Standards · security · data protection

Honest about where we stand.

OndLingua processes personal data on behalf of our customers under UK GDPR, with a written Data Processing Agreement. We are a new provider: below is what we hold today and what we are working towards, stated plainly.

01Standards

What we hold, and what we don't.

Each line states its actual status — compliant, underway, or on the roadmap. We do not list a certification we have not been awarded.

UK GDPR
Data protection
We process personal data as a processor on behalf of our customers, under a written Data Processing Agreement. Data subject rights requests are handled via [email protected].
Compliant · DPA available on request
UK GDPR · Data Protection Act 2018
Scope · UK
Cyber Essentials
Government cyber baseline
The UK government-backed baseline for perimeter, endpoint hardening and patch posture. We are working towards certification under the IASME-NCSC scheme.
Underway · not yet certified
IASME · NCSC scheme
Scope · UK
ISO 27001
Information security
An information security management system covering risk, access control, change management and supplier review. On our roadmap; we are not certified today.
On roadmap · not certified
ISO/IEC 27001
Scope · Planned

02Privacy commitments

Six things we always do.

These are not negotiable per client — they apply across every contract, every region, every sector. Codified in the DPA you sign with us.

01
Encrypted in transit
Traffic is encrypted in transit, and production secrets are held separately from application code. We do not claim encryption at rest, because we have not implemented it.
02
Sessions are not recorded
We have no call recording capability. Nothing is recorded, so there is no recording to retain, release or disclose.
03
Minimum necessary data
We collect what routing and audit require — institution, language, duration and who took which action. We do not transcribe sessions and we do not profile anyone.
04
Right-to-be-forgotten
Subject access and erasure requests fulfilled within one month, the statutory UK GDPR timeframe. Ask us and we will tell you exactly what we hold about you and what happens to it.
05
Sub-processor transparency
We will tell you which sub-processors handle your data and what each one does, and give notice before we add or materially change one.
06
Breach notification within 72 hours
We notify controllers within seventy-two hours of confirming a breach, as GDPR Article 33 requires. We are a small company, so that escalation goes straight to the director — there is no rota for it to get lost in.

03Data protection pack

What your DPO gets.

The documents we can provide today for a supplier or data protection review.

Data Processing Agreement (DPA)
Description of the data we process and why
Our current certification status, stated honestly
Named contact for data protection questions

Vendor assessment

Request the data protection pack.

Sent to your DPO or security team on request.

Request the pack