HomeDialect

Data Processing Agreement

Effective date: November 1, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Your Company SRL, [company address] ("Processor"), and applies when the Processor processes personal data on the Controller's behalf through HomeDialect.

1. Subject matter and duration

The Processor provides real-time translation of audio broadcast by the Controller and delivers the translations to the Controller's listeners. The DPA lasts as long as the Controller uses the Service.

2. Nature and purpose

Receiving the live audio stream, passing it to translation providers, generating translated speech and delivering it to listeners in real time. The Processor stores no audio or translations beyond short technical buffers held in memory. Translation providers may keep them for a limited time under their own terms, as stated on the sub-processors page.

3. Personal data and data subjects

  • Data subjects: speakers and other people whose voices are captured; people mentioned in speech; listeners.
  • Data: voice and speech content, and any personal data contained in it; listeners' IP addresses and technical connection data.
  • The Controller should not broadcast special categories of data beyond what is inherent to its event (for example the religious context of a church service), and remains responsible for the lawfulness of broadcasting.

4. Processor's obligations

The Processor will:

  1. process personal data only on the Controller's documented instructions (these terms and the Controller's use of the Service);
  2. ensure people authorized to process the data are bound by confidentiality;
  3. implement the technical and organizational measures in Annex 1;
  4. engage sub-processors only under §5;
  5. assist the Controller with data subject requests and with security, breach and impact-assessment obligations, taking into account the nature of the processing;
  6. notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach;
  7. delete personal data at the end of the Service (audio is not stored in the first place);
  8. make available the information needed to demonstrate compliance and allow reasonable audits, with reasonable notice and at the Controller's cost.

5. Sub-processors

The Controller gives general authorization to engage the sub-processors listed on the sub-processors page. The Processor will announce new sub-processors at least 14 days in advance; the Controller may object on reasonable data-protection grounds and terminate if no solution is found. The Processor imposes equivalent data-protection obligations on each sub-processor and remains responsible for them.

6. International transfers

Where sub-processors process data outside the EU/EEA, transfers rely on an adequacy decision or on the Standard Contractual Clauses (Commission Decision 2021/914), with supplementary measures where needed.

7. Liability

Liability under this DPA follows the limits in the Terms of Service, except where the law does not allow limitation.

Annex 1: Technical and organizational measures

  • Encryption in transit (TLS) for all connections; encrypted storage at the hosting provider.
  • No persistence of broadcast audio or translations.
  • Short-lived, signed, per-broadcast access tokens; one broadcasting computer per broadcast.
  • Access control with least privilege; administrator access protected by two-step verification; audit logs.
  • Passwords stored with a modern one-way hash; optional two-step verification for all users.
  • Hosting in EU data centers with physical security; regular, encrypted backups.
  • Monitoring, rate limiting and abuse protection.
  • Documented incident response and breach notification process.