Data protection notice

No data protection officer has been appointed, as fewer than 20 persons in our organisation are constantly engaged in the automated processing of personal data (Section 38(1) of the Federal Data Protection Act (BDSG)).

This data protection notice applies to

• our website prodoc-digital.com and
• the processing of data of our clients, prospective clients and their contact persons in connection with enquiries, quotations and engagements for consulting and translation (section 6).

The former PRODOC Translations GmbH no longer exists; the controller for our websites and all engagements is PRODOC Digital GmbH.

The legal framework is formed by the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and, for cookies and comparable technologies, the Telecommunications Digital Services Data Protection Act (TDDDG).

We process only the data we need for the respective purpose and, where it is within our own control, on our own servers in Germany. Where we use service providers, we name them in the following sections.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access to stored data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure under certain circumstances (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• OBJECTION (ART. 21 GDPR) – You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process this data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a data protection supervisory authority (Art. 77(1) GDPR)

Where data is subject to a statutory retention obligation, we restrict its processing until the retention period expires instead of erasing it. To exercise your rights, an informal message to the contact details in section 14 is sufficient.

4.1 Delivery and server log data

Each time our website is accessed, the following data is collected automatically:

• IP address
• Date and time of access
• Page/URL accessed
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer URL (previous page)

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the technical provision of the website and the security of our systems, including the investigation of misuse.
Purpose: Technical provision of the website, ensuring system security.
Retention period: 7 days, followed by automatic erasure. The log data is not analysed statistically.

4.2 Delivery via Cloudflare

Our website is delivered via Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare also handles the forms on our website, the sending of the associated emails and their spam protection (sections 5.1 and 5.2).

The following data is processed:

• IP address
• Browser information (user agent, language, version)
• URLs accessed and timestamps
• Technical connection metadata (TLS handshake, ASN)

Purpose of processing: Provision and maintenance of the website, protection against DDoS attacks and bots, faster delivery via Cloudflare's global network, ensuring system stability.

Legal basis for processing: Art. 6(1)(f) GDPR (legitimate interest in the secure, fast and stable provision of the website).

Retention period: Cloudflare does not store log data for longer than is necessary to detect and defend against attacks; for details, see Cloudflare's data protection policy.

Data transfers to third countries: see section 8.

Processing on behalf of a controller: A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Cloudflare.

Further information: https://www.cloudflare.com/de-de/privacypolicy/

4.3 Cookies and storage on your device

Cookies are small text files that are stored on your device and allow your browser to be recognised. The same applies to comparable technologies (e.g. local storage in the browser).

We use only technically necessary cookies. For this reason, we do not use a cookie banner or any tool for managing consent.

Specific cookies in use:

• Cloudflare cookies (e.g. __cf_bm, cf_clearance): serve security (bot protection, protection against DDoS attacks) and performance.
• Spam protection for forms (Cloudflare Turnstile): evaluates technical characteristics of your browser on submission in order to detect automated entries.
• Session cookies, where our server technology requires them: store temporary session information and are deleted when the browser is closed.

Not used: marketing cookies, analytics and tracking cookies, social media cookies.

Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary storage) and, for the associated processing of personal data, Art. 6(1)(f) GDPR (legitimate interest in the secure and functional provision of the website).

You can delete or block cookies in your browser at any time; individual functions, such as submitting a form, may then be restricted.

4.4 No analytics, advertising or tracking services

On our website, we do not use web analytics, conversion tracking for advertisements or services for identifying visiting companies. We do not embed maps, videos, fonts or other content from third-party providers; all content is delivered from our own systems or via Cloudflare. No data is transferred to third-party providers for tracking purposes.

4.5 LinkedIn and links to other websites

We maintain a company presence on LinkedIn, a platform of LinkedIn Ireland Unlimited Company (Wilton Park House, Wilton Place, Dublin 2, Ireland), and link to LinkedIn profiles on our website. The links are simple references; data is only transferred when you click on a link.

The following data is processed by LinkedIn: location data and technical information about the device; profile data, networking data, usage data; interactions with our company page (posts, likes, comments).

Purpose: Presentation of our company and analysis of the reach of our company page (Page Insights).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting and optimising our presence); where LinkedIn obtains consent, Art. 6(1)(a) GDPR.

Joint controllership: We are joint controllers with LinkedIn for the Page Insights (Art. 26 GDPR, LinkedIn's Joint Controller Addendum). You can exercise your rights both with us and with LinkedIn.

Data transfers to third countries: see section 8.

Further information: https://www.linkedin.com/legal/privacy-policy, https://legal.linkedin.com/pages-joint-controller-addendum

5.1 Contact form and email

Data processed: name, email address, telephone number (optional), company (optional), content of the message, time of the enquiry; for the form, additionally the IP address to prevent misuse.

Procedure: Forms on our website are received via Cloudflare and delivered as an email to our mailbox. Our email mailboxes are hosted by Microsoft (Microsoft 365, addresses at prodoc-digital.com and prodoc-translations.com) and by Migadu (Switzerland, addresses at prodoc.de).

