DeepL Privacy Policy changes — 20220803_rev01

67

In addition to the aforementioned data, we process further (usage-)data relevant for the provision and billing of our service, such as subscription ID, date and time of the subscription conclusion, billing period, successful payment processing, log-ins, number of translated characters and documents, upgrades and downgrades. The processing and storage of the aforementioned data is necessary for the conclusion of the contract as well as its performance and is therefore justified according to Art. 6 para. 1 sentence 1 lit. b) GDPR. If you yourself are not a party to the contract, but DeepL Pro is provided to you, e.g. by your employer or an organization to which you belong, we justify the processing of the data mentioned in section 5.1 and the aforementioned usage data via Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is necessary for the performance of the business relationship with our customers, i.e. your employer or your organization.

68

69

We store the data for the duration of the contract term and subsequently, if applicable, for the duration of statutory retention periods, insofar as these prescribe the retention for the respective types of data. We will delete your account if you wish to do so after canceling your subscription. Otherwise, we will maintain your account as DeepL account so that it is available to you in the event of a renewed subscription without you having to register again. This is in your as well as in our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

70

71

In your account in the section "usage", you can also view data about your usage behavior e.g., - depending on your subscription - the number of characters translated in the past or the number of documents translated. If you have a consumption-based subscription, such as the DeepL API Pro, you can also view the monthly costs incurred. We justify this data processing via Art. 6 para. 1 sentence 1 lit. f) GDPR, insofar as it is necessary for the performance of the contract, in particular for billing purposes or for managing the number of documents still available for translation. Insofar as the processing goes beyond what is necessary for the performance of the contract, we base the processing on our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, as we seek to meet our customers' wish to visualize information on usage behavior in a transparent manner. The graphical representation of the development of consumption over the contract period is considered to be also in the interest of our customers.

72

73

If you yourself are not a party to the DeepL Pro subscription, but access to our products is provided to you by your employer or an organization to which you belong, it is possible that we share data about your usage behavior with your employer or organization. Such data transfer only takes place insofar as this corresponds to our legitimate interests as well as the legitimate interests of our customers in receiving information about the use of the subscriptions they have paid for and your interests do not override in the individual case.

73

If you yourself are not a party to the DeepL Pro subscription, but access to our products is provided to you by your employer or an organization to which you belong, it is possible that we share data about your usage behavior (e.g. last login date) with your employer or organization. Such data transfer only takes place insofar as this corresponds to our legitimate interests as well as the legitimate interests of our customers in receiving information about the use of the subscriptions they have paid for and your interests do not override in the individual case.

74

75

### 5.3. Processing of the Submitted Texts and Translations

76

77

We process the texts you submit to DeepL Pro and their translations only temporarily, insofar as this is necessary for the creation and transmission of the translation. The processing is therefore justified by Art. 6 para. 1 sentence 1 lit. b) GDPR. Your texts and the translations will - within the framework of the contractual agreements and as stated in section [4]() - not be stored permanently and will be deleted after the performance of the contractually owed service. The only exception is if you use the "save translations" feature in our apps. In this case, texts selected by you, including translations, can be saved locally on the device used and thus kept accessible at all times.

78

79

If you use our glossary feature and store certain term pairs there, this data will be forwarded to our servers and stored for your account. If you want to use the glossary function as part of our service, the data processing that takes place in this context is necessary for the performance of our contract and is therefore also justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.

