Data Processing Agreement

Plain-language summary

1. What the DPA covers

Where Lingu processes personal data on behalf of a customer (for example, an organisation whose learners use Lingu English), that processing is governed by a Data Processing Agreement (“DPA”) that meets the requirements of Article 28 of the UK GDPR and the EU GDPR. The DPA sets out the subject matter and duration of processing, the nature and purpose of processing, the categories of data subjects and personal data, the security measures, sub-processor terms, international-transfer safeguards, audit rights, and the return or deletion of data at the end of the engagement.

2. Where to find the DPA and sub-processor list

To keep the agreement and its sub-processor list accurate and version-controlled, the full DPA text and the current list of sub-processors are provided inside the application and require authentication. Signed-in account holders and customer administrators can review, download, and where applicable accept the DPA, and can view the up-to-date sub-processor register, from within their account. They are not published on this public page because they are kept current in the authenticated environment and may differ by customer engagement.

3. Controller and processor roles

For personal data Lingu processes to provide the Service to individual learners, Lingu Ltd (formerly Perfectly Spoken Ltd), registered in England and Wales under company number 09197891, is the data controller — see the Privacy Policy. Where Lingu processes personal data on documented instructions on behalf of a customer organisation, Lingu acts as processor and that relationship is governed by the DPA referenced in section 1.

4. Questions about the DPA

If you have a question about the Data Processing Agreement or need access to it before signing in — for example, a procurement or data-protection team carrying out due diligence — contact us using the form below or email [email protected]. See also the Legal & compliance centre.