GDPR Compliance

1. Introduction

i18n Agent is committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR). This document outlines how we comply with GDPR requirements and your rights as a data subject.

i18n Agent is a product and trading name of FatCouple OÜ, a private limited company (osaühing) incorporated in Estonia under registry code 14261112 and registered in Tallinn, Estonia. FatCouple OÜ is the data controller responsible for all personal data processed through i18n Agent, including personal data received from partner platforms such as Klaviyo, Shopify, Webflow and GitHub. Any reference in this document to "i18n Agent", "we", "us" or "our" means FatCouple OÜ.

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance, Article 6(1)(b) GDPR: to provide the translation services and the integrations you connect, and to take payment for them.
• Legitimate interests, Article 6(1)(f) GDPR: to secure the service, prevent fraud and abuse, and improve service quality and our AI models. You may object to this processing at any time.
• Consent, Article 6(1)(a) GDPR: for marketing communications, where you have opted in. You may withdraw consent at any time.
• Legal obligation, Article 6(1)(c) GDPR: to meet tax, accounting and other statutory requirements, and to respond to lawful requests from public authorities.

3. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access: Request access to your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

4. Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security:

• End-to-end encryption for data in transit and at rest
• Regular security audits and penetration testing
• Access controls and employee training
• Data minimization and purpose limitation
• Regular backup and disaster recovery procedures

5. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected:

• Translation Content: Deleted within 30 days after processing
• Account Information: Retained while your account is active
• Payment Data: Retained for 7 years for tax and accounting purposes
• Marketing Data: Retained until consent is withdrawn

6. International Transfers

When transferring personal data outside the EU/EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Binding Corporate Rules (where applicable)
• Explicit consent from data subjects

7. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the relevant supervisory authority within 72 hours
• Inform affected individuals without undue delay if high risk is involved
• Document all breaches and remedial actions taken
• Conduct thorough investigation and implement preventive measures

8. Data Protection Officer

Our Data Protection Officer (DPO) oversees GDPR compliance and can be contacted at:

9. Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the information above. We will respond to your request within one month and may request additional information to verify your identity.

10. Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. Because FatCouple OÜ is established in Estonia, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You may complain to that authority, or to the supervisory authority in the EU or EEA country where you live, where you work, or where the alleged infringement took place. We encourage you to contact us first so we can address your concerns directly, but you are not required to do so.

A directory of all EU and EEA supervisory authorities is published by the European Data Protection Board at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.