LETRE PRIVACY POLICY

This Privacy Policy defines the rules for the processing and protection of personal data when using the international service Letre, available at letre.io.

Letre provides services to users from various states.

With respect to persons and processing falling within the territorial scope of Regulation (EU) 2016/679 (GDPR/RODO), personal data is processed in accordance with the GDPR.

With respect to users from other states, the mandatory norms of the respective national data protection legislation may additionally or in place of certain GDPR provisions apply.

The data controller is:

E-mail for personal data matters: info@letre.io

Depending on the service used, Letre may process:

3.1. Contact data

• first and last name;
• email;
• phone number;
• address;
• country;
• preferred contact method.

3.2. Account data

• account identifier;
• authorization data;
• Order history;
• profile settings.

3.3. Document data

Documents provided for translation may contain:

• first and last name;
• date and place of birth;
• citizenship;
• address;
• marital status;
• data of parents and family members;
• identification numbers;
• document numbers;
• signature;
• photograph;
• education and employment information;
• financial information;
• information about legal entities;
• other information contained in the source document.

3.4. Special categories of personal data

Provided documents may contain data on health, racial or ethnic origin, religious or philosophical beliefs, biometric or other special categories of data.

Letre does not request such data without necessity.

If they are contained in a document necessary to perform an Order, their processing takes place only where a corresponding legal basis exists under applicable law.

3.5. Third-party data

Documents may contain data of spouses, parents, children, employees, company representatives and other third parties.

The Client must have a legal basis to transfer such documents to Letre.

3.6. Payment data

Payments are processed via Stripe.

Letre may receive:

• payer name;
• amount;
• currency;
• payment status;
• transaction identifier;
• limited information about the payment method.

Where card data is entered directly within the Stripe infrastructure, Letre does not store the full card number or CVC/CVV.

Stripe and associated financial institutions may independently process additional information necessary to make the payment, prevent fraud and comply with the law.

3.7. Technical data

We may process:

• IP address;
• device information;
• browser;
• operating system;
• date and time of access;
• technical logs;
• cookies and similar identifiers.

Data is processed for:

• registering and maintaining the account;
• providing a preliminary estimate;
• preparing a quote;
• performing the translation;
• interacting with the translator;
• receiving and recording payments;
• providing the completed translation;
• organizing delivery;
• communicating with the Client;
• reviewing claims;
• ensuring the Site's security;
• preventing fraud;
• fulfilling legal obligations;
• establishing, exercising and defending legal claims.

Where the GDPR applies to the processing, the legal bases may be:

1. Art. 6(1)(b) GDPR — processing necessary for the conclusion and performance of a contract;
2. Art. 6(1)(c) GDPR — compliance with a legal obligation;
3. Art. 6(1)(f) GDPR — the legitimate interests of Letre, in particular ensuring security, preventing abuse, protecting legal claims and developing the service;
4. Art. 6(1)(a) GDPR — consent, where processing is based on consent.

For special categories of data, the relevant basis provided by Art. 9 GDPR additionally applies where necessary.

To perform an Order, a document may be transmitted to a translator or a sworn translator.

The translator receives only the information necessary to perform the respective Order.

Depending on the nature of the relationship and legal requirements, the translator may act as a processor on behalf of Letre or as an independent controller with respect to those operations which they are obliged to carry out by law or by their professional duties.

Data may be transmitted to:

• translators;
• hosting and cloud providers;
• IT providers;
• email and communication service providers;
• Stripe and other participants of the payment infrastructure;
• courier and postal operators;
• parcel locker operators;
• accountants;
• legal advisors;
• security service providers;
• government authorities, where disclosure is required by law.

Only the volume of data necessary for the respective purpose is transmitted.

As Letre is an international service and the Operator is located outside the European Union, personal data may be processed or transferred between various states.

Where the GDPR applies and data is transferred from the EEA to a state for which there is no European Commission adequacy decision, Letre uses a transfer mechanism provided by the GDPR where such a mechanism is required.

It may include:

• Standard Contractual Clauses (SCC);
• an adequacy decision;
• other mechanisms provided by Chapter V of the GDPR.

Where necessary, additional organizational and technical measures are applied.

Stripe is used to process payments.

Stripe may process data in various states and act as an independent controller or processor depending on the specific operation.

Data transmitted to Stripe is limited to the information necessary to:

• make the payment;
• confirm its status;
• prevent fraud;
• process a refund, where a refund is required by law;
• fulfill financial and regulatory obligations.

Use of payment services is also governed by the applicable terms and privacy policy of the respective payment provider.

Personal data is kept no longer than necessary for the respective purpose.

The period is determined based on:

• the duration of performance of the Order;
• tax and accounting law requirements;
• statutes of limitations for legal claims;
• the need to review claims;
• requirements for the activity of sworn translators;
• the requirements of the law of the respective country.

Once processing is no longer necessary, the data is deleted, anonymized or securely blocked, unless the law requires its further retention.

Letre recognizes that documents for translation may contain a significant amount of confidential information.

Appropriate technical and organizational measures are applied to protect data from:

• unauthorized access;
• loss;
• destruction;
• unlawful modification;
• disclosure;
• copying;
• other unlawful use.

Access is granted only to persons who need it to perform their respective duties.

Where the GDPR applies to the processing of personal data, the data subject, subject to conditions provided by law, has the right to:

• access the data;
• obtain a copy of the data;
• rectify the data;
• request deletion;
• request restriction of processing;
• object to processing;
• exercise the right to portability;
• withdraw consent;
• lodge a complaint with the competent supervisory authority.

To exercise the right, contact: info@letre.io

Before providing personal data or deleting it, Letre may take reasonable measures to verify the identity of the requester.

If the user is located outside the EU/EEA and the GDPR does not apply to the respective processing, Letre complies with the mandatory requirements of the data protection law applicable to the respective activity.

If local law grants the user mandatory rights of access, rectification, deletion or otherwise managing personal data, such rights may be exercised by contacting: info@letre.io

Nothing in this Policy is intended to limit rights that cannot be limited by contract or a privacy policy.

The Site may use necessary and optional cookies.

Necessary cookies are used for the functioning, security, authorization and basic features of the Site.

Analytical, marketing and other optional cookies are used in accordance with the legal requirements of the user's country and, where required, after obtaining consent.

The user may manage the relevant settings through the cookie management mechanism, if one is used on the Site.

Letre may enable interaction through third-party services, including messengers, payment systems and delivery services.

When the user independently moves to an external service, the respective company may process personal data according to its own privacy policy.

Letre does not make decisions producing legal or similarly significant effects on the user solely on the basis of automated processing, unless expressly communicated to the user.

Letre is not intended for independent use by minors without the involvement of a parent, legal representative or other person with the relevant authority, where such involvement is required by law.

Documents of minors may be processed within a lawfully placed Order.

Letre may disclose personal data to government authorities, courts, law enforcement or regulatory bodies where such disclosure is required by applicable law or a legally binding request.

The Policy may be updated due to changes in:

• legislation;
• the geography of service provision;
• technologies used;
• service providers;
• payment methods;
• the functionality of Letre.

The current version is published on the Site indicating the date of the latest update.

For privacy and personal data processing matters: