Data protection and UK GDPR

Who is controller and who is processor

Two consequences worth stating plainly, because they are the two most often assumed the other way round.

1. We do not decide anything about the personal data in your conversations. Not the purposes, not the retention, not who sees it. Where we need an instruction we ask you for one.
2. A request from a person about a conversation in your service comes to you. It is your conversation and your duty of care. We give you what the system holds so you can answer it.

The one place the roles reverse is this website and any correspondence with us, where C2 Discovery Labs CIC is the controller. That is covered in the privacy notice and is separate from anything in your service.

What is processed in a conversation

1. What each person writes, and its translation.
2. Structured facts about the conversation, whether entered by the worker, declared by the person, or extracted from what was said, each held with the category it belongs to and a confidence figure.
3. Attributes of the people in the conversation, including age band and gender, where these were entered, declared, or picked up from what was said. These choose correct referring terms in the target language.
4. Per-turn fidelity scores, revisions and clarifying questions.
5. Staff account details and an audit record of administrative actions.

Special category data

This is the part most likely to be underestimated. These conversations happen in homelessness, domestic abuse, health, justice and support settings, so what a person writes will often reveal health, sexual life or orientation, religious belief, ethnic origin, or details amounting to criminal offence data. That is Article 9 and Article 10 territory.

It follows that a lawful basis under Article 6 is not enough on its own. As controller you need an Article 9 condition and, where relevant, an Article 10 basis, together with an appropriate policy document under the Data Protection Act 2018 where the condition requires one. If your existing case-recording basis does not already cover a machine translation tool in the loop, extend it before you start rather than after.

Transparency to the person

The person should be told a machine translation tool is being used and that they can ask for an interpreter instead. On their own device the interface renders in their language, so the explanation reaches them as well as the translation does. Where a supervisor is present, everyone in the conversation is told so by the product itself. Your own privacy information needs to reflect that the tool is in use.

Where the data goes

Translating a conversation means sending its content to a hosted large language model. That is inherent to how the product works, not an optional integration, and it means conversation content leaves your systems in the course of being translated. Content is also stored so an exchange can be reviewed and audited.

The model provider is therefore a sub-processor. Naming it, the hosting region, the retention period and whether content may be used for model training are contract terms rather than website copy, and they are covered below under what is not settled.

Rights

For a conversation in your service you handle the request as controller and we assist. In practice:

1. Access. A conversation can be reopened as a read-only record, including the score attached to each turn at the time, so a subject access request can be answered from what the system holds.
2. Rectification. Where something recorded about a person is wrong, including an age band or gender picked up from the conversation, it is visible to the worker and can be corrected.
3. Erasure, restriction, portability and objection. Routed through you. Tell us what you have decided and we act on your instruction.
4. Complaints. A person may complain to the Information Commissioner's Office at any time.

Security

Sign-in happens on the application at app.mywords.chat, either with a passkey or with a username and password supported by a two-factor code. Where a passkey is used we hold only a public key and the private key never leaves the user's device. No credential is ever entered on this marketing site. Access is grouped by organisation with per-group permissions, and administrative actions are recorded in an audit log. Traffic is served over HTTPS. Single sign-on against your own identity provider is available on enterprise plans.

Breach

As processor we would notify you without undue delay on becoming aware of a personal data breach, with what we know at the time, and keep telling you as we learn more. The Article 33 notification to the ICO is yours to make as controller, within 72 hours where the threshold is met.

Your DPIA

A DPIA is very likely to be required here: large-scale processing of special category data, a novel technology, and vulnerable data subjects. Treat it as required rather than looking for a reason to skip it.

Ask us for what you need to complete it. Where the answer is that something is not decided yet, you will get that answer rather than a reassuring paragraph.

What is not settled yet

Publishing these before they are agreed would be worse than saying plainly that they are outstanding. Each one is a term in the data processing agreement, and none should be left until after a service has started.

1. The named sub-processor for the language model, and its own sub-processors.
2. Hosting and processing region, and the transfer mechanism if any processing happens outside the UK.
3. Retention. How long conversation content is kept, whether the organisation can set that, and how deletion is evidenced.
4. Training. Whether conversation content may be used to train or improve any model, by us or by the provider. Until this is contractually stated, treat it as unresolved.
5. A signed data processing agreement under Article 28, with the Article 28(3) terms in it.
6. Self-hosting or a deployment that keeps content inside your infrastructure. An open piece of work, not an available option.

If your information governance rules any of that out, tell us at the start. It is a genuine constraint for some services and we would rather hear it early than argue about it late.

This page describes how the product works and what remains to be agreed. It is not legal advice, and it does not replace your own assessment. Questions to contact.