 In addition to the aforementioned data, we process further (usage-)data relevant for the provision and billing of our service, such as subscription ID, date and time of the subscription conclusion, billing period, successful payment processing, log-ins, number of translated characters and documents, upgrades and downgrades. The processing and storage of the aforementioned data is necessary for the conclusion of the contract as well as its performance and is therefore justified according to Art. 6 para. 1 sentence 1 lit. b) GDPR. If you yourself are not a party to the contract, but DeepL Pro is provided to you, e.g. by your employer or an organization to which you belong, we justify the processing of the data mentioned in section 5.1 and the aforementioned usage data via Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is necessary for the performance of the business relationship with our customers, i.e. your employer or your organization.
 We store the data for the duration of the contract term and subsequently, if applicable, for the duration of statutory retention periods, insofar as these prescribe the retention for the respective types of data. We will delete your account if you wish to do so after canceling your subscription. Otherwise, we will maintain your account as DeepL account so that it is available to you in the event of a renewed subscription without you having to register again. This is in your as well as in our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
 In your account in the section "usage", you can also view data about your usage behavior e.g., - depending on your subscription - the number of characters translated in the past or the number of documents translated. If you have a consumption-based subscription, such as the DeepL API Pro, you can also view the monthly costs incurred. We justify this data processing via Art. 6 para. 1 sentence 1 lit. f) GDPR, insofar as it is necessary for the performance of the contract, in particular for billing purposes or for managing the number of documents still available for translation. Insofar as the processing goes beyond what is necessary for the performance of the contract, we base the processing on our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, as we seek to meet our customers' wish to visualize information on usage behavior in a transparent manner. The graphical representation of the development of consumption over the contract period is considered to be also in the interest of our customers.
+If you yourself are not a party to the DeepL Pro subscription, but access to our products is provided to you by your employer or an organization to which you belong, it is possible that we share data about your usage behavior with your employer or organization. Such data transfer only takes place insofar as this corresponds to our legitimate interests as well as the legitimate interests of our customers in receiving information about the use of the subscriptions they have paid for and your interests do not override in the individual case.
+If you yourself are not a party to the DeepL Pro subscription, but access to our products is provided to you by your employer or an organization to which you belong, it is possible that we share data about your usage behavior (e.g. last login date) with your employer or organization. Such data transfer only takes place insofar as this corresponds to our legitimate interests as well as the legitimate interests of our customers in receiving information about the use of the subscriptions they have paid for and your interests do not override in the individual case.
 ### 5.3. Processing of the Submitted Texts and Translations
 We process the texts you submit to DeepL Pro and their translations only temporarily, insofar as this is necessary for the creation and transmission of the translation. The processing is therefore justified by Art. 6 para. 1 sentence 1 lit. b) GDPR. Your texts and the translations will - within the framework of the contractual agreements and as stated in section [4]() - not be stored permanently and will be deleted after the performance of the contractually owed service. The only exception is if you use the "save translations" feature in our apps. In this case, texts selected by you, including translations, can be saved locally on the device used and thus kept accessible at all times.
 If you use our glossary feature and store certain term pairs there, this data will be forwarded to our servers and stored for your account. If you want to use the glossary function as part of our service, the data processing that takes place in this context is necessary for the performance of our contract and is therefore also justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.
 - Full IP address
 - Diagnostic information in the event of errors
 Processing is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is stored for purely technical reasons. Website access data is used for error analysis, ensuring system security, logging access to DeepL Pro and for improving our translation service. Based on your IP address, we also use geolocation to determine the region from which you are visiting our website. We use this information to check whether we can offer you the DeepL Pro service in your region, which corresponds to our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. The storage of the full IP address for the users of the DeepL free version for a maximum period of 14 days is also justified by our legitimate interest in achieving the listed purposes, Art. 6 para. 1 sentence 1 lit. f) GDPR. The storage of IP addresses of users of the paid DeepL Pro subscription for the duration of the contract is justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.
