Data Processing Terms

These terms are part of our Terms of Service. They apply only when, and only to the extent that, we process personal data on your behalf to provide the service — for example, personal data in a recording you ask us to transcribe.

They do not cover personal data we process for our own purposes: running your account, sign-in, billing and payments, preventing fraud and abuse, keeping the service secure and working, and keeping the records the law requires. We decide how that data is used, and our Privacy Notice explains it.

1. What these terms cover

Customer Personal Data means personal data in the files you upload to Jinova, and in the results a job produces from them, that we process on your behalf to provide the service you ask for.

Data protection law means the UK GDPR, the Data Protection Act 2018, and any other data protection law that applies to the processing.

The Schedule at the end of these terms describes the processing: its subject matter and duration, its nature and purpose, the types of personal data involved, and the people it concerns.

2. Who decides what

You decide why Customer Personal Data is processed. For that data you are the controller — or, where you act for another organisation, you are a processor for that organisation, which is the controller.

We process Customer Personal Data on your behalf, only to provide the service you asked for. We act as your processor, or as your subprocessor where you are yourself a processor.

These roles follow from who decides why and how the data is processed, not from the labels in these terms.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are these terms, the rest of our Terms of Service, and the jobs you submit — the tool you choose, the files you give it and the settings you select, through the console or any other way we offer to submit them.

The only exception is where the law requires us to process it in another way, including to transfer it. If that happens, we will tell you before we do so, unless the law prohibits telling you.

If we think an instruction breaks data protection law, we will tell you immediately, and we do not have to follow it.

4. Your responsibilities

You are responsible for the processing you ask us to do being lawful. That includes having the legal right to provide Customer Personal Data to us and to have it processed through Jinova — an appropriate lawful basis, and any notices, permissions or consents the law requires — and meeting any additional condition the law sets for special-category or criminal-offence information. We do not decide your lawful basis for you.

Where you are a processor acting for another organisation, you confirm that its instructions allow what you ask us to do, including our use of the subprocessors described below.

Your use must also comply with our Acceptable Use Policy.

5. Confidentiality and security

We make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

We take appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to the people concerned. The measures in place when these terms took effect are described in the Schedule.

6. Subprocessors

You give us general authorisation to use subprocessors: the providers our Service Providers & Subprocessors page identifies as receiving your uploaded files, to process Customer Personal Data as that page describes.

Before a subprocessor processes Customer Personal Data, we put in place a contract that imposes on it data protection obligations giving the same protection as these terms, including sufficient guarantees of appropriate technical and organisational measures. Where a subprocessor fails to meet those obligations, we remain responsible to you for its performance of them, to the extent data protection law requires.

Changes. Before we add or replace a subprocessor that receives your uploaded files, we will update that page at least 30 days before it starts processing Customer Personal Data. If a change is needed urgently to keep the service secure or available, we will update the page as soon as we reasonably can.

Objecting. You may object to a change on reasonable grounds relating to data protection, using the Privacy or data request option on our support page. We will discuss your objection with you in good faith. If we cannot reasonably resolve it — for example by not using that subprocessor for your jobs — you may stop using the affected part of the service, and unused credit you paid for can be refunded on request, as our Credit & Refunds policy describes.

7. Transfers outside the UK

We will transfer Customer Personal Data outside the UK, or allow a subprocessor to, only in compliance with data protection law — for example to a country the UK recognises as providing adequate protection, or with appropriate safeguards that data protection law recognises.

8. Helping you meet your obligations

Requests from individuals. Taking into account the nature of the processing, we help you, by appropriate technical and organisational measures where possible, to respond to people exercising their data protection rights. The console lets you find, download and delete your jobs’ files and results yourself. If someone asks us directly about Customer Personal Data, we will not answer the request ourselves: we will tell them to contact you, and let you know about the request where we can identify you.

Security, breaches and impact assessments. Taking into account the nature of the processing and the information available to us, we help you meet your obligations on the security of processing, on personal data breaches, on data protection impact assessments, and on consulting the Information Commissioner’s Office.

Personal data breaches. If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and give you the information we have that you reasonably need to meet your own obligations.

9. Deletion and return

You can download your results, and delete a job’s files and results, whenever the console allows it. Content is also scheduled for deletion once its retention period has passed, as our Privacy Notice describes, and a deletion attempt that fails is retried.

When we stop providing the service to you, we delete the Customer Personal Data that remains on that schedule, unless the law requires us to keep it; download anything you want to keep before then. Records we keep for our own purposes, such as billing records, are not Customer Personal Data, and are kept as our Privacy Notice describes.

10. Information and audits

We will make available to you the information reasonably necessary to show that we meet our obligations under these terms, including by answering reasonable written questions. We will allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice and at reasonable intervals, subject to appropriate confidentiality and to protecting the security of the service and of other customers’ data.

11. If we act outside your instructions

If we were to decide for ourselves why or how Customer Personal Data is processed, we would be a controller for that processing, and responsible for it as a controller is under data protection law.

12. How these terms fit with the rest

These terms apply for as long as we process Customer Personal Data on your behalf. If they conflict with anything else in our Terms of Service about the processing of Customer Personal Data, these terms take priority.

Schedule: the processing

Subject matter. Providing the compute services you request through Jinova: running the tools you choose on files you upload, and returning the results.

Duration. For as long as needed to provide the service you requested, and then until the content is deleted under the retention and deletion process in our Privacy Notice.

Nature and purpose. Storing files and results; inspecting files to check they can be processed; running the tool you chose on compute infrastructure; checking results before you are charged; making results available to you; and deleting content. The only purpose is to provide the service you asked for.

Transcription, step by step. When you ask for a transcript we store your recording in private storage; read bounded parts of it to identify its format and measure its duration, which decides whether it can be accepted and what it costs; transfer it, through time-limited links, to the compute infrastructure that transcribes it; produce a transcript and timed segments, with the language detected; verify the result before you are charged; make the transcript and segments available only to you, after you sign in; and delete the recording and the results under the retention and deletion process.

Types of personal data. Whatever personal data your content contains, which may include: audio and video recordings; images and video, where other tools are used; speech and voice; transcripts; timed segments and language information derived from recordings; personal data about other people contained in your content; and special-category information, where your content contains it. Transcription does not identify anyone from their voice.

People concerned. Your personnel; your customers or users; people who appear or speak in content you upload; and other people described in that content.

Security measures. Uploaded files and results are held in private storage that is not publicly accessible. Access to a file is given through short-lived links for that one file: an upload link lasts one hour, a download link fifteen minutes, and the links the compute infrastructure uses to read an input and write a result six hours. Customers can reach only their own jobs and files, after signing in. Where our service reads a file itself, it reads only what it needs for that purpose, and keeps none of the file content it reads. Transcript text is not written to our logs, analytics or operational records. Connections to Jinova and to the services we use are encrypted in transit, and access to our systems is restricted to people who need it.

Subprocessors. The providers our Service Providers & Subprocessors page identifies as receiving your uploaded files.