Data Processing Addendum
Standard terms for paid pilots · Citeqly Ops Ltd (CRO 788421) · Last updated 15 January 2026
1. Roles
Customer is controller. Citeqly Ops Ltd is processor for Customer Personal Data and Customer Content uploaded to a pilot workspace (policies, questionnaires, drafts, approvals, audit metadata).
2. Subject matter & duration
Processing is limited to providing seller-side DDQ drafting, citation retrieval, human approval, export, and pilot reporting. Duration equals the pilot term. Unless Customer requests a longer export retention window in writing, Citeqly deletes the workspace within 30 days after engagement end.
3. Security measures
MFA for admin access; TLS in transit; encryption at rest for workspace stores; least-privilege access; approval/export audit logs; EU primary hosting (Ireland region). Sev1 personal-data incidents: notify Customer without undue delay and within 72 hours where GDPR Art. 33 applies.
4. Subprocessors & transfers
Current subprocessors are listed at /subprocessors. Material changes: ≥14 days notice where practicable. Transfers outside the EEA use Standard Contractual Clauses (or equivalent lawful mechanism). Customer content is not used to train foundation models.
5. Assistance & audits
Citeqly assists with data-subject requests and DPIA inputs reasonably required for the pilot. Customer may diligence Citeqly via security questionnaire during the pilot. On written request after deletion, Citeqly confirms wipe completion.
6. Execution
These DPA terms apply to paid pilots. The pilot order form incorporates this DPA by reference. Contact: legal@citeqly.com / privacy@citeqly.com. Registered office: The Academy, 42 Pearse Street, Dublin 2, D02 YA89, Ireland.