1 Each party shall be liable for damages caused by its own breach of this DPA or Applicable Data Protection Law in accordance with the liability terms set forth in the main Service Agreement.

12. General Terms

12.1 Precedence: In the event of any conflict between this DPA and other agreements between the parties, this DPA shall prevail with regard to the parties’ data protection obligations.

12.2 Amendments: Any amendments to this DPA shall be in writing and documented through updated published terms or signed addenda.

12.3 Severability: Should any provision of this DPA be invalid or unenforceable, the remainder of the DPA shall remain valid and in full force.