+Our website also uses services of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which operates a so-called Content Delivery Network (CDN). To protect our website, the data transfer between your browser and our servers is routed through Cloudflare's infrastructure in order to analyse whether it is an abusive attack. In the course of this analysis, your IP address is transmitted to Cloudflare, if necessary also to Cloudflare servers in the USA. This data is deleted after 30 days. We have concluded a data processing agreement with Cloudflare and Cloudflare may therefore only process the data according to our instructions and not for its own purposes. You can find more information about Cloudflare's handling of personal data [here](https://www.cloudflare.com/de-de/privacypolicy/). The use of Cloudflare is in our legitimate interest to secure the use of our website and to prevent and defend harmful attacks from outside, Art. 6 para. 1 sentence 1 lit. f) GDPR.
+Our website also uses services of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which operates a so-called Content Delivery Network (CDN). To protect our website, the data transfer between your browser and our servers is routed through Cloudflare's infrastructure in order to analyze whether it is an abusive attack. As part of this analysis, your data is transmitted to Cloudflare in encrypted form, if necessary also to Cloudflare servers in the USA. However, since your translation requests and other customer data are encrypted between your end device and the DeepL servers, Cloudflare does not have any access to this data, but only to meta-data (such as your IP address). Only static resources (such as graphics) are loaded directly from Cloudflare-servers. In addition, Cloudflare determines a so-called botscore immediately before the login to DeepL, which is based on the analysis of the metadata of the client (browser) used. This data is deleted after 30 days. The use of Cloudflare is in our legitimate interest to secure the use of our website and to prevent and defend harmful attacks from outside, Art. 6 para. 1 sentence 1 lit. f) GDPR. We have concluded a data processing agreement with Cloudflare and Cloudflare may therefore only process the data according to our instructions and not for its own purposes. You can find more information about Cloudflare's handling of personal data [here](https://www.cloudflare.com/de-de/privacypolicy/).
 ## 8\. Cookies and Web Storage on deepl.com and Analysis of User Behavior
 ### 8.1 Use of Cookies and Web Storage on deepl.com
 If you do not want us to use cookies or web storage objects, you can change your browser settings accordingly. Please note that if you completely disable the use of cookies or web storage objects, the functionality and scope of the website may be impaired.
  | TechnologyCookie | Expiry6 months | OwnerDeepL |
 | Translator | IDLMT | Description
 Stores settings made explicitly by the user. E.g. preferred translation language or entries in the glossary.
  | TechnologyLocal Storage | Expiry1 month | OwnerDeepL |
+| Translator | IDproductRecommendations | Description
+Used for feature onboarding and discovery on the translator.
+ | TechnologyCookie | Expiry7 days | OwnerDeepL |
+| Translator | IDrecommendationFlags | Description
+Used to store additional translator settings of the user.
+ | TechnologyLocal Storage | Expiry6 month | OwnerDeepL |
 | Discovery and Onboarding | IDclickOnWordHint, LMT\_MessageBox, onboardingData, showAppOnboarding, AppOnboardingInfo | Description
 Stores if the user has on-boarded with features to ensure that onboarding prompts are only displayed once.
  | TechnologyLocal Storage | Expiry1 to 6 months | OwnerDeepL |
 | Checkout Process | IDFurther details about Stripe 3rd party cookies can be found under [https://stripe.com/cookies-policy/legal](https://stripe.com/cookies-policy/legal). | Description
  | TechnologyLocal Storage | ExpiryPersistent Data | OwnerDeepL |
 | Document translation | IDLMT\_doctranslate\_client | Description
 Used to bind an ongoing document translation process to a user and protect the document translation feature from excessive use by individual users. This ensures that the service is not impacted for the remaining users.
  | TechnologyCookie | Expiry1 month | OwnerDeepL |
+| Document translation | IDLMT\_text\_translator\_usage\_free | Description
+Used to bind an ongoing text translation process to a user and protect the translation feature from excessive use by individual users. This ensures that the service is not impacted for the remaining users.
+ | TechnologyCookie | Expiry1 month | OwnerDeepL |
 | Security | IDdapUid | Description
 User identifier to ensure correct operation of our systems, including to identify malicious bots and measure performance.
  | TechnologyCookie | Expiry12 months | OwnerDeepL |
+| Security | IDdl\_clearance | Description
