Standards · security · data protection

Honest about where we stand.

OndLingua processes personal data on behalf of our customers under UK GDPR. Data-processing terms are agreed with each customer as part of contracting. We are a new provider: below is what we hold today and what we are working towards, stated plainly.

Our Net Zero Commitment is published as its own page.

01Standards

What we hold, and what we don't.

Each line states its actual status — compliant, underway, or on the roadmap. We do not list a certification we have not been awarded.

UK GDPR
Data protection
We are the controller for the personal data of interpreters, applicants, client contacts, prospects, suppliers, visitors and staff, and the processor for service users' data handled on behalf of our clients. Data-processing terms are part of our contract pack and are agreed at contract stage. Rights requests: [email protected].
Compliant · processing terms agreed at contract stage
UK GDPR · Data Protection Act 2018
Scope · UK
Hosting · Falkenstein, Germany (EEA)
ICO registration ZC274330
Cyber Essentials
Government cyber baseline
The UK government-backed baseline for perimeter, endpoint hardening and patch posture. We are working towards certification under the IASME-NCSC scheme.
Underway · not yet certified
IASME · NCSC scheme
Scope · UK
ISO 27001
Information security
An information security management system covering risk, access control, change management and supplier review. On our roadmap; we are not certified today.
On roadmap · not certified
ISO/IEC 27001
Scope · Planned

02Privacy commitments

Six things we always do.

These are not negotiable per client — they apply across every contract, every region, every sector. Data-processing terms are part of our contract pack and are agreed at contract stage.

01
Encryption
Traffic is encrypted in transit. At rest, the most sensitive vetting fields are encrypted at column level; the database volume itself is not, and we say so.
02
Sessions are not recorded
We have no call recording capability. Nothing is recorded, so there is no recording to retain, release or disclose.
03
Minimum necessary data
We collect what routing and audit require — institution, language, duration and who took which action. We do not transcribe sessions and we do not profile anyone.
04
Right-to-be-forgotten
Subject access and erasure requests fulfilled within one month, the statutory UK GDPR timeframe. Ask us and we will tell you exactly what we hold about you and what happens to it.
05
Sub-processor transparency
We will tell you which sub-processors handle your data and what each one does, and give notice before we add or materially change one.
06
Breach notification within 72 hours
We notify controllers within seventy-two hours of confirming a breach, as GDPR Article 33 requires. We are a small company, so that escalation goes straight to the director — there is no rota for it to get lost in.