DeepL Privacy Policy changes — 20230520_rev01

517

516

Automated decision-making pursuant to Art. 22 GDPR does not take place.

518

517

519

518

Please note that we may record Zoom webinars and publish them afterwards on our website or social media channels. Participants will not be visible or identifiable in these recordings. As participants can only ask written questions, they will not appear visually in the recording. The answer to the participant's question will be part of the webinar recording. If, contrary to expectations, personal data of the participants is visible during the recording, it will be made unrecognisable before publication. The recording and storage of the webinar is based on Art. 6 para. 1 sentence 1 lit. f) GDPR, as these processing operations are in our legitimate interest to improve the quality of our webinars. When the webinars are published, no further processing of personal data will take place, as we will make them unrecognisable beforehand - if they can be viewed at all.

520

519

521

520

## 17\. Job Applications

522

521

523

We offer you the opportunity to apply for a position at DeepL via our career page and the integrated career portal, or by email. This digital recruitment process means that in order to complete the application procedure, your application data (usually name, contact information, cover letter, resume, as well as other supporting documents and credentials) is collected and processed electronically. The personal data you provide will be used exclusively for processing your job application. Your data will only be shared with persons involved in the application process. If you submit your documents in German only, even though an English version of the documents was requested in the job advertisement, we reserve the right to translate your documents into English using DeepL's PDF translation feature. In this context, your data may be transferred to the USA (see also section [7.2]() of this privacy policy). The legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). If you apply for a freelance job at DeepL, the legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR.

522

We offer you the opportunity to apply for a position at DeepL via our career page and the integrated career portal, or by email. This digital recruitment process means that in order to complete the application procedure, your application data (usually name, contact information, cover letter, resume, as well as other supporting documents and credentials) is collected and processed electronically. The personal data you provide will be used exclusively for processing your job application. Your data will only be shared with persons involved in the application process. If you submit your documents in German only, even though an English version of the documents was requested in the job advertisement, we reserve the right to translate your documents into English using DeepL's PDF translation feature. The legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). If you apply for a freelance job at DeepL, the legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR.

524

523

525

524

Where necessary, we reserve the right to carry out a pre-check of the data provided by the applicant as part of the application process in relation to the applicant's work permit. The pre-check enables us to find out whether the applicant is eligible to obtain a work visa and at what time such a visa could be provided. In order to process your application data, it will be forwarded to the service provider Localyze UG (haftungsbeschränkt), Bäckerbreitergang 28, 20355 Hamburg, which carries out the Pre-Check on behalf of DeepL. We have concluded a data processing agreement with Localyze UG (haftungsbeschränkt) and therefore Localyze may only process the data according to our instructions and not for its own purposes. You can find more information about Localyze's handling of personal data [here](https://www.localyze.com/privacy-policy). The processing of personal data in the context of the pre-check is necessary for the establishment of an employment relationship. Accordingly, we justify the data processing via Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act).

526

525

527

526

If a contract is concluded with you and a work visa is required, Localyze will take over the further coordination of obtaining the work visa. It is possible that Localyze will need to obtain further data from you in addition to the applicant data in order to be able to support you in the visa process (e.g., passport scan; health insurance confirmation). The processing of personal data by Localyze is necessary for the implementation of the employment relationship and is therefore covered by Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act).

528

527

529

528

If, following the recruitment process, an employment contract is concluded, we will store your personal data as part of your personnel file for the purpose of standard organizational and administrative procedures, in compliance with the more extensive legal obligations. In this case, the legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). When working on a freelance basis for DeepL, we will store your personal data for the purpose of executing your contract with us. In this case, the legal basis for the processing of your data is Art. 6 paragraph 1 sentence 1 lit. b) GDPR.

