处理者条款， 包含附件。

本数据处理附录（“DPA”）构成 Digital Socket LLC，一家在美国特拉华州成立的有限责任公司，以 Transglot 名义运营（“Transglot”，“处理者”）与客户（“客户”，“控制者”）之间的服务条款或其他书面协议（“协议”）的一部分，适用于我们在提供服务过程中代表客户处理客户个人数据的所有情况。它通过引用纳入协议，并与协议同时生效；无需签名即可约束我们。如果客户本身是代表第三方控制者行事的处理者，则客户为出口方，本 DPA 视同客户为控制者而适用，且客户确认其已获得自身控制者的授权，可按这些条款签订本 DPA。

“数据保护法”指适用于一方的所有关于处理个人数据的法律，包括欧盟《通用数据保护条例》2016/679（“GDPR”）、英国 GDPR 和《2018 年数据保护法》、瑞士《联邦数据保护法》、经修订的《加州消费者隐私法案》（“CCPA”）以及美国各州类似的隐私法。“客户个人数据”指包含在客户内容中或由我们代表客户处理的其他个人数据。“标准合同条款”或“SCCs”指附于欧盟委员会实施决定 (EU) 2021/914 的条款。“英国附录”指英国信息专员根据《2018 年数据保护法》第 119A 条发布的国际数据传输附录。“子处理者”指由我们聘请来处理客户个人数据的第三方。“控制者”、“处理者”、“数据主体”、“个人数据”、“处理”、“个人数据泄露”和“监管机构”具有 GDPR 中赋予的含义，其他法律中的等效术语具有其等效含义。

如发生冲突，优先顺序为：(a) 标准合同条款和英国附录（如适用）；(b) 本 DPA；(c) 订单表单中的任何其他数据保护条款；(d) 协议的其余部分。本 DPA 中的任何内容均无意与一方在数据保护法下的义务相冲突，任何此类条款应被解释为消除冲突所需的最小范围。

本 DPA 自协议生效之日起适用，直至我们不再持有任何客户个人数据，这可能因第 13 条规定的删除时间表而在协议结束后继续有效。只要我们持有任何客户个人数据，其义务在终止后仍然有效，且保密义务在数据保护法要求的范围内无限期有效。

我们仅依据客户的书面指示处理客户个人数据，包括向第三国传输，除非受我们适用的法律要求必须这样做，在这种情况下，我们将在此类处理之前告知客户该要求，除非法律基于重要的公共利益理由禁止此告知。协议、本 DPA、文档以及客户在产品中设置的配置（项目、区域设置、连接器、Webhook 订阅、保留开关、翻译记忆库开关以及客户可用的引擎和质量设置）共同构成客户的完整书面指示。如果我们认为某项指示违反数据保护法，我们将告知客户，并且我们可以暂停受影响的处理，直到该指示被撤回或修改，而不是执行该指示。

我们处理客户个人数据仅是为了向客户提供、保障、支持和维护服务，绝非出于我们自身的独立目的。我们不出售客户个人数据，不共享用于跨上下文行为广告的数据，除数据保护法允许服务提供商进行的操作外，不将其与我们从其他来源接收的个人数据合并，也不使用它来训练、微调或评估任何机器学习模型。我们的 AI 子处理者仅将其用于推理，商业条款禁止对其进行训练。我们可以创建和使用既不能识别客户也不能识别任何数据主体的聚合或去标识化统计数据，并且我们不会尝试重新识别它们。

我们确保每位获准处理客户个人数据的人员都受到适当的保密义务约束，无论是合同性的还是法定的，该义务在其聘用结束后仍然有效。访问权限基于最小特权原则授予，仅限于个人履行其角色所需的内容，定期审查，并在角色变更或离职时迅速撤销。拥有访问权限的人员会接受与其角色相适应的数据保护和安全性培训。

我们实施并维护附件 II 中规定的技术和组织措施，考虑到技术水平、实施成本以及处理的性质、范围、背景和目的，以及对数据主体的风险。我们可能会随着时间的推移更新这些措施，前提是付费订阅期间的整体保护水平不会大幅降低。附件 II 故意列出了我们的差距以及我们的控制措施：一份只列出优势的措施附件不是审查员可以依赖的文件。

