The DPA that automatically applies to your subscription.

• Acceptance. By accepting the Terms or executing an Order Form, Customer accepts this DPA.
• Parties. The “Processor” is Citesvue Inc. (or the contracting Citesvue affiliate named in the Order Form). The “Controller” is the Customer entity that owns the workspace.
• Precedence. In any conflict between this DPA and the Terms with respect to the processing of personal data, this DPA prevails.
• Scope. This DPA covers Citesvue’s processing of personal data on Customer’s behalf in connection with the Service. Account registration data and billing data, where Citesvue acts as an independent controller, are governed by the Privacy Policy.

• “Applicable Data Protection Law” means the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, etc.), and any successor or equivalent law applicable to the processing.
• “Customer Personal Data” means personal data contained in Customer Content or otherwise processed by Citesvue on Customer’s behalf.
• “Sub-processor” means any third party engaged by Citesvue to process Customer Personal Data on Customer’s behalf.
• “SCCs” means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), as supplemented by the UK Addendum where applicable.
• “Personal Data Breach” has the meaning given in Article 4(12) GDPR.
• Other capitalised terms have the meanings given in the Terms or in Applicable Data Protection Law.

For Customer Personal Data, Customer is the Controller (or, where Customer acts as a processor for a third party, the Processor) and Citesvue is the Processor (or sub-processor, respectively). The processing details required by Article 28(3) GDPR are set out below.

Citesvue will process Customer Personal Data only on the documented instructions of Customer, including with respect to international transfers. Customer’s instructions are: (a) the Terms and this DPA; (b) the configurations Customer makes in the Service (workspace settings, retention policies, integration configurations, region pinning, member roles); and (c) any further written instructions Customer provides.

If Citesvue believes an instruction violates Applicable Data Protection Law, Citesvue will inform Customer in writing without delay (subject to legal restrictions).

Customer authorises Citesvue to engage Sub-processors to provide the Service. The categories of Sub-processors and their function are listed below. The named list of Sub-processors (with entity name, country of operation, and function) is published in the customer trust portal — request access via security@citesvue.com.

Notice & objection. Citesvue will give Customer at least 30 days’ notice before engaging a new Sub-processor (via the trust portal and email). During that window, Customer may object on reasonable data-protection grounds; if the parties cannot agree on a remedy, Customer may terminate the affected portion of the Service for convenience and receive a pro-rata refund of pre-paid fees.

Sub-processor obligations. Citesvue will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA. Citesvue remains liable for the acts and omissions of its Sub-processors as if they were its own.

The SCCs are deemed incorporated into this DPA by reference. The selections required by the SCCs (Module, optional clauses, Annexes) are completed as set out in the Schedule to this DPA. Where Annexes refer to specific information, the contents of this DPA, the Order Form, and the trust portal’s named Sub-processor list constitute that information.

Detailed control mappings to ISO 27001 / SOC 2 (Type II in progress) are available under NDA via the trust portal. See /security for the public summary and /compliance for current and in-progress certifications.

• Notification window. Citesvue will notify the affected Customer’s designated security and privacy contacts without undue delay and in any event within 72 hours after becoming aware of a confirmed Personal Data Breach affecting that Customer’s data.
• Contents of the notice. To the extent then known, the notice will include (a) the nature and likely consequences of the breach; (b) the categories and approximate volume of personal data and data subjects affected; (c) the measures taken or proposed; and (d) a single point of contact for follow-up. We will update Customer as the investigation progresses.
• No supervisory-authority notification by Citesvue. Customer remains the controller and is responsible for any required notification to supervisory authorities or data subjects. Citesvue will provide reasonable assistance.
• Cooperation. Citesvue will document the breach, the measures taken, and any remediation, and will make this documentation available to Customer.

Citesvue will provide Customer with the in-product functionality and reasonable assistance necessary to enable Customer to fulfil its obligations to respond to data-subject requests under Applicable Data Protection Law.

If a data subject contacts Citesvue directly with a request relating to Customer Personal Data, Citesvue will (where lawful) refer the data subject to Customer and inform Customer of the request without undue delay.

• Documentation. Customer may request, no more than once per twelve months, the most recent independent audit reports (e.g. SOC 2 Type II once issued), penetration-test summaries, and a completed security questionnaire (CAIQ). These are made available under NDA via the trust portal.
• On-site / virtual audit. Where Customer reasonably believes documentation is insufficient (e.g. following a confirmed Personal Data Breach affecting Customer), Customer may, at its own expense, conduct or commission an audit of Citesvue’s controls relevant to the processing of Customer Personal Data. The parties will agree the scope, timing, and confidentiality terms in advance, and will conduct the audit during business hours and in a manner that does not interfere with Citesvue’s operations.
• Independent auditor. Audits performed by a third party require a mutually acceptable auditor under written confidentiality terms.

• Export window. For 30 days after termination, Customer may export Customer Personal Data via in-product export or the API.
• Deletion. After the export window (or earlier on Customer’s written instruction), Citesvue will delete Customer Personal Data from primary stores, derived stores, and search indices, and will purge it from backups on the next rotation cycle (≤ 30 days further). A signed deletion receipt is provided on request.
• Retention exceptions. Citesvue may retain Customer Personal Data only to the extent and for the period required by applicable law (e.g. statutory tax/finance retention for invoices).

Each party’s liability under this DPA is subject to the limitation of liability in the Terms. The limit applies in aggregate across all claims under the Terms and the DPA combined. Nothing in this DPA limits a party’s liability where such limitation is not permitted under Applicable Data Protection Law.

This DPA is effective from Customer’s acceptance of the Terms (or signature of an Order Form referencing this DPA) and continues for as long as Citesvue processes Customer Personal Data, plus any post-termination period required for return, deletion, and statutory retention.

• Service-provider role. For California personal information, Citesvue acts as a “service provider” (CCPA/CPRA), “processor” (under VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, and similar US state laws). Citesvue does not sell, share, or process personal information for any purpose other than the limited and specified purpose of providing the Service to Customer.
• No combination. Citesvue will not combine personal information received from one Customer with personal information received from another Customer or any other source, except as expressly permitted by law to detect security incidents or perform another service-provider function on Customer’s behalf.
• Compliance. Citesvue will provide the same level of privacy protection as required of Customer; will notify Customer if it determines it can no longer meet its obligations; and will allow Customer to take reasonable steps to remediate unauthorised use.

• DPO / Privacy: dpo@citesvue.com
• Security incidents & vulnerabilities: security@citesvue.com
• Sub-processor list & trust portal access: security@citesvue.com
• Wet-signed DPA: /contact?topic=dpa