Data Processing Addendum v1.5-2026-08-11

Version 1.5 — 11 August 2026. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Hablexo Ltd, a company registered in England & Wales (company no. 17354416), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF (“Hablexo”) and the business or organisational Customer (“you”, the “Customer”). “Controller” means the party that determines the purposes and means of the event processing: either the Customer or, where the Customer provides services to a client, that client or another third-party controller. Terms not defined here have the meaning given in UK GDPR / the Data Protection Act 2018.

1. Roles and scope

• For the content plane — live speech, captions, slides, chat, and any attendee personal data inherent in them — Hablexo is a processor where the Customer is the Controller, and a sub-processor where the Customer is itself a processor acting for a third-party Controller.
• Where the Customer is a processor, it warrants that the Controller has authorised the Customer to appoint Hablexo as a sub-processor and to pass the Controller’s documented instructions to Hablexo. The Customer remains Hablexo’s contracting party and point of contact and is responsible for communicating with the Controller.
• The account and billing plane — your account contact details, credit ledger, Customer identity and eligibility details, and aggregate usage counts — is processed by Hablexo as an independent controller. That processing sits outside this DPA and is described in the Privacy Notice.
• Direct attendee feedback to Hablexo. The attendee page offers a control an attendee may use to send a message to Hablexo about the service — feedback, a problem report, or a feature request. Where an attendee chooses to do so, Hablexo determines the purpose and means of collecting, triaging and retaining that message and is therefore an independent controller for it. That processing is outside the processing Hablexo performs on the Customer’s behalf under this DPA, and outside the Customer’s instructions: it is initiated by the attendee, not by the Customer, and the Customer neither directs it nor receives its contents. It is described in the Privacy Notice.
  Two consequences the Customer should know. First, the message and any reply address the attendee provides are never disclosed to the Customer, so a report about an event does not reach the organiser through this channel and cannot be treated as notice to them. Second, this channel carries no content-plane data: it does not collect captions, translations, chat messages, chat display names or the event key, so nothing the Customer controls passes through it.

The Service and this DPA are for business and organisational use. They are not intended to create a controller-to-processor arrangement for wholly or mainly personal, family, or household activity. The parties’ roles are determined by the facts and applicable law, not merely by the labels used in this DPA.

2. Processing details (Annex 1)

• Subject-matter: provision of real-time transcription, translation, captioning, optional spoken audio, optional carriage of a live human translator’s voice, and a translated chat forum for events operated by or for the Customer.
• Duration: the term of the Terms of Service.
• Nature and purpose: transient capture, transcription, machine translation, and per-language delivery of live content to attendee devices.
• Types of personal data: whatever is contained in the spoken or typed content of your events — speakers’ words, the voice and words of any human translator the Customer admits, attendee chat messages, and optional display names. No special-category data is required by the service; any that arises does so only because it is spoken or typed in your event.
• Categories of data subjects: speakers, presenters, human translators admitted by or for the Customer, and attendees in events operated by or for the Customer.
• Storage: on Hablexo’s servers, content is held in memory only — event-scoped, size-capped, time-limited, and dropped when the event’s publisher disconnects. Hablexo does not persist caption content or attendee identifiers on its servers. Durable chat history — and any audio recordings or transcripts you choose to enable — lives on your operator machine, not on Hablexo’s servers (see section 10). If the Customer enables the input-audio relay (off by default), the event’s live input audio is relayed through Hablexo’s servers to listening devices in real time, unprocessed, and is not recorded or stored by Hablexo; the Customer is responsible for informing the people in the room, and the attendee page discloses the relay to listeners while it is on. If the Customer admits a live human translator, the translator’s speech is relayed through Hablexo’s servers to that language’s listeners in the same in-memory way, and may be transiently transcribed by the speech-to-text sub-processors in Annex 3 to produce that language’s captions. Any recording of the event the Customer chooses to make happens on the Customer’s own equipment, outside Hablexo’s processing.

3. Processor obligations

Hablexo shall:

• process the personal data only on the Customer’s documented instructions, including any Controller instructions the Customer is authorised to pass to us (the Terms, the service configuration, and the Customer’s use of the service), including for international transfers, unless required by law — in which case we will inform the Customer unless legally prohibited;
• ensure persons authorised to process the data are under an appropriate duty of confidentiality;
• implement the technical and organisational measures in Annex 2;
• respect the conditions in section 5 for engaging sub-processors;
• assist you, insofar as possible and taking into account the nature of the processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations — noting that the store-nothing design means most content is not retained by Hablexo and is therefore not retrievable after an event;
• at your choice, delete or return all personal data after the end of the provision of services and delete existing copies, save where law requires retention (the content plane retains nothing on our servers by design);
• make available the information necessary to demonstrate compliance, and allow for and contribute to audits as set out in section 7.