客户给予我们一般性的书面授权，允许我们聘请子处理商，类别如子处理商文档中所述，并特别授权生效日期时附件 III 中提供的子处理商列表中的那些。我们通过书面合同对每个子处理商施加不低于本 DPA 中的数据保护义务，并且我们对子处理商履行其义务的情况向客户承担全部责任。在新子处理商开始处理客户个人数据之前，我们将通过电子邮件向账户所有者发出至少三十天的通知。客户可以在该期限内基于合理的、有据可查的数据保护理由提出反对，在这种情况下，我们将本着诚意努力提供配置更改或替代方案以避免处理；如果我们在合理时间内无法做到，客户可以终止受影响的订阅而无需支付罚款，并获得预付未使用费用的按比例退款。

考虑到处理的性质，我们在可能范围内通过适当的技术和组织措施协助客户履行其义务，以响应行使访问、更正、删除、限制、可携带性或反对权的数据主体。产品本身是这种协助的第一道防线：账户所有者和工作区管理员可以搜索、编辑和删除项目内容，管理成员和角色，并通过 API 拉取端点、命令行界面、交付捆绑包或付费计划上的存储连接器检索项目内容，账户所有者可以删除工作区。如果产品无法回应请求，我们将在合理期限内应请求免费提供帮助，处理合理数量的请求。如果数据主体直接联系我们询问客户个人数据，我们不会实质性回应；我们会告知他们联系客户，并在不被禁止的情况下迅速通知客户。

考虑到处理性质及我们要掌握的信息，我们将协助客户履行《通用数据保护条例》(GDPR) 第 32 至 36 条及其等效条款规定的义务，包括数据保护影响评估以及与监管机构的事先磋商。实际上，这意味着提供本 DPA、附件 II、信任中心披露信息、隐私政策中的保留时间表、我们的安全文档，以及对安全或隐私问卷的合理书面答复。对于超出合理范围的大量协助请求，我们可能会按当时的专业服务费率收费，并会在开展工作前而非事后告知客户。

在知悉影响客户个人数据的个人数据泄露事件后，我们将毫不拖延地通知客户，且在任何情况下不超过七十二小时。通知将描述当时已知的情况，并随着了解深入而更新：泄露的性质，包括在可能情况下涉及的数据主体和记录的类别及大致数量；可能的后果；为解决泄露及减轻其影响所采取或拟采取的措施；以及进一步信息的联系点。我们将与客户合作，并采取客户合理要求的步骤，协助其进行调查和通知。通知不构成也不应被解释为承认过错或责任。我们不会为了完成调查而延迟发出通知。

根据客户的选择，我们在服务提供结束时删除或返回客户个人数据，并删除现有副本，除非我们受其约束的法律要求存储。在产品中，其工作方式如下：取消订阅会将账户移至免费计划，其中包括一个工作区，其他所有工作区变为只读，并在 30 天后删除，或者对于最近经历过相同情况的工作区，按照服务条款第 13 条的描述更早删除，除非客户先升级或移动它；删除工作区会使其在 30 天内变为只读，在此期间账户所有者可以恢复它，之后工作区将从活动数据库中清除，包括项目、翻译、版本历史、使用记录、webhook 交付记录、截图和审计事件；关闭账户会以相同方式删除其上的每个工作区，并将账户发票保留 7 年；删除用户登录名是立即且不可逆的。客户通过 API、命令行界面、交付捆绑包或存储连接器检索的内容，从我们交付的那一刻起就不再受我们控制。加密备份不受清除影响，并按附件 II 中的时间表过期；在它们存在期间，它们是隔离的、加密的，并且仅用于灾难恢复，绝不会将已清除的工作区恢复服务。在删除之前提出的以结构化格式返回的书面请求将在合理期限内免费 honoured 一次。

我们将向客户提供合理必要的信息，以证明符合本 DPA 和 GDPR 第 28 条的规定，并允许和配合由客户或其指定的审计师进行的审计（包括检查）。首先，通过提供本 DPA、附件 II、信任中心、安全页面以及我们已完成的安全问卷答复来满足该义务。如果这些材料确实不足以满足客户的监管义务，客户可在任何十二个月期间内进行一次审计，需提前至少三十天书面通知，在工作时间内进行，不得无理干扰我们的运营，须遵守保密义务，仅限于与客户自身数据相关的系统和记录，费用由客户承担。行使法定权力的监管机构不受上述限制。审计师不得是我们的竞争对手，我们可以要求其签署单独的保密承诺。