Legal basis: Art. 6(1)(b) GDPR, where your enquiry is aimed at a quotation or a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry and in protecting the form against misuse).
Purpose: Handling your enquiry and any follow-up questions.
Retention period: 3 years after the communication has ended; if the enquiry leads to a quotation or an engagement, the periods in section 9 apply.

5.2 Requesting the Intent-Chat-Skill

On the ‘Intent-Chat-Skill’ page of prodoc-digital.com, you can fill in a form to receive the Intent-Chat-Skill by email.

• Data: first name, surname, email address and company; optionally also your role. The time of submission and the IP address are recorded technically to prevent misuse.
• Purpose: Sending the requested skill. If you have also given your consent, we will additionally use your address to contact you about Intentron and AI-assisted software development.
• Legal basis: For sending the skill, Art. 6(1)(b) GDPR; for contacting you beyond that, Art. 6(1)(a) GDPR (your explicit consent); for preventing misuse, Art. 6(1)(f) GDPR (protecting the form against automated entries).
• Recipients: PRODOC Digital GmbH and Owlist GmbH, which develops the Intentron framework. The emails are sent technically via Cloudflare, Inc. as processor pursuant to Art. 28 GDPR; spam protection is provided via Cloudflare Turnstile.
• Retention period: Without consent to be contacted, we erase your data no later than six months after sending. With consent, we store it until you withdraw your consent.
• Withdrawal of consent: at any time and informally, for example by email to info@prodoc.de. The lawfulness of the processing carried out up to that point remains unaffected.

5.3 Appointment booking (Cal.com)

To book discovery calls and consulting appointments, we use Cal.com, provided by Cal.com, Inc. (2261 Market Street #4382, San Francisco, CA 94114, USA).

• Data: name, email address, telephone number (optional), selected appointment and time zone, additional details in the booking form, technical connection data (IP address, browser).
• Purpose: Scheduling and managing appointments, confirmation and reminder emails, calendar synchronisation.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure) and Art. 6(1)(f) GDPR (legitimate interest in the efficient organisation of appointments).
• Retention period: 24 months after the appointment; if a contract is concluded, the periods in section 9 apply.
• Processing on behalf of a controller and third country: DPA pursuant to Art. 28 GDPR; for the transfer to the USA, see section 8.
• Further information: https://cal.com/privacy

This section applies to prospective clients and clients of PRODOC Digital GmbH and their contact persons in connection with enquiries, quotations and engagements for consulting, implementation, training and translation.

6.1 What data we process

• Contact and master data: name, company, position, business address, email address and telephone number of contact persons.
• Quotation and contract data: quotations, engagement confirmations, scope of services, dates, proof of services rendered.
• Billing data: invoices, payment data, VAT identification number.
• Communication: emails, notes of conversations, minutes; recordings of conversations only with consent (section 6.6).
• Documents and texts of the engagement: source texts, translations, terminology, consulting project documents.

As a rule, we receive data about contact persons from those persons themselves; where the client names further contact persons or hands over documents containing names, the data originates from the client.

6.2 Purposes and legal bases

6.3 Translation engagements

We handle translations in a self-hosted translation environment (memoQ) on our own servers in Germany. For machine translation, we use only DeepL Pro from DeepL SE (Cologne) there. Under its contractual terms, DeepL uses the transmitted texts only to provide the translation for us and stores them only temporarily, in exceptional cases for troubleshooting for up to 72 hours; a data processing agreement is in place with DeepL. The results are checked by qualified translators. We will only integrate further machine translation services once they are named in this data protection notice.

We translate finished documents such as manuals, technical documentation and marketing materials. These contain personal data to a small extent at most, for example names in author, review or approval notes. We retain the texts, the translations and the resulting translation memories and terminology databases without time limit, so that you can retrieve earlier engagements and we can keep terminology consistent; any such names remain part of the text. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the retrievability of earlier engagements and in consistent terminology).

If your documents contain further personal data (for example personnel records, client or participant lists), please inform us before commissioning us. We then process this data as your processor on the basis of a contract pursuant to Art. 28 GDPR and erase it after the period agreed therein (section 9). You can exclude the use of machine translation and other AI tools for an engagement before the contract is concluded.

6.4 Translators and subject-matter reviewers

We work with qualified freelance translators and subject-matter reviewers in many countries, including outside the European Union. They work exclusively via a personal login on our memoQ server in Germany; your documents do not leave this server. All translators and subject-matter reviewers are bound to confidentiality and receive only the data they need for their part of the engagement.

Where documents contain personal data, we assign them only to translators and subject-matter reviewers in the EU or the European Economic Area, in countries with an adequacy decision of the European Commission or on the basis of EU standard contractual clauses, and only within the scope of the data processing agreement with you (section 8).

6.5 AI tools in consulting

In consulting, we preferably use AI models that we run ourselves on our own systems. We use cloud services from AI providers for confidential information and personal data of our clients only if a data processing agreement pursuant to Art. 28 GDPR is in place with the provider and, under that agreement, the provider may process the data only to provide the service to us and, in particular, not to train its own models. Some of these providers are based in the USA (section 8). We will tell you on request which providers we currently use.

