Acceptance, precedence, and where this DPA fits.
- Acceptance. By accepting the Terms or executing an Order Form, Customer accepts this DPA.
- Parties. The “Processor” is Citesvue Inc. (or the contracting Citesvue affiliate named in the Order Form). The “Controller” is the Customer entity that owns the workspace.
- Precedence. In any conflict between this DPA and the Terms with respect to the processing of personal data, this DPA prevails.
- Scope. This DPA covers Citesvue’s processing of personal data on Customer’s behalf in connection with the Service. Account registration data and billing data, where Citesvue acts as an independent controller, are governed by the Privacy Policy.
The terms we use, the way we use them.
- “Applicable Data Protection Law” means the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, etc.), and any successor or equivalent law applicable to the processing.
- “Customer Personal Data” means personal data contained in Customer Content or otherwise processed by Citesvue on Customer’s behalf.
- “Sub-processor” means any third party engaged by Citesvue to process Customer Personal Data on Customer’s behalf.
- “SCCs” means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), as supplemented by the UK Addendum where applicable.
- “Personal Data Breach” has the meaning given in Article 4(12) GDPR.
- Other capitalised terms have the meanings given in the Terms or in Applicable Data Protection Law.
Customer is the Controller. Citesvue is the Processor.
For Customer Personal Data, Customer is the Controller (or, where Customer acts as a processor for a third party, the Processor) and Citesvue is the Processor (or sub-processor, respectively). The processing details required by Article 28(3) GDPR are set out below.
| Element | Description |
|---|---|
| Subject matter | Operation of the Citesvue platform - converting recorded sessions into structured, citable evidence. |
| Duration | For the term of the subscription, plus the post-termination retention window in /privacy. |
| Nature & purpose | Hosting, ingestion, transcription, visual analysis, artifact extraction, search and retrieval, integration delivery, audit logging. |
| Categories of data subjects | Customer’s employees, contractors, customers, prospects, and any other individuals whose voice, image, or screen content appears in recordings Customer chooses to upload. |
| Categories of personal data | Identifiers (name, email, role); audio recordings; video recordings; on-screen text and images; transcripts; comments and annotations; usage telemetry; authentication metadata. |
| Special category data | Not requested or required by the Service. May appear incidentally in recordings; Customer is responsible for assessing lawful basis where this occurs. |
| Frequency of processing | Continuous, for the duration of the subscription. |
We process on documented instructions.
Citesvue will process Customer Personal Data only on the documented instructions of Customer, including with respect to international transfers. Customer’s instructions are: (a) the Terms and this DPA; (b) the configurations Customer makes in the Service (workspace settings, integration configurations, member roles); and (c) any further written instructions Customer provides.
If Citesvue believes an instruction violates Applicable Data Protection Law, Citesvue will inform Customer in writing without delay (subject to legal restrictions).
Categories listed here. Named list available on request.
Customer authorises Citesvue to engage Sub-processors to provide the Service. The categories of Sub-processors and their function are listed below. The named list of Sub-processors (with entity name, country of operation, and function) is available on request via security@citesvue.com.
| Category | Function | Region(s) |
|---|---|---|
| Cloud infrastructure | Compute, object storage, networking, queues | Global edge network |
| Speech-to-text provider | Speaker-aware ASR | US / EU |
| Visual analysis & OCR provider | Frame analysis and on-screen text extraction | US / EU |
| LLM provider(s) | Artifact extraction & Q&A - zero-retention API mode where supported; no training on inputs | US / EU |
| Email & transactional messaging | Service emails and security advisories | US / EU |
| Application observability | Error tracking, performance traces, structured logs (PII-stripped) | US / EU |
| Customer support tooling | Ticketing and customer correspondence | US / EU |
| Payments processor | Card processing - PCI-DSS Level 1; Citesvue does not store PAN data | US / EU |
Notice & objection. Citesvue will give Customer at least 30 days’ notice before engaging a new Sub-processor, by email to workspace owners. During that window, Customer may object on reasonable data-protection grounds; if the parties cannot agree on a remedy, Customer may terminate the affected portion of the Service for convenience and receive a pro-rata refund of pre-paid fees.
