Data Processing Addendum v1.14-2026-10-06

Version 1.14 — 6 October 2026. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Hablexo Ltd, a company registered in England & Wales (company no. 17354416), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF (“Hablexo”) and the business or organisational Customer (“you”, the “Customer”). “Controller” means the party that determines the purposes and means of the event processing: either the Customer or, where the Customer provides services to a client, that client or another third-party controller. Terms not defined here have the meaning given in UK GDPR / the Data Protection Act 2018.

1. Roles and scope

• For the event content — live speech, captions, slides, chat, and any attendee personal data inherent in them — Hablexo is a processor where the Customer is the Controller, and a sub-processor where the Customer is itself a processor acting for a third-party Controller.
• Where the Customer is a processor, it warrants that the Controller has authorised the Customer to appoint Hablexo as a sub-processor and to pass the Controller’s documented instructions to Hablexo. The Customer remains Hablexo’s contracting party and point of contact and is responsible for communicating with the Controller.
• The account and billing data — your account contact details, credit ledger, Customer identity and eligibility details, and aggregate usage counts — is processed by Hablexo as an independent controller. That processing sits outside this DPA and is described in the Privacy Notice.
• Direct attendee feedback to Hablexo. The attendee page offers a control an attendee may use to send a message to Hablexo about the service. Hablexo determines the purpose and means of handling that message and is an independent controller for it. That processing is outside the processing Hablexo performs on the Customer’s behalf under this DPA: the attendee initiates it, and the Customer neither directs it nor receives its contents. It is described in the Privacy Notice.
  The message and any reply address are never disclosed to the Customer, so a report made this way is not notice to the Customer. The form does not attach captions, translations, chat messages or chat display names, though it accepts whatever the attendee types, and it uses the event key only to identify the Customer’s organisation, without keeping it.

The Service and this DPA are for business and organisational use. They are not intended to create a controller-to-processor arrangement for wholly or mainly personal, family, or household activity. The parties’ roles are determined by the facts and applicable law, not merely by the labels used in this DPA.

2. Processing details (Annex 1)

• Subject-matter: provision of real-time transcription, translation, captioning, optional spoken audio, optional carriage of a live human translator’s voice, and a translated chat forum for events operated by or for the Customer.
• Duration: the term of the Terms of Service.
• Nature and purpose: transient capture, transcription (including distinguishing speakers and detecting the language spoken), machine translation, optional automated screening of chat posts, and per-language delivery of live content to attendee devices.
• Types of personal data: whatever is contained in the spoken or typed content of your events — speakers’ words, the voice and words of any human translator the Customer admits, attendee chat messages, and optional display names. No special-category data is required by the service; any that arises comes from an event’s content or context.
• Categories of data subjects: speakers and presenters, anyone who takes part in a conversation the Customer conducts through the Service, human translators admitted by or for the Customer, and attendees in events operated by or for the Customer.
• Storage: on Hablexo’s servers, content is held in memory only — event-scoped, size-capped, time-limited, and dropped when the event’s publisher disconnects. Hablexo does not persist caption content or attendee identifiers on its servers. Durable chat history — and any audio recordings or transcripts you choose to enable — lives on your operator machine, not on Hablexo’s servers (see section 10). If the Customer enables the input-audio relay (off by default), the event’s live input audio is relayed through Hablexo’s servers to listening devices in real time, unprocessed, and is not recorded or stored by Hablexo; the Customer is responsible for informing the people in the room, and the attendee page discloses the relay to listeners while it is on. If the Customer admits a live human translator, the translator’s speech is relayed through Hablexo’s servers to that language’s listeners in the same in-memory way, and may be transiently transcribed by the speech-to-text sub-processors in Annex 3 to produce that language’s captions. Any recording of the event the Customer chooses to make happens on the Customer’s own equipment, outside Hablexo’s processing.

3. Processor obligations

Hablexo shall:

• process the personal data only on the Customer’s documented instructions, including any Controller instructions the Customer is authorised to pass to us (the Terms, the service configuration, and the Customer’s use of the service), including for international transfers, unless required by law — in which case we will inform the Customer unless legally prohibited;
• inform the Customer immediately if, in Hablexo’s opinion, an instruction infringes applicable data protection law;
• ensure persons authorised to process the data are under an appropriate duty of confidentiality;
• implement the technical and organisational measures in Annex 2;
• respect the conditions in section 5 for engaging sub-processors;
• assist you, insofar as possible and taking into account the nature of the processing, in responding to data-subject requests and in meeting your security, breach-notification, impact-assessment, and prior-consultation obligations — noting that the store-nothing design means most content is not retained by Hablexo and is therefore not retrievable after an event;
• at your choice, delete or return all personal data after the end of the provision of services and delete existing copies, save where law requires retention (event content is retained on no server of ours, by design);
• make available the information necessary to demonstrate compliance, and allow for and contribute to audits as set out in section 7.

