Data protection and UK GDPR

Controller and processor

1. We do not decide anything about the personal data in your conversations. Where we need an instruction we ask you for one.
2. Requests from people about their data come to you. We give you what the system holds so you can answer it.

The one place the roles reverse is this website and any correspondence with us, where INT6 Ltd is the controller. That is covered in the privacy notice and is separate from anything in this service.

What is processed in a conversation

1. What each person writes, and its translation.
2. Structured facts about the conversation, whether entered by the worker, declared by the person, or extracted from what was said. Each held with the category it belongs to and a confidence figure.
3. Attributes of people in the conversation, including age band and gender, where these were entered, declared, or picked up from what was said. These choose correct terms in the target language.
4. Per-turn fidelity scores, revisions and clarifying questions.
5. Staff account details and an audit record of administrative actions.

Special category data

These conversations happen in domestic abuse, health, justice and support settings. As such, what a person writes will often reveal many protected characteristics, such as health, sex life or orientation, religious belief, ethnic origin or details amounting to criminal offence data. That is Article 9 and Article 10 territory.

It follows that a lawful basis under Article 6 alone is not enough. As controller you need an Article 9 condition and, where relevant, an Article 10 basis. Where the Data Protection Act 2018 requires one, you also need an appropriate policy document. If your existing case-recording basis does not already cover a machine translation tool in the loop, extend it before you start using this service.

Transparency to the person

The person should be told a machine translation tool is being used and that they can ask for an interpreter instead. On their own device the interface presents in their language, so the explanation reaches them as effectively as the translation. The product will also make it clear, to all involved, who is in the room at any one time. Your own privacy information needs to reflect that the tool is in use.

Where the data goes

Translating a conversation means sending its content to a hosted large language model. That is how the product works, not an optional integration. Content is also stored so an exchange can be reviewed and audited.

Rights

For a conversation in your service, in practice, you handle the request as controller and we assist.

1. Access. A conversation can be reopened as a read-only record, including the score attached to each turn, so a subject access request can be answered from what the system holds.
2. Rectification. Where something recorded about a person is wrong, it is visible to the worker and can be corrected.
3. Erasure, restriction, portability and objection. Routed through you. Tell us what you have decided and we act on your instruction.
4. Complaints. A person may complain to the Information Commissioner's Office at any time. INT6 Ltd is on the ICO's register of fee payers as a data controller, reference ZB000380.

Security

Sign-in happens on the application at app.inmywords.chat, either with a passkey or with a username and password supported by a two-factor code. Where a passkey is used we hold only a public key and the private key never leaves the user's device. No credential is ever entered on this marketing site. Access is grouped by organisation with per-group permissions and administrative actions are recorded in an append-only audit log. Traffic is served over HTTPS.

Breach

As processor we would notify you without undue delay on becoming aware of a personal data breach, with what we know at the time, and keep telling you as we learn more. The Article 33 notification to the ICO is yours to make as controller, within 72 hours where the threshold is met.

Your DPIA

A DPIA is very likely to be required here when dealing with large-scale processing of special category data, a novel technology and vulnerable data subjects. Treat it as required rather than overlooking it.

Ask us for what you need to complete it. Where the answer is undecided, you will get the truth rather than a reassuring paragraph.