6.6 Online meetings and recording of conversations

Microsoft Teams. For online consulting sessions, webinars and workshops, we use Microsoft Teams, a service of Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) or Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA). IP address and device data, profile and content data (audio, video, chat, shared files) and usage data (duration of participation, connection metadata) are processed. The legal basis is Art. 6(1)(b) GDPR where the meeting serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient communication with clients and partners). Microsoft is a processor on the basis of the Microsoft Product Terms with Data Protection Addendum. Further information: https://privacy.microsoft.com/de-de/privacystatement

Recording with tl;dv and Hedy. We only record conversations after all participants have been informed and have expressly consented. For this purpose, we use

• tl;dv from tldx Solutions GmbH (Aachen) for recording, transcription and summarisation; the recordings are stored in the European Economic Area, their AI analysis takes place in the EU in accordance with our settings, and sub-processors based in the USA may be involved; according to its own statements, tl;dv does not use recordings, transcripts or notes to train AI models (Further information: https://tldv.io/privacy), and
• Hedy from Hedy AI LLC (Portland, USA) for AI-assisted notes during the conversation; the conversation data is stored in the EU and, according to Hedy, is not used to train AI models; because the provider is based in the USA, access from the USA cannot be ruled out (Further information: https://www.hedy.ai/privacy).

Audio and video recordings or audio streams, transcripts, automatically generated notes, summaries and tasks, the name and email address of the participants and conversation metadata (duration, time, platform) are processed. The purpose is the traceable documentation of the consulting work (minutes, task lists) and, on request, making it available to the participants. The legal basis is solely your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Data processing agreements pursuant to Art. 28 GDPR are in place with both providers. You can object to the recording at any time; the conversation will then take place without AI-assisted documentation.

We erase audio and video recordings no later than twelve months after the conversation. We file transcripts and summaries as part of the engagement documents in our file storage (section 6.7); the period in section 9 applies to them.

6.7 Where we store data

• Own servers at Hetzner in the Falkenstein data centre (Germany): memoQ translation environment, client management, internal wiki, storage of client documents.
• Backups of these servers in a Hetzner Storage Box, also in Falkenstein.
• Own network-attached storage system (NAS) on our business premises in Goslar for client documents, engagement folders and transcripts of conversations, without cloud backup and without remote access via the manufacturer.
• Email with Microsoft 365 and Migadu (section 5.1).

Hetzner is bound as a processor pursuant to Art. 28 GDPR.

6.8 Obligation to provide data

Providing contact and billing data is necessary for the quotation, the conclusion of the contract and invoicing; without it, we cannot prepare a quotation or carry out an engagement. Provision of the data is not required by law. Consent to the recording of conversations is voluntary.

We only pass on your personal data in the following cases:

Data is not passed on for advertising purposes.

We generally process your data in the EU or the European Economic Area. In the following cases, data is transferred to third countries or access from third countries is possible:

• USA, on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (certification of the provider), supplemented by EU standard contractual clauses: Cloudflare (section 4.2) and LinkedIn (section 4.5; LinkedIn carries out the transfer itself).
• USA, on the basis of EU standard contractual clauses: Microsoft (sections 5.1, 6.6), Cal.com (section 5.3), Hedy (section 6.6; storage in the EU, provider based in the USA), sub-processors of tl;dv (section 6.6) and the providers of AI services (section 6.5; our contractual partners there are companies in Ireland whose parent companies are based in the USA).
• Switzerland: Migadu (section 5.1), on the basis of the European Commission's adequacy decision for Switzerland.
• Other countries: Translators and subject-matter reviewers outside the EU access our server in Germany (section 6.4). Where this concerns personal data, access takes place only from countries with an adequacy decision or on the basis of EU standard contractual clauses.

You can obtain a copy of the respective safeguards on request via the contact details in section 14.

Our self-hosted systems (translation environment, client management, wiki, file storage, backups) process data exclusively in Germany.

We erase personal data as soon as the purpose of the processing no longer applies and no statutory retention periods prevent erasure. Periods linked to a calendar year begin at the end of that year.

Our website uses TLS encryption for all data transfers; you can recognise this by the ‘https://’ in the address bar of your browser. Data transfer over the internet, for example by unencrypted email, may nevertheless have security vulnerabilities; complete protection against access by third parties is not possible.

Technical measures: encryption of all data transfers, regular security updates, firewall protection, secure server configuration, personal login for every access to the translation environment, backups.

Organisational measures: access authorisation concept, regular staff training, confidentiality undertaking by all staff, translators and subject-matter reviewers, documented data protection processes, procedures for security incidents.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. AI tools and machine translation support our work and do not make any decisions about you.

Our website is not directed at persons under 16 years of age. We do not knowingly process personal data of children under 16.

We adapt this data protection notice when the legal situation or our services and service providers change. The current version can always be found on our website; we will send you earlier versions on request.

The German version of this data protection notice is authoritative. Translations are provided for information only; in the event of any discrepancy, the German version shall prevail.

Date of this data protection notice: 27 October 2026