4. Security

Hablexo implements and maintains the measures in Annex 2, appropriate to the risk.

5. Sub-processors

The Customer provides, and where necessary warrants that it has obtained from the Controller, general authorisation for Hablexo to engage the sub-processors listed in Annex 3. Hablexo imposes data-protection obligations consistent with this DPA on each sub-processor and remains responsible for their performance. Hablexo will give you reasonable prior notice (by email or through your account) of any new or replacement sub-processor, and you may object on reasonable data-protection grounds; if the objection cannot be resolved, you may close your account.

6. International transfers

Where personal data is transferred internationally, Hablexo will ensure that a transfer mechanism valid under the data protection law that applies to the transfer is in place — an adequacy decision, the UK International Data Transfer Agreement or Addendum, or EU standard contractual clauses, as applicable to the sub-processor concerned.

7. Data-subject requests and audits

Hablexo will respond to reasonable audit requests by providing relevant documentation (this DPA, the sub-processor list, and the security measures), and will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints, on reasonable notice and confidentiality terms.

8. Personal data breach

Hablexo will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us to help you meet your own notification obligations.

9. Deletion and return

See section 2 (Storage) for transient event content. On termination, Hablexo will delete any incidental personal data within its control, save where law requires retention (for example account and billing records in Hablexo’s separate controller processing, as described in the Privacy Notice).

10. What your machine stores — and what that means for you

The operator application writes some files to your own device, not to our servers. Two of them can contain other people’s personal data. The Customer is the controller of them where it decides the purpose and means of the event, or a processor holding them for its client Controller:

• Chat history — attendee posts and the chat names they chose, saved so a forum survives a restart. Kept for a period the Customer sets, 7 days by default, and erasable at any time from the app. Attendees are told this before they post.
• Audio recordings and transcripts — off by default. If you switch them on, you are recording, on your own equipment, everyone whose voice the application captures: your presenters at an event, and everyone taking part in a conversation. A transcript can include chat posts and the names attached to them. Depending on what is said, that may include special-category data. The Customer must ensure that the Controller has a lawful basis and has authorised the capture.

The Customer must ensure that the Controller has a lawful basis, informs attendees and anyone taking part in a conversation, authorises any recording or transcript, and supplies the necessary instructions. Hablexo processes event content only on those instructions, and provides the limits, retention defaults, and delete controls described above.

11. Liability, precedence, and law

This DPA prevails over the Terms of Service and the EULA on data-protection matters. Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA is governed by the laws of England and Wales.

Annex 2 — Technical and organisational measures

• Store-nothing event content — captions, translations, chat, and audio clips are held on our servers in RAM only: event-scoped, capped, time-limited, and dropped when the event’s publisher disconnects.
• Transport security — TLS on every connection that crosses the public internet: attendee, translator, and operator connections to Hablexo, and Hablexo’s connections to its sub-processors. Hablexo’s own servers reach each other over a private network. The operator application connects out to Hablexo; it accepts connections only on the device itself or, where the Customer turns that on, from the Customer’s local network.
• Speech path minimisation — speech captured by the operator application streams directly from the operator’s device to the speech-to-text provider using short-lived credentials; it does not pass through Hablexo’s servers. Audio that is relayed (a human translator’s voice, or the optional input-audio relay) passes through Hablexo’s servers in memory only.
• Account-plane hardening — passwords stored only as salted hashes from a memory-hard function, hashed credential tokens, a database that is not network-exposed, encrypted off-site backups, and an audit log free of content and secrets.
• Hosting — Oracle Cloud, United Kingdom (London) region, for the delivery and account infrastructure.
• Access control — least-privilege operational access; per-event key scoping for attendee delivery; publisher authentication bound to the owning account.

Annex 3 — Sub-processors (event content)

The sub-processors that may process event content (audio or text) are:

• Speech-to-text: Soniox, ElevenLabs, Deepgram, Amazon Web Services, and Google Cloud.
• Translation: Makora, DeepInfra, and Google Cloud.
• Hosting of the delivery and account infrastructure: Oracle Cloud.

This list is complete. The company each sub-processor is, where that company is registered, and every server location we may route event content through are published at console.hablexo.com/legal/sub-processors.html. That page forms part of this Annex, and we update it before event content is routed through a location it does not list.

Which sub-processor serves which language is not published, here or elsewhere.

Providers used for account and billing data (payments, email, hosting) are listed in the Privacy Notice.

Hablexo Ltd · Registered in England & Wales · Company No. 17354416 · Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF · hello@hablexo.com

Hablexo home · Privacy Notice · Terms of Service · EULA · Sign up