TranslationOS

GDPR overview

Compliance is claimed explicitly: the privacy policy opens by invoking Regulation (EU) 2016/679 and Italian data protection law. The controller is Translated S.r.l., Via Indonesia 23, Rome, and a Data Protection Officer is named, Simone Giovanni Perone, reachable at dpo@translated.com. Processing rests on consent for site visitors and on Article 6 for client data. Listed rights cover access, origin, rectification, erasure, anonymisation, blocking, portability and complaint to the supervisory authority. Two gaps stand out. The policy was published and last updated on 25 May 2018 and still justifies non-EU transfers under Privacy Shield decision 1250/2016, which Schrems II invalidated in July 2020. And no data processing agreement or subprocessor list is published anywhere on the site. No Article 27 representative is designated, which is consistent, since the publisher is established in the European Union.

Who owns the data?

Translated's sales conditions are silent on who owns the delivered translation: no assignment and no licence clause appears. The only ownership statement is a negative one, namely that until the invoice is paid any partial or total reproduction of the translation is deemed illegal, with the publisher reserving the right to claim payment and copyright compensation. On confidentiality the commitment is broader. Source texts, the nature of the work performed, personal data submitted for translation and any information transmitted by the client are held under the strictest confidentiality. Disclosure to third parties requires the client's prior written consent, except to authorised employees and to authorised subcontractors whose intervention requires it.

Reuse rights

The sales conditions give the client no explicit licence over the delivered translation, and set out no explicit restriction on reusing it either, beyond one condition: reproduction remains illegal while the invoice is unpaid. In practice a client who has paid uses the translation as their own content, but nothing in writing confirms it, which matters for regulated or high-value material. Quality claims are tightly framed. Complaints are admissible only by registered letter with return receipt within seven days of delivery, after which the translation is considered correct, and liability is capped at the invoice amount. Disputes fall to the courts of Rome and only written agreements are taken into account. Inside the platform the client supplies translation memories, glossaries, context and instructions, and approved translations are fed back into the publisher's AI.

Data retention & training

Hosting summary

The privacy policy states that data collected through the site is processed at the controller's headquarters and at the web host's data centre. One host is named as a processor: Hitachi CBT, described as located in the European Economic Area and operating to European standards. No specific country is identified, so the record carries a region rather than a country. Transfers outside the European Union are acknowledged towards Google, Facebook and Microsoft through social plugins and analytics, still justified under Privacy Shield decision 1250/2016, a basis invalidated in July 2020. Governing law is Italian and commercial disputes fall to the courts of Rome. The public site itself is served through Amazon CloudFront, so the resolved server address reflects an edge node rather than any storage location. The platform and its API run on separate hosts, both named in the vulnerability disclosure scope. No hosting information specific to this platform is published: the policy addresses the main website.