 ### 6.3. Processing of the Submitted Texts and Translations
 We process the texts you submit to DeepL Pro and their translations only temporarily, insofar as this is necessary for the creation and transmission of the translation. The processing is therefore justified by Art. 6 para. 1 sentence 1 lit. b) GDPR. Your texts and the translations will - within the framework of the contractual agreements and as stated in section [5]() - not be stored permanently and will be deleted after the performance of the contractually owed service. The only exception is if you use the "save translations" feature in our apps. In this case, texts selected by you, including translations, can be saved locally on the device used and thus kept accessible at all times.
 If you use our glossary feature and store certain term pairs there, this data will be forwarded to our servers and stored for your account. If you want to use the glossary function as part of our service, the data processing that takes place in this context is necessary for the performance of our contract and is therefore also justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.
+## 7\. Translation of documents
+## 7\. Translation of Documents
+### 7.1. Translation of .docx and .pptx Documents with DeepL Translator and DeepL Pro
+### 7.1. Translation of Documents with DeepL Translator and DeepL Pro
+You can translate documents in .docx and .pptx format both with DeepL Pro as well as with DeepL Translator. When using document translation in DeepL Translator, section [3]() of this privacy policy applies. If you translate documents of the file types mentioned above while you are logged in to your DeepL Pro account, the texts you submit will only be processed temporarily and will be deleted after the completion of the translation process, including the translations themselves (see also section [5]() and [6.3]() of this privacy policy).
+You can translate documents in different file formats (.docx, .pptx, .html, .pdf and .txt) both with DeepL Pro as well as with DeepL Translator. When using document translation in DeepL Translator, section [3]() of this privacy policy applies. If you translate documents of the file types mentioned above while you are logged in to your DeepL Pro account, the texts you submit will only be processed temporarily and will be deleted after the completion of the translation process, including the translations themselves (see also section [5]() and [6.3]() of this privacy policy).
+### 7.2. Translation of PDF documents with DeepL Translator and DeepL Pro
+### 7.2. Temporary Storage of Metadata when Translating Documents
+DeepL offers the translation of PDF documents for both DeepL Translator and DeepL Pro; in this respect, section [7.1]() applies accordingly. Please note the following specifics: The actual translation of your documents will continue to be provided exclusively by DeepL and processed on our infrastructure in the EEA. In order to be able to translate PDF documents, it is necessary for technical reasons to convert the content of the PDF files into formatted text. For this purpose, we use the API of Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Dublin 24, Republic of Ireland ("Adobe API"). The PDF documents are sent to the Adobe API, converted there, sent back to DeepL in the required format and translated by DeepL. The infrastructure of Adobe Inc., 345 Park Ave, San Jose, CA 95110, USA, is also used in the conversion process. To make the text translated by DeepL available to you again in PDF format, the Adobe API is used once more (this time in reverse order). Adobe stores the files received on its servers for a maximum period of 24 hours. We have concluded a data processing agreement with Adobe Systems Software Ireland Limited and therefore the transferred data may only be processed according to our instructions. To justify the data transfer to the USA, Adobe Systems Software Ireland Limited and Adobe Inc. have agreed on EU standard contractual clauses, Art. 46 para. 2 lit. c) GDPR. Further information on the handling of personal data at Adobe can be found [here](https://www.adobe.com/privacy/policy-linkfree.html).
+If you upload documents containing personal data for PDF translation as a DeepL Pro customer in accordance with section [5]() of this privacy policy, we will process this data in accordance with your express instructions. You give us this instruction by confirming before each translation of a PDF document that you want to translate it using the Adobe API. As a DeepL Pro customer, you have the option of permanently saving the instruction in the translation settings of your account. For team accounts, the translation of PDF documents is only possible after prior authorisation by the team administrator. When using the DeepL API Pro, we cannot ask you for your instruction before each translation of a PDF document for technical reasons. You therefore give us your instruction by allowing the use of this function in your account settings prior to translating PDF documents.
+You can adjust your instruction at any time in the translation settings in your account. In consequence, we will ask you again for your confirmation before each translation of a PDF document. Further explanations on how to manage your translation settings depending on the DeepL Pro subscription you have chosen can be found [here](https://support.deepl.com/hc/en-us/articles/4408150502802). Free users who want to translate PDF documents with DeepL Translator will also find further information there.