+Used to prevent misuse of our services by using the Cloudflare bot score.
+ | TechnologyCookie | Expiry5 minutes | OwnerDeepL |
 | Product Support/Zendesk | IDzendesk | Description
 Third-party cookie used by our ZenDesk support tool. Necessary for the operation of the service (bot detection and session management).
  | TechnologyCookie | Expiry1 month | OwnerThird Party - Zendesk |
 | Product Support/HubSpot | IDhubspot | Description
 ### Comfort
 | Context | ID | Description | Technology | Expiry | Owner |
 | --- | --- | --- | --- | --- | --- |
 | Translator | IDuserRecommendations | Description
+Used for feature discovery.
+Used to personalise the users experience.
  | TechnologyCookie | Expiry7 days | OwnerDeepL |
+| Translator | IDuserRecommendationFlags | Description
+| Translator | IDrecommendationFlags | Description
 Used to store additional translator settings of the user.
  | TechnologyLocal Storage | Expiry6 month | OwnerDeepL |
 | Product information | IDapiDocsVisited | Description
 ### 12.3. Customer Satisfaction Surveys
 From time to time, DeepL sends out customer satisfaction surveys via email to inquire about your satisfaction with our products. Participation in the surveys is voluntary and they can generally be answered anonymously, but you also have the option to voluntarily provide your name and/or email address. If you do so, we may contact you afterwards and ask if you would be willing to share your experience with us in a personal conversation.
 This processing of your data corresponds to our legitimate interests according to Art. 6 para. 1 sentence 1 lit. f) GDPR to improve our products and to further develop them according to our customer's wishes. If you voluntarily provide your name and/or email address in the survey, we justify the processing of your data via your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You can revoke this consent at any time with effect for the future.
+To conduct the customer satisfaction surveys, we use a service of Typeform SL, Carrer Bac de Roda, 163, local, 08018 Barcelona, Spain ("Typeform"), on whose platform the surveys are stored. In this context, there may be a transfer of your data to the USA. We have concluded a data processing agreement with Typeform and Typeform may only process the data in accordance with our instructions and not for its own purposes. You can find more information about Typeform's handling of personal data [here](https://admin.typeform.com/to/dwk6gt/).
+#### 12.3.1 Typeform
+To conduct the customer satisfaction surveys, we use a service of Typeform SL, Carrer Bac de Roda, 163, local, 08018 Barcelona, Spain ("Typeform"), on whose platform the surveys are stored. Typeform uses different subcontractors, which are also partly located in third countries outside the EU. Therefore, in certain cases, there may be a transfer of your data to the USA. We have concluded a data processing agreement with Typeform and Typeform only processes the data in accordance with our instructions and not for its own purposes. You can find more information about Typeform's handling of personal data [here](https://admin.typeform.com/to/dwk6gt/).
+#### 12.3.2 Hotjar
+Furthermore, we use a survey tool of Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta ("Hotjar"), on whose platform the surveys are stored. Hotjar uses different subcontractors, which are also partly located in third countries outside the EU.Therefore, in certain cases, there may be a transfer of your data to the USA. We have concluded a data processing agreement with Hotjar and Hotjar only processes the data in accordance with our instructions and not for its own purposes. You can find more information about Hotjar's handling of personal data [here](https://www.hotjar.com/legal/policies/privacy/).
 ### 12.4. Email Service Provider HubSpot
 For sending the newsletters, we use a service provided by HubSpot, Inc. with headquarters at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA. As part of this, your data may also be transferred to the USA. We have concluded a data processing agreement with HubSpot and therefore HubSpot may only process the data according to our instructions and not for its own purposes. You can find more information on HubSpot's handling of personal data [here](https://legal.hubspot.com/privacy-policy) and [here](https://www.hubspot.com/data-privacy/privacy-shield).
 We also statistically record, among other things via HubSpot, which emails you open and which links you click on in our emails (opening and click rates). This allows us to understand which content is of interest to our users and to optimize the newsletter and our email communication, which corresponds to our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
 You also have the right to lodge a complaint regarding the processing of your personal data with a supervisory authority, such as the data protection supervisory authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 - 4, 40213 Düsseldorf, email: [poststelle(at)ldi.nrw.de](mailto:poststelle@ldi.nrw.de).
 ## 17\. Changes to the Privacy Policy
 We reserve the right to amend this privacy policy. The current version of the privacy policy can be accessed at any time on our [website](https://www.deepl.com/privacy).
+Last update: May 2022
+Last update: July 2022

Privacy Policy

Full text changes — 20220604_rev01 to 20220803_rev01