Sub-processor obligations. Citesvue will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA. Citesvue remains liable for the acts and omissions of its Sub-processors as if they were its own.
SCCs by default. Adequacy where it exists.
| Scenario | Mechanism | Parties |
|---|---|---|
| Customers in the UK | Citesvue → Customer: UK GDPR controller-to-processor SCCs (UK Addendum to the EU SCCs, Module Two). | Customer ↔ Citesvue UK Ltd. |
| Customers in the EU/EEA | Citesvue → Customer: EU SCCs (2021/914), Module Two - controller to processor. | Customer ↔ Citesvue EU GmbH. |
| Sub-processors outside EU/UK | EU SCCs Module Three (processor-to-processor) where the sub-processor is the data importer. | Citesvue ↔ Sub-processor. |
| Adequacy decisions | Where the destination country has an adequacy decision (e.g. UK ↔ EU; UK Extension to the EU-US Data Privacy Framework), we rely on the adequacy decision. | No SCCs required for that leg. |
The SCCs are deemed incorporated into this DPA by reference. The selections required by the SCCs (Module, optional clauses, Annexes) are completed as set out in the Schedule to this DPA. Where Annexes refer to specific information, the contents of this DPA, the Order Form, and the named Sub-processor list (available on request) constitute that information.
The controls in force, in plain language.
| Domain | Measure |
|---|---|
| Encryption | TLS in transit on every connection; AES-256 at rest on managed storage and databases; OAuth tokens and comparable secrets carry an additional application-level AES-256-GCM layer with purpose-scoped keys. |
| Access control | Role-based, least-privilege access; production credentials are held as platform-managed secrets, never in source control, and production access is limited to authorised personnel. |
| Network controls | The service runs on a managed serverless edge platform; ingress is restricted to documented API endpoints, internal services are not directly routable from the public internet, and DDoS protection is applied at the edge. |
| Tenant isolation | Logical isolation enforced at the data layer: every query is scoped to the customer workspace, and cross-tenant access is treated as a defect of the highest severity. |
| Vulnerability management | Dependency vulnerabilities are monitored and patched as part of the development workflow; security advisories in the framework and runtime stack are applied promptly. Reports to security@citesvue.com are triaged with priority. |
| Endpoint security | Devices used to operate the service use full-disk encryption and current, patched operating systems; production access requires authenticated tooling. |
| Personnel security | Personnel with access to production systems are bound by confidentiality obligations and acceptable-use policies. |
| Backup & recovery | Data is stored on managed, replicated infrastructure with encrypted storage; recovery capabilities follow the underlying platform’s durability and restore features. |
| Audit logging | Security-sensitive events (authentication, password changes, membership changes) are recorded in an internal audit trail retained per the privacy policy. |
| Secure SDLC | Code review and automated test gates before deployment; versioned deploys with rollback capability; security-relevant changes receive additional scrutiny. |
| Incident response | Incidents are triaged ahead of all other work, with root-cause analysis after resolution and customer notification per the breach clause below. |
Citesvue is not currently certified against ISO 27001 or SOC 2 and does not claim to be. The controls we actually operate are described publicly on /security; certification programmes will be announced there when a report exists.
A clear timeline and a single inbox.
- Notification window. Citesvue will notify the affected Customer’s designated security and privacy contacts without undue delay and in any event within 72 hours after becoming aware of a confirmed Personal Data Breach affecting that Customer’s data.
- Contents of the notice. To the extent then known, the notice will include (a) the nature and likely consequences of the breach; (b) the categories and approximate volume of personal data and data subjects affected; (c) the measures taken or proposed; and (d) a single point of contact for follow-up. We will update Customer as the investigation progresses.