+If you choose not to translate PDF documents, your texts will still be processed exclusively within the European Economic Area.
+### 7.3. Temporary Storage of Metadata when Translating Documents
 Regardless of whether you use our paid or free service when translating documents, particularly the following data is stored for each translation process:
 - Status/progress of the translation process
 - Document file type
 - Full IP address
 - Diagnostic information in the event of errors
 Processing is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is stored for purely technical reasons. Website access data is used for error analysis, ensuring system security, logging access to DeepL Pro and for improving our translation service. Based on your IP address, we also use geolocation to determine the region from which you are visiting our website. We use this information to check whether we can offer you the DeepL Pro service in your region, which corresponds to our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. The storage of the full IP address for the users of the DeepL free version for a maximum period of 14 days is also justified by our legitimate interest in achieving the listed purposes, Art. 6 para. 1 sentence 1 lit. f) GDPR. The storage of IP addresses of users of the paid DeepL Pro subscription for the duration of the contract is justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.
+Our website also uses services of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which operates a so-called Content Delivery Network (CDN). To protect our website, the data transfer between your browser and our servers is routed through Cloudflare's infrastructure in order to analyze whether it is an abusive attack. As part of this analysis, your data is transmitted to Cloudflare in encrypted form, if necessary also to Cloudflare servers in the USA. However, since your translation requests and other customer data are encrypted between your end device and the DeepL servers, Cloudflare does not have any access to this data, but only to meta-data (such as your IP address). Only static resources (such as graphics) are loaded directly from Cloudflare-servers. In addition, Cloudflare determines a so-called bot score immediately before the login to DeepL, which is based on the analysis of the metadata of the client (browser) used. This data is deleted after 30 days. The use of Cloudflare is in our legitimate interest to secure the use of our website and to prevent and defend harmful attacks from outside, Art. 6 para. 1 sentence 1 lit. f) GDPR. We have concluded a data processing agreement with Cloudflare and Cloudflare may therefore only process the data according to our instructions and not for its own purposes. You can find more information about Cloudflare's handling of personal data [here](https://www.cloudflare.com/de-de/privacypolicy/).
+Our website also uses services of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which operates a so-called Content Delivery Network (CDN). To protect our website, the data transfer between your browser and our servers is routed through Cloudflare's infrastructure in order to analyze whether it is an abusive attack. As part of this analysis, your data is transmitted to Cloudflare in encrypted form, if necessary also to Cloudflare servers in the USA. However, since your translation requests and other customer data are encrypted between your end device and the DeepL servers, Cloudflare does not have any access to this data, but only to meta-data (such as your IP address). Only static resources (such as graphics) are loaded directly from Cloudflare-servers. In addition, Cloudflare determines a so-called bot score immediately before the login to DeepL, which is based on the analysis of the metadata of the client (browser) used. The use of Cloudflare is in our legitimate interest to secure the use of our website and to prevent and defend harmful attacks from outside, Art. 6 para. 1 sentence 1 lit. f) GDPR. We have concluded a data processing agreement with Cloudflare and Cloudflare may therefore only process the data according to our instructions and not for its own purposes. You can find more information about Cloudflare's handling of personal data [here](https://www.cloudflare.com/de-de/privacypolicy/).
 ## 9\. Cookies and Web Storage on deepl.com and Analysis of User Behavior
 ### 9.1 Use of Cookies and Web Storage on deepl.com
 If you do not want us to use cookies or web storage objects, you can change your browser settings accordingly. Please note that if you completely disable the use of cookies or web storage objects, the functionality and scope of the website may be impaired.
 | Product information | IDapiDocsVisited | Description
 Stores whether API documentation has been visited to help users select the correct package at checkout.
  | TechnologyLocal Storage | ExpiryPersistent Data | OwnerDeepL |
+### Marketing
+| Context | ID | Description | Technology | Expiry | Owner |
+| --- | --- | --- | --- | --- | --- |
+| Conversion Tracking | ID | Description
+Records and evaluates conversions from DeepL's LinkedIn advertising campaigns
+ | TechnologyTracking Pixel | ExpiryPersistent Data | OwnerLinkedIn |
 ## 10\. DeepL Apps
 In addition to the translation service on our website, we also offer apps for Windows and macOS operating systems ("desktop apps"), as well as apps for iOS and Android ("mobile apps"), through which you can also translate texts.
