Data Processing Addendum
In the ordinary case this Addendum creates no processing relationship, because none exists. The Customer hosts the deployment, and the personal data of the persons authenticating against it remains with the Customer; Ydentifi neither receives that data nor has any route to it. Part B records that position. Part C sets out the terms under Article 28 of the GDPR which apply where, and only where, processing does arise.
1. Terms used in this Addendum
- Ydentifi is Ydentifi Ltd., a company registered in the Republic of Bulgaria under number 208962261, with its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad.
- The Customer is the organisation licensed to run the Software under the Terms of Service.
- The Software is the Ydentifi server, libraries and tooling the Customer deploys.
- End users are the people who authenticate against the Customer's deployment.
- GDPR is Regulation (EU) 2016/679. Controller, processor, personal data,
processing and personal data breach carry the meanings given there.
Part A — Roles
2. Controller, processor, or neither
The parties' roles differ by the data in question, and are not the same throughout.
| Data | Controller | Ydentifi's role |
|---|---|---|
| End-user authentication data on the Customer's deployment | The Customer | Neither controller nor processor |
| The Customer's business contact and licensing records | Ydentifi | Controller, independently |
| Data disclosed to Ydentifi in a support request (clause 5) | The Customer | Processor, for that request only |
Where each party is a controller in its own right, neither processes on the other's behalf, and this Addendum imposes no Article 28 obligations between them. What Ydentifi holds as controller, and on what basis, is set out in the Customer & Website Privacy Notice.
3. The Customer is the controller of end-user data
The Customer determines the purposes and means of processing personal data concerning its end users. It decides which authentication events are recorded, what is retained and for how long, and what its end users are told. Ydentifi has no part in those decisions and no ability to influence them.
The Customer is responsible for the lawfulness of that processing, for its own notice to its end users, and for responding to their requests. Nothing in the Software relieves it of that.
Part B — Why no processing relationship arises
4. The self-hosted deployment
The Software runs on infrastructure the Customer controls. Authentication traffic passes between the end user's device and the Customer's own server. Ydentifi operates no service in that path, hosts nothing, and holds no credential, key or access route into the deployment.
Because Ydentifi does not process personal data on the Customer's behalf, no Article 28 agreement is owed for the deployment, and any purported processor obligations in respect of it would describe processing that does not occur.
Two further facts support that position:
- Keys stay on the device. End-user private cryptographic keys are generated on the end user's device and
never leave it. Biometric verification is performed by the device; only its result is used.
- The application makes no call to Ydentifi. It communicates with the Customer's server, at the
address supplied in the setup code, and nowhere else.
This position holds only while those facts do. Should Ydentifi ever operate a hosted deployment, receive deployment telemetry containing personal data, or otherwise obtain access to end-user data, Part C applies to that activity and this Addendum requires amendment.
Part C — Where processing does arise
5. Scope of Part C
Part C applies only where the Customer discloses personal data to Ydentifi so that Ydentifi may act on the Customer's behalf — in practice, where the Customer supplies logs, diagnostic output or similar material in support of a request, and that material contains personal data. In that circumstance, and for that material only, Ydentifi acts as processor and the Customer as controller.
Part C does not apply to the deployment (Part B), nor to data Ydentifi holds as controller (clause 2).
The Customer is asked not to disclose personal data in a support request where the request can be answered without it. Ydentifi does not require it and will not ask for it as a matter of course.
6. Subject matter, duration, nature and purpose
| Subject matter | Personal data contained in material the Customer voluntarily discloses to Ydentifi in support of a request |
|---|---|
| Duration | The period necessary to answer the request, after which clause 12 applies |
| Nature and purpose | Diagnosis of a fault, question or incident raised by the Customer |
| Types of personal data | Determined by what the Customer discloses; typically identifiers, device information and event timestamps appearing in logs |
| Categories of data subject | The Customer's end users and its own personnel |
7. Processing on documented instructions
Ydentifi processes the personal data only on the Customer's documented instructions, including as to transfers, save where required by Union or Member State law to which Ydentifi is subject — in which case Ydentifi informs the Customer of that requirement before processing, unless the law prohibits it.
The support request itself constitutes the Customer's instruction. Ydentifi informs the Customer if, in its opinion, an instruction infringes the GDPR.
8. Confidentiality
Ydentifi makes the personal data available only to personnel who need it to answer the request, and who are bound by an appropriate obligation of confidentiality.
9. Security
Ydentifi implements appropriate technical and organisational measures under Article 32, having regard to the state of the art, the costs of implementation and the risks presented. Annex II records the measures in place.
10. Sub-processors
Ydentifi engages no sub-processor in respect of Part C material. Should that change, Ydentifi will give the Customer prior notice of the intended addition and a reasonable opportunity to object, and will impose on the sub-processor obligations no less protective than those in this Part.
11. Assistance
Taking into account the nature of the processing, Ydentifi assists the Customer by appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise data-subject rights, and assists the Customer in meeting its obligations under Articles 32 to 36 — including notification of a personal data breach and, where applicable, data protection impact assessments.
Ydentifi notifies the Customer without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting Part C material, with the information available to it.
12. Deletion or return
On completion of the request, and in any event on the Customer's instruction, Ydentifi deletes the personal data and any copies of it, unless Union or Member State law requires it to be retained. Ydentifi confirms deletion on request.
13. Audits and information
Ydentifi makes available to the Customer the information necessary to demonstrate compliance with this Part, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates. Given the narrow scope of Part C, the parties expect that a written response will ordinarily suffice.
14. International transfers
Ydentifi does not transfer Part C material outside the European Economic Area. Should a transfer become necessary, it will be made only on a lawful basis under Chapter V of the GDPR, and the Customer will be informed in advance.
Annexes
Annex I — Details of processing
The details required by Article 28(3) are at clause 6. There is no processing under Part B, so no Annex I entry arises for the deployment.
Annex II — Technical and organisational measures
Applicable to Part C material only.
- Access confined to named personnel handling the request.
- Encryption in transit; encryption at rest on the systems where such material is held.
- Retention limited to the life of the request, with deletion on completion.
- Logging of access to support material.
- Personnel bound by confidentiality obligations.
The measures protecting the Customer's own deployment are the Customer's responsibility.
Annex III — Sub-processors
None. See clause 10.
Contact
privacy@ydentifi.io
Ydentifi Ltd., Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad, Bulgaria. Company number 208962261.