如果我们对客户个人数据的处理涉及从欧洲经济区向未获得充分性认定国家的传输，标准合同条款 (SCC) 将纳入本 DPA 并成为其一部分，适用如下：如果客户是控制者，适用模块二（控制者到处理者）；如果客户本身是处理者，适用模块三（处理者到处理者）。适用第 7 条（接驳条款）。在第 9 条中，选择选项 2（一般书面授权），通知期如上第 09 条所述。在第 11 条中，不选择可选的独立争议解决语言。在第 17 条中，除非双方在订单表中同意其他欧盟成员国法律，否则条款受爱尔兰共和国法律管辖。在第 18(b) 条中，争议同样由爱尔兰共和国法院解决。附件 I(A) 为各方信息，附件 I(B) 为传输描述，附件 I(C) 为主管监管机构，附件 II 为技术和组织措施，附件 III 为子处理者列表，具体如下所示。

对于受英国 GDPR 约束的传输，英国附录已纳入并完成如下：表 1 由附件 I(A) 完成；表 2 和表 3 由本 DPA 的第 15 条及附件 I 和 II 完成，依赖的版本为经批准的欧盟 SCC；在表 4 中，任何一方均不得因经批准的附录发生变更而终止本附录。对于受瑞士法律约束的传输，SCC 中对 GDPR 的引用应解读为对《瑞士联邦数据保护法》的引用，主管机构为联邦数据保护和信息专员，提及成员国不得剥夺瑞士数据主体在其惯常居住地提起诉讼的权利，且 SCC 保护法人实体的数据，直到瑞士法律不再要求为止。

如果我们收到公共机构对客户个人数据具有法律约束力的请求，我们将：审查其有效性和范围，并在有合理理由认为其违法时提出质疑；仅披露请求所需的最小数据；并及时通知客户，提供足够细节以便其回应，除非法律禁止，在此情况下我们将尽合理努力获得禁令豁免并寻求允许披露的临时措施。我们将保存收到的请求及回复的记录，并在法律允许的范围内，根据客户要求向客户和监管机构提供。我们从未收到要求我们构建或保留对客户个人数据的通用访问机制的政府请求，我们也绝不会自愿构建此类机制。

对于受《加州消费者隐私法案》(CCPA) 约束的个人信息，客户是企业，我们是服务提供商。我们禁止且不会出售或共享该个人信息；不会出于协议规定的业务目的或 CCPA 允许的其他目的之外保留、使用或披露该信息；不会在双方直接业务关系之外保留、使用或披露该信息；也不会将其与从其他来源接收的个人信息合并，除非 CCPA 允许服务提供商这样做。我们证明我们理解并将遵守这些限制。如果我们确定无法再满足这些限制，我们将通知客户。客户可以利用第 14 条中的审计权利，采取合理适当的步骤制止和补救未经授权的使用。我们提供与 CCPA 对企业要求的同等水平的隐私保护。

当适用的全面州隐私法要求签订包含特定条款的处理者合同时，本 DPA 即为该合同：它规定了处理的性质和目的、数据类型、持续时间、双方的权利和义务、我们的保密义务、我们在等效书面条款下聘请子处理者、我们协助处理消费者权利请求和安全义务、我们在服务结束时的删除或返还义务，以及我们提供必要信息以证明合规并允许合理评估的义务。根据这些法律，我们作为处理者或服务提供商行事，绝不作为客户个人数据的控制者。

各方因本 DPA 产生或与之相关的责任，无论是基于合同、侵权还是其他理论，均受协议中的责任限制和排除条款约束，且这些限制中对一方责任的任何引用均指该方在协议和本 DPA 下的累计责任。本条款不限制数据主体根据标准合同条款或数据保护法享有的权利，也不限制依法不能限制的责任。