 You can use the desktop apps in both the free version and the paid DeepL Pro version. The Android app is available in the free version. If you use the free version of DeepL in the apps, Section [3]() of this Privacy Policy applies; if you use the paid DeepL Pro version, Sections [5]() and [6]() apply. As the desktop apps use the same interfaces for creating translations as the web-based service, also sections [7]() and [8]() of this privacy policy apply to the use of these apps.
 ### 12.2. Privacy Requests
 You also have the option of contacting privacy(at)deepl.com with questions or concerns about data protection at DeepL. We process your data in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR on the basis of your voluntarily given consent. We also use the Zendesk ticket system to respond to privacy enquiries, so please also note the above explanations in this regard under section [12.1]().
 ## 13\. DeepL Newsletter
+### 13.1. Product Emails
+### 13.1. Product Newsletter
 If you have signed up for DeepL Pro or DeepL API Free, we will occasionally send you emails with news on our products, such as the launch of new languages and new features as well as on related products and services. This will also include information and tips on how to get the most out of DeepL Pro. We are entitled to use the email address you provided when signing up for a DeepL Pro/DeepL Free API subscription in this way under the legal conditions of § 7 para. 3 of the German Act against Unfair Competition (UWG). Given our existing contractual relationship, it is also in our legitimate interest to inform you as set out above (Art. 6 para. 1 sentence 1 lit. f) GDPR). If you do not wish to receive such emails from us, you can object to the use of your email address for this purpose at any time by sending an email to support(at)deepl.com. Of course, each of our emails contain an unsubscribe link at the end. For sending the newsletter, we use a service provided by HubSpot, Inc. ("HubSpot"), for more information see [13.3]().
+### 13.2. Marketing Emails
+### 13.2. Marketing Newsletter and other marketing communication
+If you like to receive more detailed information about our company, products, services and promotions, you can sign up for our marketing newsletter. We may send you information about special offers, promotions and marketing campaigns and other news from DeepL from time to time. The processing of your data is based on your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). You can withdraw your consent at any time with effect for the future by sending an email to support(at)deepl.com. Of course, our emails each contain an unsubscribe link at the end. We also use the HubSpot service to send the marketing newsletter, for more information please see [13.3]().
+If you would like to receive more detailed information about our company, products, services and promotions, you can sign up for our marketing newsletter or you can agree to receiving marketing communication in certain other contexts. We may send you information, within the scope of your consent, about offers, special offers, promotions and marketing campaigns and other news from DeepL from time to time or get in touch with you to discuss specific products and services. The processing of your data is based on your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). You can withdraw your consent at any time with effect for the future by sending an email to support(at)deepl.com. Of course, our emails each contain an unsubscribe link at the end. We also use the HubSpot service to send the marketing emails, for more information please see [13.3]().
 ### 13.3. Email Service Provider HubSpot
+For sending the newsletters, we use a service provided by HubSpot, Inc. with headquarters at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA. As part of this, your data may also be transferred to the USA. We have concluded a data processing agreement with HubSpot and therefore HubSpot may only process the data according to our instructions and not for its own purposes. You can find more information on HubSpot's handling of personal data [here](https://legal.hubspot.com/privacy-policy) and [here](https://www.hubspot.com/data-privacy/privacy-shield).
+For sending the newsletters and other marketing emails, we use a service provided by HubSpot, Inc. with headquarters at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA. As part of this, your data may also be transferred to the USA. We have concluded a data processing agreement with HubSpot and therefore HubSpot may only process the data according to our instructions and not for its own purposes. You can find more information on HubSpot's handling of personal data [here](https://legal.hubspot.com/privacy-policy) and [here](https://www.hubspot.com/data-privacy/privacy-shield).
 We also statistically record, among other things via HubSpot, which emails you open and which links you click on in our emails (opening and click rates). This allows us to understand which content is of interest to our users and to optimize the newsletter and our email communication, which corresponds to our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
 ## 14\. User research and surveys
 ### 14.1 User surveys
 Automated decision-making pursuant to Art. 22 GDPR does not take place.
 Please note that we may record Zoom webinars and publish them afterwards on our website or social media channels. Participants will not be visible or identifiable in these recordings. As participants can only ask written questions, they will not appear visually in the recording. The answer to the participant's question will be part of the webinar recording. If, contrary to expectations, personal data of the participants is visible during the recording, it will be made unrecognisable before publication. The recording and storage of the webinar is based on Art. 6 para. 1 sentence 1 lit. f) GDPR, as these processing operations are in our legitimate interest to improve the quality of our webinars. When the webinars are published, no further processing of personal data will take place, as we will make them unrecognisable beforehand - if they can be viewed at all.
