Data Privacy Framework (DPF) Policy

< BACK

EU STANDARD CONTRACTUAL CLAUSES AND THE DATA PRIVACY FRAMEWORK (DPF)

As a global provider of language, translation, interpretation, testing and other commercial services, Lionbridge Technologies, LLC. (“Lionbridge”) is trusted by its customers, employees and vendors to safeguard the confidentiality and integrity of their content in any language and locale. Lionbridge has deployed a variety of measures to ensure that this content is protected appropriately and is transferred in accordance with applicable law. When that content consists of “personally identifiable information” or “Personal Data”, Lionbridge has implemented special procedures for processing, storage and transfer of Personal Data that are designed to meet the requirements of the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). These procedures are detailed in this Privacy Policy, and applies to all Personal Data that Lionbridge processes, transfers or stores, whether from employees, vendors or customers.

Generally, in the course of its business, Lionbridge will have access to Personal Data consisting of personnel information related to its Personnel and business contact information of its Business Contacts and Contractors (“Business Contact Information”) or any such information that is contained in materials provided to Lionbridge for the purpose of obtaining translation, interpretation, testing or other commercial services.

In addition to adopting the Data Privacy Framework (DPF), Lionbridge has also elected to adopt the EU Standard Contractual Clauses (Processors) with respect to the transfer of Personal Data from the European Union to the United States of America.

In adopting and complying with the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, Lionbridge adheres to the guidelines outlined in the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the US U.S. Department of Commerce regarding the collection, use, and retention of Personal Data transferred from the European Union, United Kingdom and Switzerland to the United States. Furthermore, Lionbridge has certified to the U.S. Department of Commerce that it adheres to the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Principles.

In the event of any conflict between this Privacy Policy (the “Policy”) and the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Principles, the terms of the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Principles shall govern. For additional information about the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, and to view our certification, please visit https://www.dataprivacyframework.gov.

Lionbridge’s practices with respect to the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF are certified and reflect the current guidelines as outlined in the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Framework. In the event of any changes to the Data Privacy Framework (DPF), including the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Framework, Lionbridge undertakes to update and circulate this Policy.

INDEPENDENT RESOURCES FOR PRIVACY COMPLAINTS

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Lionbridge commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

If the complaint concerns Personal Data that consists of Human Resources data, in accordance with the Data Privacy Framework (DPF) Supplemental Policy for HR Data, we resolve to deal with all questions regarding HR Data and potential concerns arising from it in a timely manner. In the event that Lionbridge is unable to accommodate a European Union, UK or Swiss employee’s request regarding HR Data, Lionbridge further commits to working with the EU Data Protection Authorities (“DPA”), The UK Information Commissioner's Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) that cover the jurisdiction from which the HR Data originated, and comply with the advice given by such authorities with regard to HR Data transferred from the EU, UK and Switzerland in the context of the employment relationship. For information on how to contact your jurisdiction’s DPA, visit https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-are-data-protection-authorities-dpas-and-how-do-i-contact-them_en.

For information on how to contact your jurisdiction’s FDPIC, visit https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/links/data-protection---switzerland.html.

For information on how to contact the ICO in the UK, visit https://ico.org.uk/global/contact-us/ .

As further explained in the Data Privacy Framework (DPF) Principles, binding arbitration mechanism is available to address residual claims not resolved by any of the other Data Privacy Framework (DPF) mechanisms, if any.

SCOPE

This Policy applies to all Personal Data received by Lionbridge in any format, irrespective of country of origin or transfer, or citizenship of the Data Subject.

NOTICE

Lionbridge treats all Personal Data received from any individual, including but not limited to Personnel, Business Contacts and Vendors, as confidential. Lionbridge notifies all identified Data Subjects regarding the types of Personal Data collected and its intended uses. Lionbridge does not use Personal Data for purposes that are incompatible with the Data Privacy Framework (DPF).