如果需要反映数据保护法的变化、新的或修订的传输机制、监管机构或法院的决定，或者服务处理客户个人数据的方式发生重大变化，我们可能会更新本 DPA，前提是更新不会实质性降低对客户个人数据的保护。对于重大更新，我们将通过电子邮件和本页面提前至少三十天通知，并更改顶部的生效日期。我们将根据要求提供被取代的版本。

本 DPA 无需签名即可约束我们，因此客户无需签署即可受到保护。如果您的流程需要签署副本存档，或者如果您希望提出修订标记，请写信至 privacy@transglot.ai，提供法律实体名称、注册地址、通知联系人和签署人，我们将返回签署副本。我们通过同一地址回答安全和隐私问卷，信任中心提供了大多数审核者在联系任何人之前所需的资料包。

Data exporter: the Customer, being the person or company that holds the Account, as named on the Account or on the Order Form, acting as controller (or as processor where clause 01 applies) in respect of Customer Personal Data processed through the Service. Contact details: the Account Owners' email addresses and the notice contact given on the Order Form. Activities relevant to the transfer: use of a cloud localization platform to store, translate, review, deliver and manage software and content strings. Signature and date: as recorded by acceptance of the Agreement, or as executed under clause 22. Data importer: Digital Socket LLC，一家在美国特拉华州成立的有限责任公司，以 Transglot 名义运营, acting as processor. Contact details: privacy@transglot.ai. Activities relevant to the transfer: provision of the Service described in the Agreement. Role: processor.

Categories of data subjects: the Customer’s personnel and contractors who hold a login (Account Owners and Billing Members, and workspace admins, developers, reviewers and translators); the Customer’s own end users, customers and other individuals to the extent their personal data appears inside source strings, translations, glossary entries, comments, screenshots or imported files; and the Customer’s billing and notice contacts. Categories of personal data: identity and contact data (name, email address, login identifier, Account, workspace and role); authentication data (hashed password, second factor enrolment, federated identity subject identifiers, API token digests); usage and technical data (IP address, user agent, pages and endpoints accessed, request and run identifiers, timings, outcomes, error traces, audit records); billing data (billing contact, billing address, tax identifiers, payment method token and card metadata held by the payment processor); content data (whatever personal data the Customer chooses to place in project content, which is under the Customer’s control and which the Acceptable Use Policy asks the Customer to keep free of payment card data, government identifiers, credentials and special category data). Sensitive data: none is requested or required, and none should be submitted; where the Customer nonetheless submits it, the restrictions and safeguards are those in Annex II applied to all Customer Content, and the Customer remains responsible for its lawful basis. Frequency: continuous, for the duration of the Agreement, on the Customer’s instruction. Nature and purpose: hosting, storage, indexing, machine translation, quality checking, translation memory matching, glossary enforcement, review workflow, delivery and transmission through the API, webhooks, connectors and the delivery bundle, together with support, security and billing. Duration of processing: the term of the Agreement plus the retention periods stated in the Privacy Policy and clause 13 of this DPA. Subprocessor processing: for the purposes, and for the durations, set out in Annex III and in the Trust Center.

Where the SCCs apply on the basis of Article 3(1) of the GDPR, the competent supervisory authority is the one in the member state in which the data exporter is established. Where they apply because the exporter is not established in the European Economic Area but is caught by Article 3(2), the competent authority is the one in the member state in which the exporter’s Article 27 representative is established. Where they apply on the basis of Article 3(2) and no representative is appointed, the competent authority is the one in the member state in which the data subjects whose personal data is transferred are located. For UK transfers the competent authority is the Information Commissioner’s Office; for Swiss transfers, the Federal Data Protection and Information Commissioner.

Data in transit is protected with TLS 1.2 or better at the edge, and connections below that are refused. Passwords are hashed with bcrypt at a cost factor of 12 and are never stored or logged in plaintext. API tokens and delivery keys are stored as SHA-256 digests, are displayed once at creation and cannot be recovered afterwards; publishable in-context keys are deliberately public identifiers bound to an origin allowlist rather than secrets, and are documented as such. Third party credentials, connector tokens, SSO configuration secrets and webhook signing secrets are held in encrypted columns using authenticated application-level encryption. Database backups are encrypted with AES-256 by the backup tool itself, independently of any provider-side encryption, and file backups are held in a password-encrypted repository. Two honest gaps: the live database and application volumes are not disk-encrypted, and server-side encryption of the object store is not asserted in our own configuration. We state both here rather than letting a reviewer discover them in diligence.

