Data sub-processors

The legally binding version of this list is the Spanish one, available at /legal/sub-encargados. This English text is an informational summary; in case of any discrepancy, the Spanish version prevails.

Under Article 28.2 of Regulation (EU) 2016/679 (GDPR), LinguFolio informs the controllers using its platform (the teachers) of the sub-processors involved in the processing of personal data. LinguFolio applies a general authorisation model: by accepting the Data Processing Agreement (DPA), the controller authorises the sub-processors listed here at the time of signing, as well as future changes notified under the procedure below.

Active sub-processors

Service category

Processing purpose

Data categories

Country of processing

Transfer safeguard

Infrastructure and database

Storage of platform data: access credentials, profile data, student information and structured pedagogical summaries of sessions (the literal transcription is not persisted)

Identification, contact, student data, structured summaries, technical data

European Union (configurable region)

Standard Contractual Clauses (SCC), Modules 2 and 3

File storage and web security

Temporary storage of session audio files (deleted after transcription), protection against unauthorised access (CAPTCHA) and domain name resolution (DNS)

Student data, voice/audio files, technical data

European Union (storage restricted to the EU)

Standard Contractual Clauses (SCC)

Natural language processing and AI

Analysis of text transcriptions to generate session summaries, extract vocabulary and produce personalised teaching materials

Student data, text transcriptions

United States

Standard Contractual Clauses (SCC)

Transactional email

Sending transactional service communications: account verification, platform notifications and waitlist communications

Identification, contact data

United States

Standard Contractual Clauses (SCC)

Error monitoring and observability

Logging and analysis of technical errors and platform events to ensure security, stability and availability, with minimisation of personal data in logs

Technical data, session identifiers and, incidentally, contact data

European Union

Standard Contractual Clauses (SCC)

Use of data for AI model training

None of the listed sub-processors uses the personal data processed on behalf of LinguFolio to train their own AI models, unless expressly stated otherwise in this list or the controller's explicit consent has been obtained.

Changes to this list

LinguFolio may add, replace or remove sub-processors. Before any change, LinguFolio will notify the controller at least 30 days in advance by email to the address associated with their account. During that period, the controller may object; in the event of a well-founded, unresolved objection, the controller may terminate the DPA under its terms.

Version v1 · updated 3 July 2026 · informational English summary; the Spanish version at /legal/sub-encargados is binding and pending final legal review.