4. Security

Hablexo implements and maintains the measures in Annex 2, appropriate to the risk. The primary control is architectural: the content plane is store-nothing on our servers, so caption content and attendee identifiers are not persisted by Hablexo.

5. Sub-processors

The Customer provides, and where necessary warrants that it has obtained from the Controller, general authorisation for Hablexo to engage the sub-processors listed in Annex 3. Hablexo imposes data-protection obligations consistent with this DPA on each sub-processor and remains responsible for their performance. Hablexo will give you reasonable prior notice (by email or in the control panel) of any new or replacement sub-processor, and you may object on reasonable data-protection grounds; if the objection cannot be resolved, you may close your account.

6. International transfers

Where personal data is transferred outside the UK or EEA, Hablexo will ensure an appropriate transfer mechanism is in place — the UK International Data Transfer Agreement or Addendum, EU standard contractual clauses, or an adequacy decision, as applicable to the sub-processor concerned.

7. Data-subject requests and audits

Hablexo will, taking into account the store-nothing design, provide reasonable assistance with data-subject requests you receive that relate to content processed under this DPA. Hablexo will respond to reasonable audit requests by providing relevant documentation (this DPA, the sub-processor list, and the security measures), and will permit an on-site or independent audit where required by law or a supervisory authority, on reasonable notice and confidentiality terms.

8. Personal data breach

Hablexo will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us to help you meet your own notification obligations.

9. Deletion and return

Because the content plane retains nothing on our servers, in the ordinary course there is no content to return or delete after an event. On termination, Hablexo will delete any incidental personal data within its control, save where law requires retention (for example account and billing records in the separate controller plane, as described in the Privacy Notice).

10. What your machine stores — and what that means for you

The operator application writes some files to your own device, not to our servers. Two of them can contain other people’s personal data. The Customer is the controller of them where it decides the purpose and means of the event, or a processor holding them for its client Controller:

• Chat history — attendee posts and the chat names they chose, saved so a forum survives a restart. Bounded (newest 50 posts per forum), deleted after 7 days by default, and erasable at any time from the app; a forum can be set memory-only so nothing is written at all. Attendees are told this in the app before they post.
• Audio recordings and transcripts — off by default. If you switch them on, you are recording your speakers on your own equipment. Depending on what is said, that may include special-category data. The Customer must ensure that the Controller has a lawful basis and has authorised the capture.

The Customer is responsible for ensuring that the Controller has a lawful basis, gives appropriate information to attendees, authorises any recording or transcript logging, and gives the Customer the necessary instructions. Hablexo processes event content only on the authorised instructions passed through the Customer, and supplies the bounds, retention defaults, and delete controls described above.

11. Liability, precedence, and law

This DPA prevails over the Terms of Service and the EULA on data-protection matters. Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA is governed by the laws of England and Wales.

Annex 2 — Technical and organisational measures

• Store-nothing content plane — captions, translations, chat, and audio clips are held on our servers in RAM only: event-scoped, capped, time-limited, and dropped when the event’s publisher disconnects.
• Transport security — TLS on all attendee, operator, and server links; the operator application makes outbound connections only.
• Secrets isolation — provider keys are held only in the server-side broker as file-based secrets; the delivery fan-out holds no provider key; card data never touches Hablexo (Stripe; PCI SAQ-A).
• Speech path minimisation — the captured audio streams directly from the operator’s device to the speech-to-text provider using short-lived vended tokens; it does not transit Hablexo’s servers.
• Account-plane hardening — strong password hashing (argon2id), hashed credential tokens, a database that is not network-exposed, encrypted off-site backups, and an audit log free of content and secrets.
• Hosting — Oracle Cloud, United Kingdom (London) region, for the delivery and account infrastructure.
• Access control — least-privilege operational access; per-event key scoping for attendee delivery; publisher authentication bound to the owning account.

Annex 3 — Sub-processors (content plane)

Current sub-processors that may process event content (audio or text):

Providers used for the account and billing plane (payments, email, hosting) are listed in the Privacy Notice.

Hablexo Ltd · Registered in England & Wales · Company No. 17354416 · Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF · hello@hablexo.com

Hablexo home · Privacy Notice · Terms of Service · EULA · Sign up