Every query in the application is scoped by Account, workspace and project, and a cross-tenant identifier answers 404 rather than 403 so that the existence of another tenant’s record never leaks. The two Account roles (Owner and Billing), the four workspace roles (admin, developer, reviewer and translator), eighteen project abilities and per-project and per-language grants are available on every plan including Free, so least privilege is never a paid upgrade. Two-factor authentication with time-based one-time codes and recovery codes, and passkeys, are available on every plan, and an Account Owner can require a second factor for an entire workspace, enforced at the workspace boundary so that federated and single sign-on doors cannot bypass it. SAML 2.0 single sign-on with just-in-time provisioning, generic OpenID Connect, SCIM 2.0 provisioning and de-provisioning, and the ability to switch off password login for a workspace are available on the Enterprise plan. API access uses scoped tokens with optional expiry. Internal administrative access is least privilege, and operator impersonation of a customer’s login is time-limited to thirty minutes and writes an audit record when it starts and when it ends.

Security-relevant events are written to an append-only audit trail: sign-in and single sign-on events, second factor and workspace MFA policy changes, member invitations, joins, role changes and removals, custom role changes, token and key creation and revocation, integration and connector connection and disconnection, review policy changes, branding changes, SCIM provisioning events, workspace rename and deletion requests. Plan, billing and spend cap changes, changes to the Account’s members and the closing of the Account are written to the Account’s own audit trail in the same way. Each record carries the workspace or the Account, the actor, the action, the target, structured metadata, the source IP address and the time, and the model layer refuses updates and deletes, so a record cannot be edited after the fact; on the Account’s trail the IP address is removed after 395 days. On the Enterprise plan the whole trail, the Account’s included, can be exported as CSV. Append-only is enforced in the application layer and there is no cryptographic hash chain or signature over the log, so we do not describe it as tamper-evident. Application errors are collected by an error tracker we host ourselves, configured not to send personally identifying information and not to capture request bodies, which is the setting that actually keeps customer strings out of a stack trace. Operational metrics are retained for thirty days.

Public endpoints are rate limited: the REST API at sixty requests a minute per token, the delivery endpoint at three hundred a minute per key and address, sign-in at five a minute per email and address, and registration at five a minute and twenty an hour per network block, with separate buckets for the other public doors. Outbound webhooks are signed HMAC-SHA256 over the timestamp and the raw body, sent as an explicit signature header and a timestamp header, and compared in constant time; the timestamp is published so the receiver can enforce its own replay window, and we are explicit that no server-side tolerance is enforced on our side. Inbound forge webhooks are verified by signature, with the delivery identifier as the replay guard. Cross site request forgery protection is applied to every state-changing browser request, sessions expire after 120 minutes of inactivity, sensitive actions require password re-confirmation within a 3 hour window, password reset links expire after 60 minutes, and destructive actions require typing the workspace name or re-entering a password. A frame-ancestors content security policy is applied; we do not claim a broad content security policy, because we do not yet ship one.

Usage metering records counts of words and tokens, never the body of a request. The shared exact-match translation memory pool stores the linguistic pair keyed by a hash of the source, together with plural forms and reuse counters, and stores no user column and no team column at all, so an entry cannot be traced to a person; the key name, file path, screenshots, comments and every other piece of surrounding context are stripped. Human-reviewed memory entries carry a workspace identifier, which functions as a hard tenant fence on the near-match query rather than as attribution, and that is why a reviewed entry is never returned to another workspace. Any project can leave the pool entirely with a per-project switch on every plan, which stops it both contributing and drawing. In-context screenshots are held on a private store with no public path and are served only through short-lived signed URLs.

The database is backed up continuously with write-ahead log archiving and periodic full and differential backups, retaining two full backups and seven differentials, encrypted with AES-256 by the backup tool. Application file storage is snapshotted nightly into a password-encrypted repository retaining thirty daily, twelve weekly and twelve monthly snapshots, with an integrity verification pass on each run. Restore procedures are documented and exercised. Backups are isolated from the production credentials that could delete them, and they are restored for disaster recovery only, never to return a purged workspace to service. Deployment images are retained for the last several releases so that a rollback is a minute rather than a rebuild.