Lionbridge works with a global network of freelance Vendors in performance of translation, interpretation, testing, consulting and localization services. These Vendors may be exposed to Personal Data in performance of these services. However, they are at all times subject to confidentiality agreements and are authorized only to use such information within the scope of performance of the services. All Vendors handling Personal Data must also agree to the EU Standard Contractual Clauses.

When Lionbridge handles Personal Data received directly from Personnel in the EEA, it will inform the Personnel regarding the type of Personal Data being collected, the purpose for collecting the information, the types of Personnel and Third Parties likely to be exposed to this information in performance of services, and that individual’s choices in limiting such exposure.

Any Contractor has the right to terminate its working relationship with Lionbridge and request the deletion of Personal Data pertaining to them in accordance with applicable law. However, Lionbridge will continue to maintain Personal Data in accordance with its Privacy Notices and in accordance with Lionbridge records retention policies and local laws and regulations. This practice is in the best interests of both parties so that identifying information relating to a particular matter is accessible but sufficiently discrete so that Lionbridge does not accidentally contact them for projects in the future.

Lionbridge may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

CHOICE

Lionbridge’s Personnel and Business Contacts have the opportunity to opt out from allowing Lionbridge to Process Personal Data for a purpose other than its original purpose. Lionbridge will not disclose Personal Data to any Third Party for the purposes of any direct marketing of products or services without permission of Lionbridge’s Personnel or Business Contacts, or providing an opportunity to opt out of receiving the direct marketing.

Personnel can ask questions and exercise his or her rights with respect to Personal Data by: (i) if the Personnel has a Lionbridge e-mail address, by going to the Lionbridge support portal, and (ii) if the Personnel does not have a Lionbridge e-mail address, by contacting Lionbridge at data-privacy@lionbridge.com. Business Contacts can ask questions and exercise his or her rights with respect to Personal Data by contacting Lionbridge at data-privacy@lionbridge.com. However, Lionbridge will continue to maintain Personal Data in accordance with its Privacy Notices and in accordance with Lionbridge records retention policies and local laws and regulations.

With regard to Personal Data that Lionbridge receives in connection with the employment or business relationship, Lionbridge will use such Personal Data only for the purpose for which it was originally collected. If Lionbridge intends to disclose Personnel Personal Data to a Third Party for any purpose other than its original purpose, Lionbridge will provide the Personnel or Business Contact with an opportunity to opt-out of such uses.

ONWARD TRANSFER

Lionbridge will obtain assurances from Third Parties and Vendors that they will safeguard Personal Data consistent with this Policy. Lionbridge will take all precautions with respect to this Policy to prevent, contain, or stop disclosure contrary to such entity’s confidentiality obligations. Lionbridge will remain liable if a Third Party or Vendor processes such Personal Data in a manner inconsistent with the Data Privacy Framework (DPF) Principles, unless Lionbridge proves that it is not responsible for the event giving rise to the damage.

ACCESS AND CORRECTION

Lionbridge will provide individuals with reasonable access to the Personal Data they have provided to Lionbridge and will allow them to review and correct this Personal Data as required by the Data Privacy Framework (DPF) Framework. Access to review this Personal Data will be granted in accordance with applicable law, and except where the burden or expense of providing access would be disproportionate to the risks to the Personnel’s privacy or where the rights of others would be violated.

Lionbridge conducts a periodic assessment in order to verify that this Policy is published, accurate, comprehensive, prominently displayed, implemented, accessible and conforms to the principles of the EU General Data Protection Regulation. Lionbridge maintains procedures for training Personnel in the implementation of the Policy and has in place internal procedures for periodically conducting objective reviews of compliance.

DATA INTEGRITY

Lionbridge ensures that all applicable Personal Data is accurate, complete, current and reliable for its intended use. All Personnel should help Lionbridge meet this objective by updating their information immediately in the event that Personal Data changes, either by notifying the local HR Representative, or other applicable contact person designated by Lionbridge, or updating the information themselves, if applicable. To the extent feasible, Lionbridge restricts access to Personal Data to those Personnel or Agents of Lionbridge that have a legitimate business need for such access.

