Privacy Policy
This policy explains what personal data Fidum collects through the fidum.app website and the Fidum service, why we collect it, how long we keep it and what rights you have.
1. Who we are
Fidum (“Fidum”, “we”, “us”) makes software for sworn translators. Fidum is the controller of the personal data described in sections 3 to 5. Write to us about anything in this policy at [email protected].
2. In short
- The website sets no cookies of its own and runs no analytics or advertising trackers.
- The access form collects your name, office and work email. We use them only to reply to your request.
- Client documents uploaded to Fidum belong to the translator’s office. We process them only to produce the translation. Scans are deleted once translated, and translations 5 days after they are created.
- We don’t sell personal data. The AI services we use don’t train on your documents.
3. Visiting the website
When you open fidum.app, your browser sends the technical data that every website receives: your IP address, browser and device type, the page requested and the time. Cloudflare, which delivers the site and protects it from attacks, and our hosting provider process this data to show you the page and keep the site secure. Our own server keeps no access logs.
The website sets no cookies of its own and uses no analytics, advertising or social media trackers. Fonts and images load from our own server. Cloudflare may set a strictly necessary security cookie to tell people from automated traffic; it isn’t used to track you.
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
4. Requesting access and writing to us
When you send the access form, we receive your name, office, work email, the language of the page and the time of the request. When you email us, we receive your email address and whatever you write. We store access requests on our server and receive them by email.
We use this data to reply to you, to arrange a call if you want one, and to decide on and set up access. We don’t add you to a mailing list.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without it we can’t reply.
Retention: we keep access requests and our correspondence about them for up to 12 months after the last message, then delete them. If you become a customer, section 5 applies instead.
5. Using Fidum
When your office uses Fidum, we process data about the people who use it: name, work email, office, role, sign-in and two-factor authentication data, and the activity log that shows the office admin who opened and downloaded which translation. For paying customers we also process billing details, such as company name, address, tax identification number and invoices.
We use this data to provide the service, keep accounts secure, answer support requests and bill for the service.
Legal basis: performance of the contract with your office (Art. 6(1)(b) GDPR); for users invited by an office, our and the office’s legitimate interest in a secure, working service (Art. 6(1)(f) GDPR); for billing records, our legal obligations under tax and accounting law (Art. 6(1)(c) GDPR).
Retention: for as long as the account is active, and deleted within 30 days after it is closed. Invoices and accounting records are kept for as long as tax and accounting law requires, generally five years.
6. Client documents
Documents that translators upload to Fidum, and the translations made from them, contain personal data of their clients and other people named in them. They may include identity document numbers and special categories of data, such as health information. This data is processed on behalf of the translator’s office: the office is the controller and Fidum is its processor under Art. 28 GDPR. We process it only on the office’s instructions, as set out in the data processing terms that form part of our Terms of Service.
- Scans are deleted once the translation is produced.
- Translations are deleted 5 days after they are created.
- Each translation is encrypted with its own key. Once deleted, it can no longer be read by anyone.
- Only people invited by the office’s admin can see the documents.
- To read and translate a document, Fidum sends it to AI service providers that act as our sub-processors. Their terms forbid using the documents to train models.
If your data appears in a document that a translator handled with Fidum, please contact that translator, who is the controller. If you write to us instead, we will pass your request on and help the translator answer it.
7. Who receives the data
- Hetzner Online GmbH, Germany: hosting. Our servers are in Finland.
- Cloudflare, Inc., United States: content delivery, DNS, protection against attacks and routing of email sent to fidum.app addresses.
- Our email provider: stores our mailbox, including access requests and correspondence.
- AI service providers: read and translate client documents (section 6). They receive no data from the website or the access form.
- Accounting and payment service providers: when we bill customers.
- Public authorities: only when the law requires us to disclose data.
Service providers process data only on our instructions, under data processing agreements. We don’t sell personal data or share it for advertising. You can ask for the current list of our sub-processors at [email protected].
8. Transfers outside the European Economic Area
Our servers are in the European Union. Cloudflare and some AI service providers may process data outside the European Economic Area, including in the United States. For such transfers we rely on an adequacy decision of the European Commission, such as the EU–U.S. Data Privacy Framework, or on the Standard Contractual Clauses adopted by the Commission. You can ask us for a copy of these safeguards.
9. Your rights
You have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process it;
- receive data you gave us in a machine-readable format and have it transferred to another provider;
- object to processing based on our legitimate interest.
To use any of these rights, write to [email protected]. We reply within one month at the latest and may ask you to confirm your identity first.
You can also lodge a complaint with a data protection supervisory authority in the EU country where you live or work, or where you believe the infringement happened. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
10. Security
All connections to Fidum are encrypted. Each translation is encrypted with its own key. Access is limited to people invited by the office’s admin, with two-factor sign-in if the office requires it, and the admin can see who opened and downloaded what. Our staff access personal data only when needed for support or security, under a duty of confidentiality.
11. Automated decisions
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Fidum drafts translations automatically, but a sworn translator reviews, certifies and signs every translation.
12. Children
Fidum is a tool for professionals and isn’t intended for children.
13. Changes to this policy
When we change this policy, we publish the new version on this page with a new date. If the changes are significant, we tell customers by email before they take effect.
14. Language versions
This policy is published in English, Polish and Ukrainian. If the versions differ, the English version prevails.
15. Contact
Questions and requests about personal data: [email protected]. We reply within one business day.