Skip to main content
← Back

Data Processing Addendum

This addendum applies where an institutional or business customer ("Customer") uses Arabist to process personal data on behalf of individuals and where the GDPR, the UK GDPR, or an equivalent regime applies.

1. Roles

The Customer is the controller of any personal data submitted to Arabist. Arabist is the processor and processes that data solely to provide the service on the Customer's documented instructions, which are the Customer's use of the product features described at arabist.io and in the Terms of Use.

2. Scope of processing

  • Subject matter: providing the Arabist manuscript service.
  • Duration: while the Customer's account is active, plus the retention window described in the Privacy Notice.
  • Categories of data: account identifiers, uploaded manuscript content, usage metadata.
  • Categories of data subjects: the Customer's authorised users and any individuals depicted in or identified by uploaded manuscripts.

3. Confidentiality & security

Arabist commits personnel with access to personal data to written confidentiality obligations and maintains the technical and organisational measures described on the Trust & Security page, taken as a whole and updated over time.

4. Subprocessors

The Customer authorises Arabist to engage the subprocessors listed on the Subprocessors page. Arabist remains responsible for their performance and will provide reasonable advance notice, by email, of new subprocessors before granting them access to personal data.

5. Data-subject requests

Arabist will, taking into account the nature of the processing, provide reasonable assistance so the Customer can meet its obligations to respond to data-subject requests. Customers can self-serve export and deletion from the account page.

6. International transfers

Where personal data is transferred outside the EEA, the UK, or Switzerland to a country not covered by an adequacy decision, transfers are governed by the relevant Standard Contractual Clauses, incorporated here by reference.

7. Return & deletion

On termination, Arabist will delete or return personal data on the Customer's written request, subject to legal-retention obligations of Arabist and its payment subprocessor.

8. Contact

To countersign this DPA or request a signed copy, email privacy@arabist.io.