Data Processing Addendum (DPA)
This Data Processing Addendum ("DPA") supplements the Tayeno Terms of Service and applies where Tayeno processes personal data on behalf of business customers ("Controllers") in the United Kingdom or European Economic Area.
1. Scope and Processing Details
Subject Matter: Provision of AI chief-of-staff services (email triage, meeting prep, drafting).
Duration: The duration of the active subscription plus a 30-day post-termination deletion buffer.
Data Subjects: Customer's employees, correspondents, clients, and prospective business contacts.
Categories of Data: Names, email addresses, email message headers & bodies, calendar event metadata, publicly accessible company web data.
2. Obligations of Processor (Tayeno)
- Process personal data strictly on documented instructions from the Controller.
- Ensure all personnel and subprocessors are bound by statutory confidentiality duties.
- Maintain technical measures including AES-256-GCM vault encryption, per-tenant Linux isolation, and outside-LLM secret resolution.
- Notify the Controller without undue delay and in any event within 24 hours upon becoming aware of any confirmed personal data breach.
- Delete or return all customer personal data upon termination of the subscription.
3. Sub-Processors & International Transfers
Controller grants general authorization for Tayeno to engage the sub-processors listed in our Privacy Policy (Hetzner Online GmbH, DeepSeek [Hangzhou DeepSeek AI Co., Ltd.], Stripe Payments UK Ltd, Telegram FZ-LLC). Inference prompts and email processing requests are transmitted directly to DeepSeek API infrastructure located in Hangzhou, China. In the absence of an adequacy regulation or executed International Data Transfer Agreement (IDTA) / Standard Contractual Clauses (SCCs), international transfers for model inference rely on explicit consent under UK GDPR Article 49(1)(a) provided by the Controller upon mailbox connection. Tayeno is actively working to establish appropriate contractual transfer safeguards and will notify Controller of any intended changes to sub-processors or transfer mechanisms at least 14 days in advance.