 ## 17\. Job Applications
+We offer you the opportunity to apply for a position at DeepL via our career page and the integrated career portal, or by email. This digital recruitment process means that in order to complete the application procedure, your application data (usually name, contact information, cover letter, resume, as well as other supporting documents and credentials) is collected and processed electronically. The personal data you provide will be used exclusively for processing your job application. Your data will only be shared with persons involved in the application process. If you submit your documents in German only, even though an English version of the documents was requested in the job advertisement, we reserve the right to translate your documents into English using DeepL's PDF translation feature. In this context, your data may be transferred to the USA (see also section [7.2]() of this privacy policy). The legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). If you apply for a freelance job at DeepL, the legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR.
+We offer you the opportunity to apply for a position at DeepL via our career page and the integrated career portal, or by email. This digital recruitment process means that in order to complete the application procedure, your application data (usually name, contact information, cover letter, resume, as well as other supporting documents and credentials) is collected and processed electronically. The personal data you provide will be used exclusively for processing your job application. Your data will only be shared with persons involved in the application process. If you submit your documents in German only, even though an English version of the documents was requested in the job advertisement, we reserve the right to translate your documents into English using DeepL's PDF translation feature. The legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). If you apply for a freelance job at DeepL, the legal basis for the processing of your applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR.
 Where necessary, we reserve the right to carry out a pre-check of the data provided by the applicant as part of the application process in relation to the applicant's work permit. The pre-check enables us to find out whether the applicant is eligible to obtain a work visa and at what time such a visa could be provided. In order to process your application data, it will be forwarded to the service provider Localyze UG (haftungsbeschränkt), Bäckerbreitergang 28, 20355 Hamburg, which carries out the Pre-Check on behalf of DeepL. We have concluded a data processing agreement with Localyze UG (haftungsbeschränkt) and therefore Localyze may only process the data according to our instructions and not for its own purposes. You can find more information about Localyze's handling of personal data [here](https://www.localyze.com/privacy-policy). The processing of personal data in the context of the pre-check is necessary for the establishment of an employment relationship. Accordingly, we justify the data processing via Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act).
 If a contract is concluded with you and a work visa is required, Localyze will take over the further coordination of obtaining the work visa. It is possible that Localyze will need to obtain further data from you in addition to the applicant data in order to be able to support you in the visa process (e.g., passport scan; health insurance confirmation). The processing of personal data by Localyze is necessary for the implementation of the employment relationship and is therefore covered by Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1, 8 sentence 2 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act).
 If, following the recruitment process, an employment contract is concluded, we will store your personal data as part of your personnel file for the purpose of standard organizational and administrative procedures, in compliance with the more extensive legal obligations. In this case, the legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. b) GDPR in conjunction with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG ("Bundesdatenschutzgesetz": German Federal Data Protection Act). When working on a freelance basis for DeepL, we will store your personal data for the purpose of executing your contract with us. In this case, the legal basis for the processing of your data is Art. 6 paragraph 1 sentence 1 lit. b) GDPR.
 You also have the right to lodge a complaint regarding the processing of your personal data with a supervisory authority, such as the data protection supervisory authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 - 4, 40213 Düsseldorf, email: [poststelle(at)ldi.nrw.de](mailto:poststelle@ldi.nrw.de).
 ## 20\. Changes to the Privacy Policy
 We reserve the right to amend this privacy policy. The current version of the privacy policy can be accessed at any time on our [website](https://www.deepl.com/privacy).
+Last update: December 2022
+Last update: March 2023

Privacy Policy

Full text changes — 20230306_rev01 to 20230520_rev01