SILA Linguists® is a registered trade mark of NEXUS of SILA Limited.
This GDPR Compliance Policy sets out how NEXUS of SILA Limited, trading as SILA Linguists® ('SILA', 'we' or 'us'), manages personal data in line with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (together, 'data protection law'). It is intended for our clients, staff, linguists and suppliers, and may be provided to the Information Commissioner's Office or another supervisory authority on request. It should be read with our Privacy Policy, which tells individuals how we use their personal data, and our Terms and Conditions of Business.
1. Scope and our roles
We are a language service provider based in Scotland, providing interpreting, translation, transcription and language analysis services to public sector bodies, private businesses, the third sector and individuals in the United Kingdom, Europe, North America, Australia and beyond. All staff, linguists and suppliers who handle personal data on our behalf must follow this policy.
We act in two roles:
- as a controller for the personal data of our clients and their contacts, our staff, linguists and job applicants, users of our App and visitors to our Website; for expert reports such as language analysis (LADO) and nationality assessment reports; and for services that individuals book for themselves; and
- as a processor for personal data contained in material that organisations send us for translation, transcription, subtitling or localisation, and in the details of interpreting bookings made by organisations. In these cases we act only on the client's documented instructions, under the data protection terms in our Terms and Conditions of Business or a separate data processing agreement.
2. Data protection principles
We process personal data in line with the principles of data protection law. Personal data must be:
- processed lawfully, fairly and in a transparent manner;
- collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes;
- adequate, relevant and limited to what is necessary;
- accurate and, where necessary, kept up to date;
- kept in a form which permits identification for no longer than necessary; and
- processed securely, using appropriate technical and organisational measures.
We are responsible for, and must be able to demonstrate, compliance with these principles.
3. Records of processing, audits and annual review
We keep a record of our processing activities and carry out regular audits of the personal data we hold. For each process involving personal data, we record the categories of data and individuals, the source, the purposes and lawful basis, where the data is stored, who has access, the retention period, the parties with whom it is shared and any international transfers.
We review our audits, records and policies at least once a year, and whenever we introduce a new service, system or supplier, and we update our procedures to address any issues identified.
4. Lawful basis, legitimate interests and special category data
We identify and record a lawful basis for every processing activity for which we are controller. Where we rely on legitimate interests, we carry out and record a legitimate interests assessment.
Our services often involve special category data, such as health information, and sometimes criminal offence data. Where we are controller, we identify a condition for processing under data protection law, including the conditions in Schedule 1 to the Data Protection Act 2018, and maintain an appropriate policy document where required. Where we are processor, we rely on our client to have a lawful basis and condition, and we process the data only on its instructions.
5. Data protection by design and impact assessments
We consider data protection when designing or changing our services, systems and processes, and we collect only the personal data needed for each assignment. We carry out a data protection impact assessment before any processing likely to result in a high risk to individuals, such as new technology for handling sensitive assignment content.
We use AI-assisted translation tools only after assessing their security and confidentiality, and only on terms that prevent client content from being used to train publicly available AI models. Clients can ask us not to use such tools.
6. Linguists, staff and suppliers
Every linguist and member of staff who handles personal data:
- is vetted and, where appropriate for the work, subject to background and security checks;
- signs a confidentiality agreement and agrees to follow our data protection procedures;
- receives only the personal data needed for the assignment;
- must use secure devices and the communication and storage methods we approve, and must not keep assignment material after the assignment ends unless we instruct otherwise; and
- must report any actual or suspected data breach to us immediately.
We engage suppliers and subcontractors who process personal data for us only under written contracts that meet the requirements of data protection law, and we check that they provide sufficient guarantees of security.
7. Security
We protect personal data with technical and organisational measures appropriate to the risk, including access controls based on need to know, multi-factor authentication, encrypted transfer of files, secure storage and deletion, staff and linguist training, and procedures for the secure handling of paper documents and original documents sent to us by post or courier.
8. International transfers
We transfer personal data outside the United Kingdom or the European Economic Area only where it is protected by a safeguard recognised by data protection law, such as an adequacy decision, the International Data Transfer Agreement, the UK Addendum or standard contractual clauses, or where a recognised derogation applies, for example where the transfer is necessary to arrange a sworn translation abroad at a client's request.
9. Data retention and deletion
We do not keep personal data longer than necessary. Retention periods for each category of personal data are documented in our records and summarised in our Privacy Policy. At the end of the retention period, data is securely deleted or anonymised. Where we act as processor, we delete or return personal data at the end of the services as the client instructs, unless the law requires us to keep it.
10. Requests from individuals
We respond to requests from individuals to exercise their rights, including subject access requests and requests for erasure, without undue delay and in any event within one month of receipt. This period may be extended by up to two further months for complex or numerous requests, in which case we tell the individual why. We verify the identity of the person making the request and do not normally charge a fee.
Where the right to erasure applies, we delete the data and ask any third-party processors with whom we shared it to do the same. Where we must keep data to perform a contract, to comply with a legal obligation or to establish, exercise or defend legal claims, the right to erasure may not apply, and we explain this to the individual.
Where we act as processor, we pass any request we receive to the client concerned promptly and help it to respond.
11. Personal data breaches
We keep a record of all personal data breaches, whether or not they must be reported. Where we are controller, we report a breach to the Information Commissioner's Office, or to another competent supervisory authority where required, within seventy-two (72) hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. Where a breach is likely to result in a high risk to individuals, we inform them without undue delay.
Where we are processor, we notify the client concerned without undue delay after becoming aware of a breach affecting its data, and give it the information it needs to meet its own obligations.
We investigate every breach to identify its cause and take corrective action, such as improved procedures, additional training or technical measures, to prevent it from happening again.
12. Personal data in translation and related work
Personal data in material for translation, transcription, subtitling and localisation is processed by our linguists, revisers and, where needed, typesetting specialists. We give them only what they need, use secure transfer methods, and require them to delete the material when the work is complete. Where a client asks us to arrange a sworn translation abroad, we share the documents with the selected sworn translator only for that purpose.
13. Personal data in interpreter bookings
We share the details of interpreter bookings, such as the names of people attending, the location and the nature of the appointment, only with the interpreter assigned and only as far as necessary for them to attend and prepare. Interpreters are bound by confidentiality and must not keep notes or records of an assignment after it ends, except where required for timesheets or by law.
14. Language analysis and expert reports
Language analysis, nationality assessment and similar reports involve particularly sensitive personal data about people who may be vulnerable. We apply strict access controls, share material only with the analysts working on the case, protect the identity of analysts where appropriate, and keep reports and supporting material only for as long as they may be needed in legal proceedings, including appeals.
15. Contact
Questions about this policy should be sent to our data protection team at daptec@silalinguists.com or to the Data Protection Team, NEXUS of SILA Limited, 2/3, 48 West George Street, Glasgow G2 1BP, Scotland.
NEXUS of SILA Limited is registered in Scotland with company number SC770122. Registered office: 2/3, 48 West George Street, Glasgow G2 1BP, Scotland, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC105121.