Loading…
Loading…
Last updated: May 30, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and REQARCHITECT LTD, operating the Archiet platform ("Processor"), and reflects the parties' agreement on the processing of personal data in accordance with the EU GDPR, the UK GDPR, and the CCPA.
The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on the documented instructions of the Controller, including with regard to transfers, unless required to do otherwise by applicable law.
The Processor processes personal data to provide the Archiet architecture-to-code platform: account management, blueprint generation, compliance reporting, and related support. Categories of data subjects include the Controller's authorised users; data categories include account identifiers (name, email), workspace content, and usage metadata.
The Controller authorises the Processor to engage sub-processors for hosting, payments, email delivery, and LLM inference. A current list of sub-processors is available on request to privacy@archiet.com. The Processor remains responsible for sub-processors' compliance with this DPA and will give notice of intended changes.
The Processor implements appropriate technical and organisational measures, including encryption in transit (TLS), encryption at rest, access controls, httpOnly session cookies, audit logging, and tenant isolation. See our Security page for details.
Where personal data is transferred outside the UK/EEA, the parties rely on the UK International Data Transfer Agreement and/or the EU Standard Contractual Clauses, which are incorporated by reference.
The Processor will assist the Controller, by appropriate technical and organisational measures and insofar as possible, in fulfilling its obligations to respond to data subject requests and to ensure security, breach notification, and data protection impact assessments.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data.
On termination, the Processor will delete or return all personal data to the Controller, and delete existing copies unless retention is required by law.
The Processor will make available information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality and scheduling.
For a countersigned DPA or sub-processor list, contact privacy@archiet.com.
This document is provided for transparency. For an enterprise agreement, a countersigned copy is available on request.