GDPR Compliance

Last updated: January 1, 2025

1. GDPR Overview and Our Commitment

What is GDPR?

The General Data Protection Regulation (GDPR) is European Union legislation that protects the personal data and privacy of EU residents. It applies to any organization that processes personal data of EU residents, regardless of where the organization is located.

Our GDPR Compliance

As a video translation service provider, Subly is committed to: - Lawful Processing: All data processing has a valid legal basis - Transparency: Clear communication about data collection and use - Data Minimization: Collecting only data necessary for service provision - Purpose Limitation: Using data only for specified, legitimate purposes - Accuracy: Maintaining accurate and up-to-date personal data - Storage Limitation: Retaining data only as long as necessary - Integrity & Confidentiality: Implementing appropriate security measures - Accountability: Demonstrating compliance with GDPR principles

2. Legal Basis for Data Processing

We process your personal data based on the following legal grounds under GDPR:

Contract Performance (Article 6(1)(b))

Purpose: Providing our video translation service
Data Processed: Account information, payment data, video content, usage records
Retention: Duration of service relationship plus 30 days

Legitimate Interest (Article 6(1)(f))

Purpose: Service improvement, analytics, fraud prevention, security
Data Processed: Usage analytics, technical logs, performance metrics
Retention: 2 years for analytics, 90 days for detailed logs
Balancing Test: Our legitimate interests are balanced against your privacy rights

Legal Obligation (Article 6(1)(c))

Purpose: Tax compliance, financial record-keeping, legal requests
Data Processed: Transaction records, business communications
Retention: 7 years for financial records, as required by law for legal requests

Consent (Article 6(1)(a))

Purpose: Marketing communications, optional analytics, service notifications
Data Processed: Email address, communication preferences
Retention: Until consent is withdrawn
Withdrawal: Can be withdrawn at any time through bot commands or email

3. Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

What it means: You can request a copy of the personal data we hold about you
Response Time: Within 1 month of request
What we provide: Data categories, processing purposes, retention periods, and data copies
How to request: Email [email protected] or use Telegram bot command /data_request

Right to Rectification (Article 16)

What it means: You can request correction of inaccurate or incomplete data
Response Time: Within 1 month, corrections made immediately when possible
Examples: Update contact information, correct payment details
How to request: Through bot settings or email to [email protected]

Right to Erasure (Article 17)

What it means: You can request deletion of your personal data ("Right to be Forgotten")
When available: - Data no longer necessary for original purpose - Consent withdrawn and no other legal basis exists - Data processed unlawfully - Required for compliance with legal obligations

Limitations: We may retain data for legal compliance, public interest, or legitimate interests
How to request: Bot command /delete_account or email [email protected]

Right to Restrict Processing (Article 18)

What it means: You can limit how we process your data in certain circumstances
When available: - Accuracy of data is contested - Processing is unlawful but you prefer restriction over deletion - We no longer need the data but you need it for legal claims - You've objected to processing pending verification of our legitimate interests

Right to Data Portability (Article 20)

What it means: You can receive your data in a portable format
Format provided: JSON format with structured data
What's included: Account data, transaction history, usage statistics
Timeline: Within 1 month of request
How to request: Email [email protected] with "Data Portability Request"

Right to Object (Article 21)

What it means: You can object to processing based on legitimate interest
Processing types: Marketing, analytics, profiling
Response: We'll stop processing unless we demonstrate compelling legitimate grounds
How to object: Bot settings for marketing, email for other objections

Rights Related to Automated Decision-Making (Article 22)

Our position: We do not make automated decisions that significantly affect you
Human oversight: All service decisions involve human review capabilities
Your rights: Right to human intervention, explanation, and challenge of decisions

4. Data Processing Activities

Personal Data Categories We Process

Identity Data: - Telegram username and user ID - Email address (if provided) - Payment information (processed by third parties)

Technical Data: - IP address (temporarily for security) - Device information (browser type, operating system) - Usage logs and analytics data

Content Data: - Video files and audio content - Transcribed text and translations - File metadata and processing logs

Commercial Data: - Transaction history and payment records - Credit balance and usage patterns - Support communications

