GDPR at Citation
Personal data processing, individual rights and accountability under the European data protection framework.
Scope at a glance.
- Framework
- GDPR
- Status
- Compliant
- Applies to
- Account information, customer content and service operations under the applicable controller and processor relationships.
Read this alongside the security controls and provider list for the features you plan to use.
Data protection in the writing workflow
Citation’s GDPR compliance approach covers personal information involved in accounts, documents, collaboration and service operations. The information required depends on the features you choose and the content you supply.
The privacy policy explains the purposes of processing and the providers involved. An organization using Citation may have its own responsibilities for personal information included in its documents. Applicable roles and obligations belong in the relevant data processing agreement.
Rights and requests
You can contact us about access, correction, deletion and other applicable privacy rights. Describe the request and the account or content involved without sending passwords or private access links. Identity and authority may need to be verified before protected information is disclosed or changed.
Document and reference exports help you take your work into other tools. Account exports, retention obligations and deletion requests can involve a different scope from downloading a single document.
Providers and international processing
Hosting, storage, AI and delivery services can involve more than one provider and location. Contact us for the processing arrangements and transfer safeguards applicable to your use. Do not assume that every feature is restricted to one country or region.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Data processing agreement and the parties’ roles
- Processing purposes, data categories and provider list
- Applicable international transfer safeguards
- Rights request, deletion and incident communication procedures
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Establish the lawful basis and notices for personal information your organization uploads.
- Limit personal data to what the workflow needs and review recipients before sharing.
- Discuss a data protection impact assessment when the intended processing requires one.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.