The policy discloses that DeepL shares personal data with third-party service providers including cloud infrastructure, payment processors, customer support vendors, and analytics providers, and states that data processing agreements are in place with these providers.
This analysis describes what DeepL's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes the transfer of user personal data to multiple categories of third-party processors and asserts that GDPR-compliant data processing agreements govern these transfers. Compliance teams should verify the adequacy of these agreements and the completeness of the sub-processor list, particularly for organizations with strict data residency or sub-processor approval requirements.
Interpretive note: The policy asserts data processing agreements are in place but does not enumerate specific sub-processors within the policy text, making independent verification of scope and adequacy uncertain without requesting the full sub-processor list from DeepL.
The updated terms establish explicit procedures for three new account-based storage and processing features. Translation Memories allow users to store source and target language segments for reuse; Translation Memory Generation processes uploaded document pairs to generate Translation Memories, then deletes the source documents immediately; and Adaptive Translation uses stored Translation Memories and reference documents to customize translations, with numeric representations (embeddings) calculated and stored in the user's account. The policy states that all content and embeddings are used only within the user's own account, never shared with other customers, and never used to train or improve DeepL's models. The policy specifies GDPR Article 6(1)(b) as the legal basis for processing (contract performance). You can deactivate Adaptive Translation in the relevant Style Profile at any time.
View change record →Under this clause, personal data including account information, usage data, and payment details may be shared with cloud, analytics, payment, and customer support sub-processors. The agreement states that data processing agreements are in place, but does not enumerate all sub-processors directly within the privacy policy text.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"We use third party service providers to support our services. These include providers of cloud infrastructure, payment processing, customer support, and analytics services. Where these providers process personal data on our behalf, we have entered into data processing agreements with them to ensure that your personal data is protected in accordance with applicable data protection law.Excerpt from DeepL's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 28, which requires written data processing agreements with all processors and mandates that processors only act on documented instructions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes the transfer of user personal data to multiple categories of third-party processors and asserts that GDPR-compliant data processing agreements govern these transfers. Compliance teams should verify the adequacy of these agreements and the completeness of the sub-processor list, particularly for organizations with strict data residency or sub-processor approval requirements.
Under this clause, personal data including account information, usage data, and payment details may be shared with cloud, analytics, payment, and customer support sub-processors. The agreement states that data processing agreements are in place, but does not enumerate all sub-processors directly within the privacy policy text.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by DeepL.