Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Streamlingo GmbH Ludwigsburger Str. 20 76228 Karlsruhe Germany

Email: info@streamlingo.net Website: https://streamlingo.net

Managing Director: Tim-Cedric Inhoff Commercial Register: Amtsgericht Mannheim, HRB 754728 VAT ID: DE455400444

2. Overview of Data Processing

We only process personal data to the extent necessary to provide our services. Processing is based on the GDPR, in particular:

• Art. 6(1)(b) GDPR – Performance of a contract
• Art. 6(1)(f) GDPR – Legitimate interest (e.g., IT security)
• Art. 6(1)(a) GDPR – Consent (where required)

3. Hosting and Technical Provision

Our website and the Streamlingo platform run on infrastructure provided by Google Cloud EMEA Limited (Firebase), with whom a data processing agreement under Art. 28 GDPR is in place. Platform data (database and file storage) is stored in the EU region. The website is delivered via the provider's content delivery network.

When you access our services, the following data is automatically collected:

• IP address (anonymized)
• Date and time of access
• Page/file accessed
• Browser type and version
• Operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision of the website).

Retention period: Server log files are stored for security purposes (e.g., to investigate abuse or fraud) for a period of 60 days and are then automatically deleted.

4. Streamlingo Platform (Translation Service)

On the platform we process personal data in two distinct roles. Registration, billing and usage data of our customers is processed by us as the controller. The content of transmitted events (audio, transcripts, translations) is processed by us as a processor on behalf of the respective customer, who is the controller in that respect.

Processing on behalf of a customer is governed by a data processing agreement under Art. 28 GDPR. You can review it without registering:

• Data processing agreement (PDF)
• Supplementary agreement on church data protection supervision (PDF) for church customers under Sec. 30(5) of the EKD Data Protection Act

4.1 Registration Data

When using our live translation platform, we process:

• Email address
• Name
• Organization/congregation (optional)
• Billing address (for paying customers)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

4.2 Usage Data

• Audio streams: Processed in real time. Storage only occurs if the customer activates this feature (e.g., for download or archiving).
• Transcripts and translations: Stored for the customer and can be deleted independently at any time.
• Technical data: IP address, device type, browser information.

4.3 Special Categories of Data

Audio and text data may contain special categories of personal data within the meaning of Art. 9(1) GDPR, insofar as such information occurs incidentally in the transmitted content, without its processing being a purpose of the processing (depending on the type of event, for example information about religious or philosophical beliefs). The platform is not designed to detect, categorize or evaluate such information; it processes the spoken word irrespective of its content.

Processing is carried out on behalf of the customer, who as the controller ensures lawfulness.

4.4 Retention Period

Customers can delete the data of past sessions themselves at any time in the customer portal. Deleting the account removes the associated session, recording and usage data. Invoice and accounting data is retained in accordance with statutory retention periods.

4.5 Cookies

For the protected login area of the platform, we use technically necessary session cookies (legal basis: Art. 6(1)(b) GDPR) to keep the user securely logged in during the session. These cookies become invalid upon logout or when the browser is closed.

5. Contact Form

When you use our contact form, we process:

• First name
• Last name
• Email address
• Your message

The form data is processed via HubSpot (data hosting in the EU, see section 7).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual inquiry) or Art. 6(1)(f) GDPR (legitimate interest in responding).

Retention period: We store your inquiries and related correspondence to be able to refer to previous communication for follow-up questions (legitimate interest under Art. 6(1)(f) GDPR) and to fulfill statutory retention obligations for business correspondence (6 years per § 257 HGB). Non-binding inquiries that do not lead to a business relationship are deleted after the regular limitation period (3 years to the end of the year).

6. Web Analytics with Plausible

We use Plausible Analytics to analyze website usage. Plausible is a privacy-friendly analytics service that:

• Uses no cookies
• Stores no personal data
• Operates exclusively on EU servers
• Requires no consent under the GDPR

Only aggregated, anonymous statistics are collected (page views, referrers, countries, device types).

Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage).

More information: https://plausible.io/privacy

7. Service Providers and Data Transfers

To provide our services, we use the following service providers with whom data processing agreements have been concluded under Art. 28 GDPR:

Where personal data is transferred to countries outside the EU and the EEA, this is based on an adequacy decision of the EU Commission (in particular the EU-US Data Privacy Framework, Art. 45 GDPR) or on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Note on audio routing: For customers based in the EU, exclusively European server routing is used. For international customers, optimized routing is used excluding servers in China.

8. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): You may request information about your stored data.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You may request the deletion of your data, provided no retention obligations apply.
• Restriction (Art. 18 GDPR): You may request the restriction of processing.
• Data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): You may object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent given at any time.

Contact: To exercise your rights, please contact info@streamlingo.net.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20 70173 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de

9. Data Security

We implement technical and organizational measures to protect your data, including:

• Encrypted data transmission (TLS/SSL)
• Encrypted data storage (encryption at rest)
• Access control and two-factor authentication
• Regular security audits

10. Changes to This Privacy Policy

We reserve the right to amend this privacy policy as necessary to adapt it to changes in the legal situation or changes to our services. The version currently published on our website applies.