Legal
Undertitle Privacy Policy
Version: 1.2 Last updated: 26 October 2026
1. Introduction
This Privacy Policy explains how Think-Tank BV, a Belgian limited liability company with registered office at Mezenstraat 80, 3061 Leefdaal, Belgium, company number 1031.720.902 (RLE Leuven) ("ThinkTank", "we" or "us"), processes personal data in connection with undertitle.ai and the Undertitle subtitling services.
It applies when you visit our website, contact us, request information or a demo, create an account or use the services.
Where a customer processes personal data through Undertitle, ThinkTank acts as processor on that customer's behalf. The customer is the controller and the processing is also governed by the customer agreement and our Data Processing Agreement.
2. Our role
ThinkTank is controller for data processed for our own purposes, including website and service administration and security, customer relationships, billing, support, logging, fraud prevention and service improvement.
For personal data supplied by customers in media, files, instructions or other customer content, we act as processor. We process that data only on the customer's documented instructions and under the applicable agreement.
3. Data we process
Depending on how you interact with Undertitle, we may process:
- identification and contact details, such as name, role, organisation, email address and telephone number;
- account and contract information;
- demo, sales, support and other communications;
- billing and payment administration;
- technical information, including IP address, browser, device data, logs and security information;
- website and service usage and performance information;
- customer content, including audiovisual material, subtitle files, term lists, instructions and generated results.
Do not submit sensitive personal data that is unnecessary for the service. The customer remains responsible for having a valid legal basis for all content processed through Undertitle.
4. Purposes and legal bases
We process personal data to perform agreements, answer enquiries, organise demos, manage accounts and services, administer payments and invoices, secure our systems, prevent misuse, and maintain and improve our website and services.
Depending on the circumstances, processing is necessary to perform a contract, comply with a legal obligation, pursue our legitimate interests or act on consent. Where we rely on legitimate interests, we balance those interests against the rights and interests of the person concerned.
5. Customer content and service data
Customer content is processed to provide the agreed Undertitle services, including transcription, translation, timing, quality control and delivery of results. ThinkTank does not use customer content for other purposes unless permitted by the agreement, Data Processing Agreement or the customer's documented instructions.
We may use aggregated, de-identified or anonymised technical data to measure performance, reliability and security and to improve the services, provided that the data can no longer identify a person.
6. Sharing data
We may share personal data with personnel and service providers who need it for hosting, infrastructure, security, communications, analytics, support, billing and professional services. They may process the data only for the agreed purpose and under appropriate contractual and security obligations.
We may also disclose data where required by law, to protect our or others' rights, in connection with a corporate reorganisation or with your consent. Where we act as processor, the subprocessor arrangements in the Data Processing Agreement also apply.
7. International transfers
Some service providers may process personal data outside the European Economic Area. Where this occurs, we use an applicable transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary safeguards where required.
8. Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, to meet contractual and legal obligations, resolve disputes and protect our rights. The period depends on the data, service, customer agreement and applicable statutory retention periods.
Customer content is retained and deleted under the customer agreement and Data Processing Agreement. Backups may remain for a limited additional period before being overwritten through the normal cycle.
9. Security
We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure. No storage or transmission method is entirely risk-free, so absolute security cannot be guaranteed.
10. Your rights
Subject to the GDPR, you may request access, correction, deletion or restriction of your personal data. You may object to certain processing, request data portability and withdraw consent without affecting earlier lawful processing.
Where we process data for a customer, contact that customer first. We assist the customer with the request as set out in the Data Processing Agreement.
You may also lodge a complaint with the Belgian Data Protection Authority or the competent supervisory authority in your country.
11. Changes
We may update this Privacy Policy as our services, practices or legal obligations change. The date above shows the latest update. We will provide appropriate notice of material changes where appropriate or legally required.
12. Contact
For privacy questions or requests, contact trust@think-tank.io.
The full Dutch version is also available.