This agreement forms part of the Octyn Terms & Conditions. It applies whenever your organisation uses Octyn to process personal data.
01 Parties and scope
This Data Processing Agreement ("DPA") is between two parties. One is the organisation that subscribes to Octyn ("you", the Data Fiduciary). The other is Zenithyn Technologies Private Limited ("we", the Data Processor), which operates Octyn.
It covers personal data that you, your staff and your users enter into or upload to Octyn, and that we process to provide the service. It does not cover personal data we collect for our own purposes. For example, we collect data to run your subscription or our website. The Privacy Policy covers that data, and for it we are the Data Fiduciary.
By accepting the DPA when you sign up or set up your organisation, you agree to it on behalf of your organisation.
02 Definitions
"Personal data", "processing", "Data Fiduciary", "Data Processor", "Data Principal", "personal data breach" and "Board" have the meanings given in the Digital Personal Data Protection Act 2023 ("DPDP Act") and the rules made under it. "Customer data" means the personal data described in section 4.
03 Roles of the parties
You decide why and how customer data is processed. That is, which staff, customers and vehicles you record, what you keep, and who in your organisation may see it. We process customer data only on your documented instructions. Those instructions are the Terms, this DPA and your use of Octyn's features.
You are responsible for having a lawful basis for the personal data you put into Octyn. You are also responsible for giving your staff and customers any notice the DPDP Act requires. If we believe an instruction breaks the law, we will tell you and may decline it.
04 What we process
| Item | Detail |
|---|---|
| Data Principals | Your owners, managers, cashiers and accountants who use Octyn. Your staff and attendants. Your credit customers and their drivers. Your suppliers' contact people. |
| Personal data | Names, phone numbers and email addresses. Staff wages, attendance, advances, bonuses and bank details. Staff documents you upload. Shift PINs (stored hashed). Credit-customer contacts, vehicle numbers and balances. Invoices and statements that carry these. |
| Purpose | Running your station on Octyn: shifts, cash, credit, purchases, retail, payroll, accounts, compliance and reports. This includes reading uploaded purchase invoices automatically. |
| Duration | For the life of your subscription, then as set out in section 11. |
Octyn is not designed for children's data or for special categories of data beyond what payroll requires. Please do not upload anything else.
05 Our obligations
As your Data Processor, we do the following.
- Instructions only — we use customer data only to provide and support Octyn for you. We never use it for advertising, and we never sell it.
- Confidentiality — everyone at Zenithyn with access to customer data is bound by confidentiality. Access is limited to those who need it.
- Security — we apply the measures in section 8.
- Sub-processors — we engage them only as set out in section 6.
- Assistance — we help you respond to Data Principals and meet your DPDP duties, as set out in section 10.
06 Sub-processors
You authorise us to use the following sub-processors. We require each of them to protect customer data at least as well as this DPA does.
| Sub-processor | What it does for Octyn | Where it processes |
|---|---|---|
| Supabase | Database, sign-in and file storage for all customer data. | India (Mumbai, ap-south-1). |
| Cloudflare | Hosts the Octyn app. Stores invoice uploads and runs the processing queues. Gives bot protection on sign-in. Reads the purchase-invoice PDFs you upload (Workers AI, open-source Llama model). | Cloudflare's global network. |
| Anthropic | Fallback only. Reads an uploaded purchase invoice that the primary reader could not read reliably. | United States. |
| Resend | Sends the emails Octyn sends: sign-in links, invitations, reminders and statements. | United States. |
| Razorpay | Subscription payments (your billing contact's details, not your station's data). | India. |
We will give you at least 30 days' notice before adding or replacing a sub-processor. We will do so by email and on this page. If you object on reasonable data-protection grounds, we will discuss it with you in good faith. If we cannot resolve it, you may stop using the affected feature or cancel your subscription. Refunds follow our Refund Policy.
07 Transfers outside India
Your records live in Octyn's database, which is in India. Some customer data is processed outside India, as the table in section 6 shows. Purchase-invoice files you upload are held and read on Cloudflare's network. An invoice the primary reader cannot read reliably may be sent to Anthropic in the United States. And email is sent through a United States provider. We do not transfer customer data to any country the Central Government has restricted under section 16 of the DPDP Act.
08 Security
We protect customer data in these ways.
- Row-level security in the database keeps each organisation's data apart. So one organisation cannot read another's records.
- Within your organisation, what each person can see and change follows their role (owner, manager, cashier, accountant). This is enforced on the server as well as in the app.
- Traffic is encrypted in transit (TLS). Our infrastructure providers encrypt data at rest.
- Two-factor sign-in is available to every user. Our security guide shows how to turn it on.
- Financial actions are recorded in an audit log. These are postings, reversals, overrides and reopens.
- Shift PINs are stored only as hashes. Staff bank details are stored encrypted.
Our wider measures are described in section 8 of the Privacy Policy.
09 Personal data breaches
If we become aware of a personal data breach affecting customer data, we will tell you without undue delay and in any case within 72 hours. We will tell you what we know about it. That covers its nature, the data and Data Principals affected, its likely consequences and the steps we are taking. We will update you as we learn more. We will also help you with any notice you must give the Board or Data Principals.
10 Helping you meet your duties
Octyn lets you view, correct, export and delete the records you keep. A Data Principal may contact us directly about customer data. If so, we will pass the request to you. We will not answer it ourselves unless you ask us to. On request we will give you reasonable help with your own obligations. This includes information for any assessment you carry out.
11 Return and deletion
While your subscription is active, you can export your data at any time (CSV, Excel, PDF and the CA pack). Before termination you can ask us for a full export at hello@octynerp.com. After termination we delete customer data, except where the law requires us to keep it. Tax and GST records are an example. In that case we keep only what is required, for as long as it is required, and then delete it. Retention periods are listed in section 7 of the Privacy Policy.
12 Information and audits
On reasonable written request, we will give you the information you need to confirm we are meeting this DPA. We will do this not more than once a year, unless a breach or a regulator requires it. Where our sub-processors publish independent certifications, we will point you to them.
13 Term, precedence and law
This DPA lasts as long as we process customer data for you. If it conflicts with the Terms on how personal data is processed, this DPA prevails. The limitations of liability in the Terms apply to it. It is governed by the laws of India. The dispute-resolution and jurisdiction clauses of the Terms apply to it.
14 Contact
Send any question about this DPA to us here.
- Email — hello@octynerp.com (subject "DPA").
- Grievance Officer — as named in the Privacy Policy.