DATA SECURITY

Lionbridge undertakes to protect Personal Data using commercially reasonable organizational, technical and administrative procedures to protect against unauthorized or unlawful access, processing, disclosure, alteration, destruction or accidental loss of your personal data. These precautions include password protections for online information systems and restricted access to Personal Data. Lionbridge may assign different types of data different security levels, with appropriate corresponding security precautions. Lionbridge also restricts access to Personal Data to those Personnel or Agents of Lionbridge that have a legitimate business need for such access.

ENFORCEMENT

Lionbridge ensures to internally verify adherence to this Policy once per year as part of its annual review and internal compliance measures. Lionbridge will use its best commercial efforts to ensure that compliance with this policy is followed and that the Policy remains accurate, comprehensive, and in conformance with the Data Privacy Framework (DPF) Framework.

In the event that any issues pertaining to this Policy cannot be resolved internally, Lionbridge agrees to adhere to the dispute resolution processes as outlined in the Data Privacy Framework (DPF) Framework.

Lionbridge is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

In compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, Lionbridge is committed to informing individuals about the types or identities of third parties to whom we disclose personal data and the purposes for which we do so.

We may disclose customer personal data to the following categories of third parties:

1.       Service Providers and Processors

We might share personal data with trusted third-party vendors and service providers who perform services on our behalf, such as payment processing, communications, linguistic services, marketing, analytics, and product development. These entities are contractually obligated to process data only as instructed by us and in compliance with applicable data protection laws and the Data Privacy Frameworks.

These third parties are authorized to process personal data only as necessary to provide their services and are contractually bound to use the data in accordance with applicable privacy laws and the Data Privacy Framework Principles.

2.       Business Partners

In limited cases, we may share data with business partners to jointly offer products or services. These partners are required to use the information only for the specific purposes for which it was provided and in accordance with applicable privacy commitments.

3.       Affiliates

We may share personal data with our corporate affiliates for internal administrative purposes, customer support, and to provide consistent services across our organization. All such processing is conducted under strict data protection obligations.

4.       Legal and Regulatory Disclosure

We may disclose personal data when required to do so by law or legal process, such as in response to a subpoena, court order, or lawful request by public authorities (including to meet national security or law enforcement requirements).

5.       Mergers, Acquisitions, or Corporate Transactions

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred as part of the transaction, as permitted by law and in accordance with applicable privacy safeguards.

Each disclosure is made for specific purposes including providing and improving our services, ensuring security and compliance, processing transactions, managing customer relationships, and fulfilling contractual obligations.

We remain responsible for the processing of personal data we receive under the Data Privacy Frameworks and subsequently transfer to a third party acting as an agent on our behalf. We ensure that any such third party provides at least the same level of protection as required by the Data Privacy Framework Principles.

GENERAL DEFINITIONS

"Agent" means a Third Party that Processes Personal Data solely on behalf of and under the instructions of Lionbridge.

"Business Contact" means a current, past, or prospective customer of Lionbridge or any of its subsidiaries and other individuals with whom it is, has been or may be engaged in commercial relationships.

"Vendor" means an individual who, as a non-employee and under contract with Lionbridge, provides translation and/or other services to Lionbridge.

"Data Subject" is an identified or identifiable natural person.

"Personal Data" is any information that is recorded in any form relating to an identified or identifiable natural person.

"Personnel" refers to any employee, former employee, job applicant, director or Vendor of Lionbridge or its subsidiary companies.

"Process (-ing, -es, -ed)" means to perform any operation or set of operations which is performed upon Personal Data or on sets of Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

"Third Party" is any natural or legal person, public authority, agency or any other body other than the Data Subject, Lionbridge, Agent or Vendor.

Effective July 2025

< BACK