Data Processing Terms
Version 1.0-draft (QC-035) · Last updated 18 August 2026
These Data Processing Terms have not received solicitor review -- they have been prepared for owner and legal review ahead of public launch. They describe how Adam Wright, trading as Orryn, operating Orryn Quote Tracker (“Processor”), processes personal data on behalf of a subscribing business (“Controller”) through its connected Gmail mailbox, supplementing our Terms of Service.
1. Subject matter and duration
The Processor processes personal data on the Controller’s behalf for as long as the Controller has an active Orryn Quote Tracker subscription, plus the post-termination retention/deletion period described in the Privacy Policy.
2. Nature and purpose of processing
Detecting quotations sent from the Controller’s Gmail mailbox, monitoring the resulting conversations, extracting quotation fields, calculating follow-up priority, and preparing suggested reply/follow-up drafts for the Controller’s review.
3. Categories of personal data
- Identity and contact details of the Controller’s customers appearing in quotation emails (name, email address, and any content included in the message/attachment).
- Message and attachment content relevant to a quotation.
- Extracted quotation fields, notes and outcome feedback.
4. Categories of data subjects
The Controller’s customers and prospective customers who appear in quotation-related Gmail correspondence.
5. Documented instructions
The Processor processes personal data only on the Controller’s documented instructions, being: providing the Orryn Quote Tracker service as configured by the Controller (detection patterns, follow-up settings) and as described in the Privacy Policy, unless required to do otherwise by law -- in which case the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits this.
6. Confidentiality
The Processor ensures that anyone authorised to process personal data is bound by an appropriate confidentiality obligation.
7. Security
The Processor implements appropriate technical and organisational measures, including encryption in transit and at rest, additional encryption for Gmail credentials, tenant-isolated database access (Row Level Security), server-side authorisation on privileged operations, and redacted logging that excludes message content and credentials -- summarised in the Privacy Policy without exposing implementation detail that could assist an attacker.
8. Subprocessors
The Controller grants the Processor general authorisation to engage subprocessors to provide the service, published and kept current on the Subprocessors page. The Processor will give reasonable notice of a new subprocessor with a material impact on the Controller’s data (for example, by updating that page and, where practical, an in-product or email notice), and remains responsible for each subprocessor’s compliance with equivalent data-protection obligations.
9. International transfers
Where a subprocessor processes personal data outside the UK/EEA, the Processor relies on that subprocessor’s own published transfer safeguards (such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses) -- see the Subprocessors page for each provider’s current position.
10. Assistance with data-subject rights
The Processor will provide reasonable assistance to the Controller in responding to requests from data subjects to exercise their rights under applicable data-protection law, taking into account the nature of the processing and the information available to the Processor.
11. Personal data breach assistance
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide reasonable information to help the Controller meet its own notification obligations -- see our Personal Data Incident Response runbook for the internal process this commitment is built on.
12. DPIA and regulator assistance
Where reasonably required and where information is available to the Processor, the Processor will provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with a supervisory authority.
13. Deletion or return of data
On termination of the Orryn Quote Trackersubscription, the Processor will make the Controller’s data available for export for the post-termination retention period described in the Privacy Policy, after which it is deleted in line with that policy’s retention schedule (including the encrypted-backup expiry window), unless the Processor is required by law to retain limited segregated records.
14. Audit and compliance information
The Processor will make available information reasonably necessary to demonstrate compliance with this Section and will allow for and contribute to reasonable audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality and scheduling to avoid disruption to other customers’ service or security.
15. Controller responsibilities
The Controller remains responsible for the lawfulness of the instructions it gives the Processor, for its own notices and consents to its customers, and for the accuracy of any information it provides.
16. Contact
Data-processing/privacy questions: privacy@orryn.studio. Security incidents: security@orryn.studio. General support: support@orryn.studio.