content/legal/README.md.Data Processing Addendum
Effective: [[EFFECTIVE_DATE]] Between: you (the Customer, controller) and Thinqmesh Technologies (the provider of Orfyn; "Orfyn" below refers to Thinqmesh Technologies acting in respect of the Orfyn product)
This addendum applies where Orfyn processes personal data on the Customer's behalf. It supplements the Terms of Service.
0. Read this first — the scope is unusually narrow
Orfyn is self-hosted. The daemon runs on the Customer's own infrastructure, under the Customer's credentials, and processes the Customer's data without transmitting it to Orfyn.
For personal data inside the Customer's systems, repositories, prompts, and agent activity, Orfyn is not a processor, because Orfyn never receives that data. The Customer is the controller and, in operating the daemon on its own infrastructure, performs the processing itself.
This addendum therefore covers the narrow set of processing Orfyn actually performs:
| Activity | Orfyn's role |
|---|---|
| Meeting-request form and business correspondence | Controller (see the Privacy Policy) |
| Optional relay transport of end-to-end encrypted traffic | Processor, limited to routing ciphertext it cannot read |
| Support, where the Customer voluntarily sends us material | Processor, for the duration of that request |
Procurement teams frequently expect a broad DPA. The honest answer is that the architecture removes most of what a DPA usually has to govern. That is a feature, and it is worth saying so in the review rather than signing up to obligations over data we do not hold.
1. Definitions
"Data Protection Law" means the Digital Personal Data Protection Act 2023 (India), the UK GDPR, the EU GDPR, and any other applicable data protection law. Where this addendum uses GDPR terminology, the equivalent concepts under the DPDP Act apply — "Data Fiduciary" for controller, "Data Processor" for processor, and "Data Principal" for data subject. "Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in that law. "Sub-processor" means a processor engaged by Orfyn.
2. Roles and instructions
Where Orfyn acts as processor it will process Personal Data only on documented instructions from the Customer, including for international transfers, unless required otherwise by law — in which case Orfyn will inform the Customer first unless legally prohibited.
Orfyn will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
3. Details of processing (Annex I)
Subject matter: transport of end-to-end encrypted traffic between the Customer's clients and the Customer's daemon, and any support material the Customer chooses to send.
Duration: for the relay, the life of a connection plus any operational log retention. For support material, until the request is resolved and any agreed retention expires.
Nature and purpose: routing encrypted traffic; responding to support requests.
Types of Personal Data: for the relay, none in intelligible form — traffic is end-to-end encrypted and Orfyn cannot decrypt it. Connection metadata may be processed transiently. For support, whatever the Customer chooses to send, which the Customer should minimise.
Categories of data subject: the Customer's personnel and, potentially, individuals whose data is present in material the Customer voluntarily sends.
Special category data: none is requested, and the Customer must not send it in support material.
4. Confidentiality
Orfyn ensures that personnel authorised to process Personal Data are bound by confidentiality obligations and receive appropriate training, and it limits access to those who need it.
5. Security (Annex II)
Taking into account the state of the art and the risks, Orfyn maintains:
- End-to-end encryption of relay traffic, such that Orfyn cannot access plaintext
- Encryption in transit for its own services
- Role-based access control and least-privilege administration
- Multi-factor authentication for administrative access
- Logging and monitoring of its own infrastructure
- A documented vulnerability disclosure route at security@thinqmesh.com
- Periodic review of these measures
Division of responsibility. Security of the daemon, the host it runs on, network access
to it, and the credentials it uses is the Customer's, because that infrastructure is the
Customer's. ../04-security.md sets out this division in operational
detail.
6. Sub-processors
The Customer gives general authorisation for Orfyn to engage the sub-processors listed in
sub-processors.md. Orfyn will give at least 30 days' notice
before adding or replacing one, and the Customer may object on reasonable data-protection
grounds. Orfyn imposes data protection obligations on each sub-processor no less protective
than those in this addendum and remains liable for their performance.
7. Data subject rights
Given the architecture, the Customer can satisfy most data subject requests directly, since the data resides on the Customer's own infrastructure. For processing where Orfyn is processor, Orfyn will assist the Customer by appropriate technical and organisational measures, and will promptly forward any request it receives directly rather than responding to it itself.
8. Personal data breach
Orfyn will notify the Customer without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting Personal Data it processes for the Customer, with the information reasonably available, and will cooperate in investigation and remediation.
9. Assistance
Orfyn will provide reasonable assistance with data protection impact assessments and prior consultations, taking into account the nature of processing and the information available to it.
10. Deletion and return
On termination, Orfyn will delete or return Personal Data it processes for the Customer, except where storage is required by law. Data on the Customer's own infrastructure is unaffected — Orfyn has no access to it and cannot delete it.
11. Audit
Orfyn will make available information reasonably necessary to demonstrate compliance with this addendum and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable notice, no more than once per year except following a breach, and subject to confidentiality.
12. International transfers
Where Orfyn transfers Personal Data outside the UK/EEA it relies on an adequacy decision or the Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), with appropriate supplementary measures. The SCCs are incorporated by reference, with Orfyn as data importer, this addendum's annexes populating theirs, and India as the governing law and forum where the clauses permit a choice.
13. Order of precedence
In case of conflict: the SCCs, then this addendum, then the Terms of Service.
Data protection contact: privacy@thinqmesh.com