Data Sources

• Direct from you: Content uploads, account information, support requests
• Automatic collection: Usage analytics, technical logs, performance metrics
• Third parties: Payment processors, AI service providers, platform integrations

International Data Transfers

We transfer personal data outside the EU to:

United States: - OpenRouter (translation services) - Standard Contractual Clauses

Speech transcription is processed locally on our own workers and is not sent to a cloud STT provider. - Fly.io (hosting) - Standard Contractual Clauses

Global CDN: - BunnyCDN (temporary file storage) - Adequacy Decision

Safeguards in Place: - Standard Contractual Clauses approved by European Commission - Regular security assessments of data processors - Contractual obligations for data protection compliance

5. Data Retention Periods

Operational Data

• Video Content: Deleted within 24 hours after processing
• Account Data: Retained during active use + 30 days after account deletion
• Usage Logs: Detailed logs for 90 days, aggregated analytics for 2 years

Legal Compliance

• Transaction Records: 7 years for tax and financial compliance
• Support Communications: 3 years for quality assurance and legal protection
• Security Logs: 1 year for incident investigation and prevention

Marketing Data

• Email Lists: Until consent is withdrawn or 2 years of inactivity
• Analytics: 2 years in anonymized format
• Preferences: Deleted immediately upon consent withdrawal

6. Data Security Measures

Technical Safeguards

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Controls: Role-based access with multi-factor authentication
• Network Security: Firewalls, intrusion detection, regular security updates
• Data Isolation: Segregated processing environments for different data types

Organizational Measures

• Privacy by Design: Data protection built into all new features
• Staff Training: Regular GDPR compliance training for all employees
• Data Processing Agreements: Contracts with all third-party processors
• Regular Audits: Annual security assessments and compliance reviews

Incident Response

• Detection: 24/7 monitoring for security incidents
• Assessment: Rapid evaluation of data breach impact
• Notification: Supervisory authorities notified within 72 hours if required
• Individual Notification: Affected users notified without undue delay for high-risk breaches

7. Children's Data Protection

Age Restrictions

• Service not intended for children under 13
• Parental consent required for users aged 13-16 in EU
• Enhanced protections for any child data we may process

Special Protections

• No Profiling: No automated profiling of individuals under 18
• Minimal Data: Reduced data collection for younger users
• Parental Rights: Parents can exercise rights on behalf of children

8. Data Protection Officer

Contact Information

Name: Available upon request
Email: [email protected]
Role: Independent oversight of GDPR compliance
Availability: Monday-Friday, 9 AM - 5 PM CET

DPO Responsibilities

• Monitoring GDPR compliance
• Conducting privacy impact assessments
• Serving as contact point for supervisory authorities
• Providing data protection training and advice

9. Supervisory Authority Rights

Your Right to Complain

If you believe we've violated GDPR, you can file a complaint with your local supervisory authority:

Lead Supervisory Authority (for our EU operations):
Irish Data Protection Commission
Website: www.dataprotection.ie
Phone: +353 578 684 800

Find Your Local Authority:
European Data Protection Board website provides a complete list of EU supervisory authorities.

What to Include in Complaints

• Description of the alleged GDPR violation
• Steps you've taken to resolve the issue with us
• Copies of relevant communications
• Specific harm or concern caused by our data processing

10. Privacy Impact Assessments

When We Conduct PIAs

We perform privacy impact assessments for: - New technologies or processing operations - High-risk data processing activities - Changes to existing data processing - Integration with new third-party services

PIA Results Available

Summary results of privacy impact assessments are available upon request, subject to commercial confidentiality requirements.

---

11. Exercising Your Rights

How to Contact Us

Primary Contact: [email protected]
Support Contact: @sublyadmin for GDPR requests
Service Bot: @subly1bot - Use commands like /data_request or /delete_account
Response Time: Within 1 month (extendable by 2 months for complex requests)

What We Need from You

To verify your identity and process your request: - Telegram username associated with your account - Approximate date of account creation - Description of specific data or processing you're concerned about

No Charge for Requests

• First request is always free
• Additional requests are free unless manifestly unfounded or excessive
• We'll explain any charges before processing

---

Your privacy is a fundamental right. We're committed to protecting it while providing you with innovative video translation services that connect people across language barriers.