Changes are made through version control with peer review, an automated test suite, static analysis and dependency scanning, and container image vulnerability scanning in the build pipeline, and a failing gate blocks the release rather than warning about it. Test environments do not use production customer data. Secrets are held encrypted at rest in the deployment repository and injected at runtime rather than committed. Several product claims are themselves enforced by tests: a translation engine that becomes reachable without a subprocessor disclosure row fails the build, and the advertised overage rate is pinned to the rate the system charges. Third party components are tracked and patched, and a build is refused when a scanner reports a vulnerability above threshold.

Access to production is limited to the personnel who need it, granted individually, and removed on role change or departure. Personnel are bound by confidentiality obligations that survive their engagement, and receive security and data protection guidance appropriate to their role. We operate a documented incident response process with defined severities, an on-call rotation, alerting on service health and background job health, and post-incident review. We publish a vulnerability disclosure policy with a safe harbour for good faith research and a security address that is monitored. We hold no third party security certification today: a SOC 2 Type II audit is in progress and an AI management system standard is being pursued, and the compliance status published on our site is rendered from a configuration value that cannot show a certificate we do not hold.

Scheduled jobs enforce the retention windows published in the Privacy Policy rather than leaving them as intentions: translation version history at 180 days with a floor of the newest 20 per string, notifications at 90 days, resolved comment threads at 365 days from resolution, the activity feed at 180 days, assistant conversations at 90 days, in-context screenshots at 90 days with the stored object deleted alongside the record, connector sync records at 90 days keeping the latest per connection, referral click records at 90 days, unreviewed and unused translation memory entries at 90 days, failed background jobs at 7 days, expired API tokens 24 hours after they lapse, federated login correlation records at their own expiry, signup integrity signals 90 days after the Account was created or the pair was last seen, sign-up refusal records at 90 days, welcome words velocity records at 30 days for a domain and 24 hours for a network, sign-up allowlist entries at the expiry an operator set, never more than 365 days, Accounts never verified and holding no workspace at 30 days, welcome words, trial and card fingerprint records at 1,095 days, and the IP address on an Account’s audit trail at 395 days. Deletion runs in bounded batches rather than as one unbounded operation. Workspace deletion is a 30 day reversible grace period followed by a cascading purge of the live database. Webhook delivery records have no time-based prune today and are removed with their endpoint or their workspace.

For transfers to subprocessors we rely on the contractual measures in clause 15 together with these supplementary measures: transport encryption on every hop; contractual prohibitions on training, on onward transfer without equivalent protection, and on processing outside our instructions; a published and code-enforced disclosure list so that no undisclosed vendor can be routed customer text; the ability for a customer to disable the optional features that engage a conditional subprocessor, including the semantic translation memory feature and the per-project translation memory switch; retention windows enforced by scheduled jobs so that transferred data does not accumulate indefinitely; and the government access commitments in clause 17, including challenge, minimisation, notification and record keeping.

权威的当前子处理器列表由我们维护，并根据保密协议应客户要求通过写信至 privacy@transglot.ai 提供。类别、目的、区域以及参与条件发布在信任中心，并在《子处理器》文档中总结，该文档通过引用纳入本附件。故意将其保存在一个地方而非复制到此页面：重新输入到法律文档中的列表会在供应商变更当天过时，而过时的附件比链接更糟糕。截至生效日期，类别包括：AI 翻译、自动质量检查、术语提取和上下文视觉建议，在美国处理，在使用 AI 功能时参与；用于语义翻译记忆的文本嵌入，在美国处理，仅在项目开启该功能时参与（默认关闭）；通过美国 API 路由器访问并托管在新加坡的可选替代翻译引擎，仅在操作员将层级路由到该引擎时参与（默认关闭）；云托管、数据库和对象存储，在部署时固定的区域中，始终参与；支付处理，在美国和欧盟，仅针对付费计划参与；事务性电子邮件投递，始终参与；以及产品内支持消息传递，仅在启用支持信使时参与。如果客户提供自己的凭据用于可选的机器翻译回退，则客户是该传输的控制者，供应商不是我们的子处理器。