Data Processing Addendum
Last updated: 1 October 2026. This mirrors cite.citely.co.uk/legal/* — the app and the marketing site run the same text, maintained in two places until a shared source is wired post-launch.
This DPA applies where Citely Limited processes personal data on behalf of a partner under the UK General Data Protection Regulation and the Data Protection Act 2018. By using Cite as a partner, you agree to this DPA.
Roles
The partner is the controller for personal data of its own employees and prospective hires that it processes via the service. Cite is the processor in respect of that data and the controller in respect of candidate accounts created directly on Cite.
Scope and duration
Processing is limited to what's necessary to deliver the service and lasts for the duration of the partner's subscription plus a 90-day return-or-delete window.
Sub-processors
A current list of sub-processors is available at cite.citely.co.uk/legal/dpa. We give 30 days' notice of changes and allow partners to object on reasonable grounds.
International transfers
We rely on the UK IDTA and the UK Addendum to the EU SCCs for transfers outside the UK. Sub-processors are bound by equivalent obligations.
Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest for candidate data, strict access controls, audit logging (90-day retention), and documented incident response.
Breach notification
We notify partners of a personal-data breach without undue delay and in any event within 72 hours of becoming aware, with the information required by UK GDPR Art. 33.
Contact
Partner DPA queries: [email protected]. Registered office: 8 Grange Road, Rugby, CV21 1EJ. Company number: 17304722.