Data Processing Addendum v1.0-2026-07-24

Version 1.0 — 24 July 2026. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Hablexo Ltd, a company registered in England & Wales (company no. 17354416), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF (“Hablexo”, the “Processor”) and the Customer (“you”, the “Controller”). Terms not defined here have the meaning given in UK GDPR / the Data Protection Act 2018.

1. Roles and scope

• For the content plane — live speech, captions, slides, chat, and any attendee personal data inherent in them — you are the controller and Hablexo is your processor, processing only to provide the service.
• This DPA applies to managed mode. Under a bring-your-own-keys arrangement, your own speech-to-text and translation providers are your processors (not Hablexo’s sub-processors) for that traffic; Hablexo never holds your provider keys.
• The account and billing plane — your account contact details, credit ledger, and aggregate usage counts — is processed by Hablexo as an independent controller (lawful basis: contract). That processing sits outside this DPA and is described in the Privacy Notice.

2. Processing details (Annex 1)

• Subject-matter: provision of real-time transcription, translation, captioning, optional spoken audio, and a translated chat forum for your events.
• Duration: the term of the Terms of Service, while you use managed mode.
• Nature and purpose: transient capture, transcription, machine translation, and per-language delivery of live content to attendee devices.
• Types of personal data: whatever is contained in the spoken or typed content of your events — speakers’ words, attendee chat messages, and optional display names. No special-category data is required by the service; any that arises does so only because it is spoken or typed in your event.
• Categories of data subjects: your speakers, presenters, and attendees.
• Storage: on Hablexo’s servers, content is held in memory only — event-scoped, size-capped, time-limited, and dropped when the event’s publisher disconnects. Hablexo does not persist caption content or attendee identifiers on its servers. Durable chat history — and any audio recordings or transcripts you choose to enable — lives on your operator machine, not on Hablexo’s servers (see section 10).

3. Processor obligations

Hablexo shall:

• process the personal data only on your documented instructions (the Terms, the service configuration, and your use of the service), including for international transfers, unless required by law — in which case we will inform you unless legally prohibited;
• ensure persons authorised to process the data are under an appropriate duty of confidentiality;
• implement the technical and organisational measures in Annex 2;
• respect the conditions in section 5 for engaging sub-processors;
• assist you, insofar as possible and taking into account the nature of the processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations — noting that the store-nothing design means most content is not retained by Hablexo and is therefore not retrievable after an event;
• at your choice, delete or return all personal data after the end of the provision of services and delete existing copies, save where law requires retention (the content plane retains nothing on our servers by design);
• make available the information necessary to demonstrate compliance, and allow for and contribute to audits as set out in section 7.

4. Security

Hablexo implements and maintains the measures in Annex 2, appropriate to the risk. The primary control is architectural: the content plane is store-nothing on our servers, so caption content and attendee identifiers are not persisted by Hablexo.

5. Sub-processors

You provide general authorisation for Hablexo to engage the sub-processors listed in Annex 3. Hablexo imposes data-protection obligations consistent with this DPA on each sub-processor and remains responsible for their performance. Hablexo will give you reasonable prior notice (by email or in the control panel) of any new or replacement sub-processor, and you may object on reasonable data-protection grounds; if the objection cannot be resolved, you may close your account.

6. International transfers

Where personal data is transferred outside the UK or EEA, Hablexo will ensure an appropriate transfer mechanism is in place — the UK International Data Transfer Agreement or Addendum, EU standard contractual clauses, or an adequacy decision, as applicable to the sub-processor concerned.

7. Data-subject requests and audits

Hablexo will, taking into account the store-nothing design, provide reasonable assistance with data-subject requests you receive that relate to content processed in managed mode. Hablexo will respond to reasonable audit requests by providing relevant documentation (this DPA, the sub-processor list, and the security measures), and will permit an on-site or independent audit where required by law or a supervisory authority, on reasonable notice and confidentiality terms.

8. Personal data breach

Hablexo will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us to help you meet your own notification obligations.

9. Deletion and return

Because the content plane retains nothing on our servers, in the ordinary course there is no content to return or delete after an event. On termination, Hablexo will delete any incidental personal data within its control, save where law requires retention (for example account and billing records in the separate controller plane, as described in the Privacy Notice).

10. What your machine stores — and what that means for you

The operator application writes some files to your own device, not to our servers. Two of them can contain other people’s personal data, and you are the controller of them:

• Chat history — attendee posts and the chat names they chose, saved so a forum survives a restart. Bounded (newest 50 posts per forum), deleted after 7 days by default, and erasable at any time from the app; a forum can be set memory-only so nothing is written at all. Attendees are told this in the app before they post.
• Audio recordings and transcripts — off by default. If you switch them on, you are recording your speakers on your own equipment. Depending on what is said, that may include special-category data, and the lawful basis for capturing it is yours.

As the controller of your event, you are responsible for informing your attendees and for having a lawful basis for the content you capture. Hablexo processes it only on your instructions, and supplies the bounds, the retention defaults, and the delete controls described above.

11. Liability, precedence, and law

This DPA prevails over the Terms of Service and the EULA on data-protection matters. Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA is governed by the laws of England and Wales.

Annex 2 — Technical and organisational measures

• Store-nothing content plane — captions, translations, chat, and audio clips are held on our servers in RAM only: event-scoped, capped, time-limited, and dropped when the event’s publisher disconnects.
• Transport security — TLS on all attendee, operator, and server links; the operator application makes outbound connections only.
• Secrets isolation — provider keys are held only in the server-side broker as file-based secrets; the delivery fan-out holds no provider key; card data never touches Hablexo (Stripe; PCI SAQ-A).
• Speech path minimisation — the captured audio streams directly from the operator’s device to the speech-to-text provider using short-lived vended tokens; it does not transit Hablexo’s servers.
• Account-plane hardening — strong password hashing (argon2id), hashed credential tokens, a database that is not network-exposed, encrypted off-site backups, and an audit log free of content and secrets.
• Hosting — Oracle Cloud, United Kingdom (London) region, for the delivery and account infrastructure.
• Access control — least-privilege operational access; per-event key scoping for attendee delivery; publisher authentication bound to the owning account.

Annex 3 — Sub-processors (content plane)

Current sub-processors that may process event content (audio or text) in managed mode:

Providers used for the account and billing plane (payments, email, hosting) are listed in the Privacy Notice. Under a bring-your-own-keys arrangement, your own providers are your processors, not Hablexo’s sub-processors, for that traffic.

Hablexo Ltd · Registered in England & Wales · Company No. 17354416 · Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF · hello@hablexo.com

Hablexo home · Privacy Notice · Terms of Service · Sign up