Data Processing Agreement
Last updated
This Data Processing Agreement ("DPA") supplements the OriginalityScan Terms of Service for institutional customers and applies whenever we process Personal Data on your behalf in connection with the Service. Capitalized terms not defined here have the meaning given in the GDPR or equivalent applicable law.
1. Roles
For Personal Data submitted to the Service, you are the Data Controller and OriginalityScan is the Data Processor. We process Personal Data only on documented instructions from you, including those expressed through configuration of the Service.
2. Subject matter and duration
- Subject matter: processing necessary to provide the plagiarism and AI-content detection Service.
- Duration: for the term of your subscription or contract, plus any retention periods required by law.
- Nature and purpose: ingestion, classification, and report generation; user authentication; billing.
3. Categories of data subjects and Personal Data
- Data subjects: end users of your account (students, faculty, staff, researchers).
- Personal Data: name, email address, role, account activity, billing reference, and the content of documents you submit for scanning.
4. Sub-processors
We may engage sub-processors to provide infrastructure (payment processing, cloud storage, email delivery). All sub-processors operate under written agreements imposing data-protection obligations no less protective than this DPA. A current list is available on request and we provide at least 30 days' notice before adding a new sub-processor.
5. Security measures
We maintain technical and organizational measures consistent with our published Security page, including:
- TLS in transit and industry-standard encryption at rest where applicable
- Role-based access controls with multi-factor authentication for production
- Documents deleted from temporary storage after report generation
- Continuous vulnerability scanning
- Audit logging with tamper-evident retention
6. Data subject rights
We will assist you in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) within the timelines required by applicable law. You can perform most requests directly through the admin console; for those that require our involvement, email [email protected].
7. Personal Data breach notification
We will notify you without undue delay, and in any event within 72 hours of becoming aware of a confirmed Personal Data breach affecting your data. Our notice will describe the nature of the breach, the categories and approximate volume of data subjects affected, the likely consequences, and the measures we have taken or propose to take.
8. International data transfers
Where Personal Data is transferred outside protected jurisdictions, we rely on the European Commission's Standard Contractual Clauses or an equivalent valid transfer mechanism.
9. Audits
We provide our security posture summary and questionnaire responses on request. For institutional customers with regulatory audit obligations, additional audit arrangements can be agreed in writing.
10. Return or deletion of data
On termination of the Service, and at your choice, we will return or delete all Personal Data we process on your behalf within 30 days, unless retention is required by law.
11. Changes
We may update this DPA where required by law or to reflect changes in sub-processors or operational practices. Material updates will be announced via email at least 30 days before taking effect.
12. Contact
Email [email protected] for any DPA-related question, to request signature, or to inquire about data handling.