- No supervisory-authority notification by Citesvue. Customer remains the controller and is responsible for any required notification to supervisory authorities or data subjects. Citesvue will provide reasonable assistance.
- Cooperation. Citesvue will document the breach, the measures taken, and any remediation, and will make this documentation available to Customer.
How we help you respond.
Citesvue will provide Customer with the in-product functionality and reasonable assistance necessary to enable Customer to fulfil its obligations to respond to data-subject requests under Applicable Data Protection Law.
| Right | How Citesvue assists |
|---|---|
| Access | Customer can self-serve via account export. Citesvue assists where the request is routed via Customer. |
| Rectification | In-product editing for most fields; Citesvue assists for system-managed fields where required. |
| Erasure | Recording- or account-level deletion in-product. Citesvue purges across primary stores, derived stores, and search indices; managed-platform backups age out per the provider’s rotation cycle. |
| Restriction | On Customer’s written instruction. |
| Portability | Bulk export (JSON/CSV/DOCX/PDF) in-product; full-workspace export via API. |
| Objection | On Customer’s written instruction. |
If a data subject contacts Citesvue directly with a request relating to Customer Personal Data, Citesvue will (where lawful) refer the data subject to Customer and inform Customer of the request without undue delay.
Documentation, reports, and on-site at reasonable cadence.
- Documentation. Customer may request, no more than once per twelve months, a completed security questionnaire and a written description of Citesvue’s current controls. Independent audit reports will be added to this commitment if and when they are issued.
- On-site / virtual audit. Where Customer reasonably believes documentation is insufficient (e.g. following a confirmed Personal Data Breach affecting Customer), Customer may, at its own expense, conduct or commission an audit of Citesvue’s controls relevant to the processing of Customer Personal Data. The parties will agree the scope, timing, and confidentiality terms in advance, and will conduct the audit during business hours and in a manner that does not interfere with Citesvue’s operations.
- Independent auditor. Audits performed by a third party require a mutually acceptable auditor under written confidentiality terms.
What happens to the data when the contract ends.
- Export window. For 30 days after termination, Customer may export Customer Personal Data via in-product export or the API.
- Deletion. After the export window (or earlier on Customer’s written instruction), Citesvue will delete Customer Personal Data from primary stores, derived stores, and search indices; managed-platform backups age out per the provider’s rotation cycle. Written confirmation of deletion is provided on request.
- Retention exceptions. Citesvue may retain Customer Personal Data only to the extent and for the period required by applicable law (e.g. statutory tax/finance retention for invoices).
One liability cap covers everything.
Each party’s liability under this DPA is subject to the limitation of liability in the Terms. The limit applies in aggregate across all claims under the Terms and the DPA combined. Nothing in this DPA limits a party’s liability where such limitation is not permitted under Applicable Data Protection Law.
The DPA lives as long as the processing.
This DPA is effective from Customer’s acceptance of the Terms (or signature of an Order Form referencing this DPA) and continues for as long as Citesvue processes Customer Personal Data, plus any post-termination period required for return, deletion, and statutory retention.
CCPA/CPRA service-provider terms and equivalents.
- Service-provider role. For California personal information, Citesvue acts as a “service provider” (CCPA/CPRA), “processor” (under VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, and similar US state laws). Citesvue does not sell, share, or process personal information for any purpose other than the limited and specified purpose of providing the Service to Customer.
- No combination. Citesvue will not combine personal information received from one Customer with personal information received from another Customer or any other source, except as expressly permitted by law to detect security incidents or perform another service-provider function on Customer’s behalf.
- Compliance. Citesvue will provide the same level of privacy protection as required of Customer; will notify Customer if it determines it can no longer meet its obligations; and will allow Customer to take reasonable steps to remediate unauthorised use.
The single inbox per topic.
- DPO / Privacy: dpo@citesvue.com
- Security incidents & vulnerabilities: security@citesvue.com
- Sub-processor list: security@citesvue.com
- Wet-signed DPA: /contact?topic=dpa