Data Management Plan (DMP)

1. Purpose

This Data Management Plan (DMP) describes how personal and non-personal data associated with the DubbiOvi project are collected, managed, processed, stored, protected, shared, retained and, where appropriate, securely deleted throughout the project's lifecycle.

The document has been prepared in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
• Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD);
• the University of Oviedo's institutional data protection policies;
• Open Science principles;
• FAIR data principles;
• Privacy by Design;
• Privacy by Default;
• responsible research and innovation.

DubbiOvi has been designed as a local-first audiovisual translation platform in which users retain control over their own working materials while only the minimum amount of administrative information necessary for project management, dissemination and software maintenance is processed.

2. Data Governance

2.1 Data Controller

The University of Oviedo acts as the Data Controller for the administrative personal data processed within the DubbiOvi project.

University of Oviedo

C/ San Francisco 3
33003 Oviedo
Spain
Website: https://www.uniovi.es

Operational coordination of the project is carried out by the Project Lead, who manages the administrative aspects of the project under the authority of the University of Oviedo.

Operational Project Contact

Alfonso C. Rodríguez Fernández-Peña
Department of English, French and German Philology
University of Oviedo
Email: rodriguezalfonso@uniovi.es

2.2 Data Protection Officer

The University of Oviedo has appointed a Data Protection Officer (DPO).

Questions relating to personal data protection or the exercise of data protection rights may also be addressed to:

Data Protection Officer

University of Oviedo
Email: delegadopdatos@uniovi.es
Website: University of Oviedo Privacy Portal

2.3 Authorised Personnel

Access to administrative registration information is restricted to authorised personnel acting within the scope of their responsibilities.

All authorised personnel are subject to confidentiality obligations and appropriate technical and organisational security measures.

3. Categories of Data

The DubbiOvi project manages two clearly differentiated categories of information.

3.1 Administrative Registration Data

Users who voluntarily register to download DubbiOvi may provide:

• First name
• Last name
• Email address
• Institution
• Country
• Operating system
• Software version downloaded
• Registration timestamp

Only the minimum amount of personal information necessary for project administration is collected.

These data are processed exclusively for:

• software distribution;
• project administration;
• communication of software updates and security notices;
• dissemination and impact assessment;
• institutional reporting;
• research and knowledge-transfer activities using anonymised statistical information.

3.2 User-Generated Project Data

DubbiOvi processes audiovisual translation materials locally on the user's own computer.

These materials may include:

• audiovisual files;
• subtitle files;
• translation memories;
• terminology databases;
• scripts;
• translated text;
• timing information;
• exported projects.

DubbiOvi does not collect, upload, archive, monitor, analyse or permanently store these materials.

Users retain full ownership and responsibility for all locally stored project files.

4. Legal Basis and Data Processing Principles

Processing of administrative registration data is carried out in accordance with Article 6(1)(e) GDPR, as it is necessary for the performance of tasks carried out in the public interest within the University of Oviedo's activities in teaching, research and knowledge transfer.

Where specific communications require the user's explicit agreement beyond the purposes described above, processing will be based on the user's consent in accordance with Article 6(1)(a) GDPR.

The DubbiOvi project applies the following GDPR principles:

• lawfulness;
• fairness;
• transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

DubbiOvi has been developed according to the principles of Privacy by Design and Privacy by Default (Article 25 GDPR).

5. Data Storage

Administrative registration data are stored within the University of Oviedo's institutional Google Workspace environment.

Stored information is limited to administrative registration records:

• name;
• surname;
• email address;
• institution;
• country;
• operating system;
• software version;
• registration date and time.

Access is restricted to authorised project personnel using authenticated institutional accounts protected by the University's security policies.

Google Workspace acts as the technological cloud infrastructure provider under the contractual and security guarantees applicable to the University's institutional Google Workspace services.

User-generated project files remain stored exclusively on users' own devices unless users independently choose to use external storage services.

6. Security Measures

Appropriate technical and organisational safeguards are implemented to protect administrative information, including:

• authenticated institutional access;
• password-protected accounts;
• HTTPS encrypted communications;
• restricted administrative permissions;
• institutional authentication mechanisms;
• regular software updates;
• secure version control through GitHub;
• periodic backups where appropriate;
• confidentiality obligations applicable to authorised personnel.

Users remain responsible for protecting files stored on their own devices.

7. External Artificial Intelligence Services

Some optional DubbiOvi features allow communication with third-party Artificial Intelligence services selected and configured by the user.

DubbiOvi acts solely as an interface for these requests.

The project does not permanently retain:

• prompts;
• translated content;
• generated outputs;
• audiovisual materials exchanged with external AI services.

Processing carried out by external AI providers is governed exclusively by their own privacy policies and terms of service.

Users are strongly advised not to submit personal data, confidential information or special categories of personal data to third-party AI services unless they have an appropriate legal basis and sufficient safeguards for doing so.

The University of Oviedo assumes no responsibility for processing activities performed independently by external AI providers.

8. Data Sharing

Administrative personal information is never sold, rented, licensed or disclosed to third parties for commercial purposes.

Only fully anonymised and aggregated statistical information may be used for:

• scientific publications;
• conference presentations;
• institutional reports;
• funding applications;
• impact assessment;
• dissemination activities;
• knowledge transfer.

No individual user can be identified from these statistics.

9. Data Retention and Disposal

Administrative registration data are retained only for as long as necessary to support the objectives of the DubbiOvi project, including software administration, communication with registered users, dissemination activities and institutional reporting.

As a general rule, registration information will be retained while the project remains active or until the user requests deletion of their personal data, unless a longer retention period is required by applicable legal obligations.

When personal information is no longer required, it will be securely deleted or irreversibly anonymised where appropriate.

10. Open Science

DubbiOvi actively supports Open Science through:

• open-access software;
• transparent development;
• public documentation;
• version-controlled source code;
• reproducible software releases through GitHub and Zenodo;
• permissive MIT open-source licensing.

Transparency is pursued while fully respecting data protection obligations.

11. FAIR Principles

DubbiOvi supports the FAIR principles by ensuring that software outputs and documentation are:

• Findable through GitHub and Zenodo.
• Accessible as open-access resources.
• Interoperable through widely adopted file formats.
• Reusable under the MIT License.

12. GDPR Compliance and Data Subject Rights

The DubbiOvi project complies with:

• Regulation (EU) 2016/679 (GDPR);
• Spanish Organic Law 3/2018 (LOPDGDD);
• the University of Oviedo's institutional data protection framework.

Data subjects may exercise their rights of:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection;
• data portability, where applicable;
• withdrawal of consent, where consent constitutes the legal basis of processing.

Requests may be submitted through the University of Oviedo or the Project Contact indicated below.

If a data subject considers that personal data have not been processed in accordance with applicable legislation, they have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD).

Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD)

Website: https://www.aepd.es

13. Contact Information

14. Version History

Version 1.2 (July 2026)
Updated to clarify data governance, legal basis for processing, institutional responsibilities, data retention criteria, use of Google Workspace, external AI services, and data subject rights in accordance with the GDPR and the recommendations of the University of Oviedo's Data Protection Officer.

Version 1.0 (July 2026)
Initial Data Management Plan released together with the public open-source version of DubbiOvi.