1Parties and roles
This Data Processing Agreement (DPA) forms part of the agreement between SMILE SERVICES SRL (TrustNet), Bdul. Decebal 84, Piatra Neamț, Neamț, Romania, and the RP operator that accepts it.
The parties acknowledge that the roles depend on the processing: TrustNet is the controller for account, persona, consent and audit data it determines the purposes of, and a processor for personal data it processes solely on the RP operator's documented instructions. Where TrustNet acts as processor, this DPA applies. Where it acts as controller, its Privacy Policy applies instead.
The allocation of roles for each data category is set out in the roles matrix below and must be completed with counsel before this DPA is signed.
| Data | TrustNet role | RP role |
|---|---|---|
| Account, login and session data | Controller | Independent controller for its own use |
| Personas and attribute mappings | Controller | Independent controller for data it receives |
| Consent decisions and audit trail | Controller | Independent controller for its own records |
| RP-directed processing under written instructions | Processor | Controller |
2Subject matter and duration
The subject matter is the provision of identity orchestration: RP registration, OIDC sign-in, consent capture, claim disclosure, the signed purge webhook and audit exports. The DPA lasts for the term of the RP agreement and until the processor has deleted or returned the personal data, subject to legal retention.
3Nature, purpose and data
- Nature: collection, storage, disclosure on consent, pseudonymisation, audit logging and deletion.
- Purpose: authenticate users and disclose only the claims an RP declares and a user approves.
- Data subjects: the RP's users (account holders) and, where the operator is an individual, the operator's own contact data.
- Data categories: account identifiers, persona labels and attribute values, approved claim names and values, consent records, RP registry metadata, technical logs (no claim values), and file metadata for uploaded pictures.
- Special categories: none are requested by default. An RP may not request special-category data without an Art. 9 condition and prior written agreement.
4Controller instructions
TrustNet processes personal data only on the RP operator's documented instructions, including the claims declared for each RP and the choices a user makes on the consent screen. TrustNet will inform the operator if an instruction, in its opinion, infringes the GDPR.
5Confidentiality
Personnel authorised to process personal data are bound by confidentiality and receive access only to the extent needed for their role.
6Security and TOMs
TrustNet implements the technical and organisational measures summarised in the Security / Trust Center and this annex:
- envelope encryption of attribute values with keys held in Vault; no plaintext attribute values in the personas database;
- lookup-by-value through HMAC blind indexes, never plaintext columns;
- pairwise PPIDs; account and persona ids never disclosed to an RP;
- least-privilege administrative access, separate machine and first-party planes, and backend-only Hydra/Kratos admin APIs;
- append-only audit events with a Merkle tree and signed tree heads; PII-free leaves;
- private files served only after a clean scan, with short-lived presigned access;
- signed RP purge webhooks, retry with delivery records, and audited account erasure.
The measures are reviewed as the service changes. No certification is claimed that TrustNet does not hold.
7Subprocessors
The current subprocessors and their locations are listed on the Subprocessors page. The operator receives notice of a new subprocessor before it starts processing, and may object on reasonable data-protection grounds. TrustNet imposes equivalent data protection obligations on each subprocessor.
8Assistance
TrustNet assists the operator with data-subject requests, DPIAs and prior consultations, taking into account the nature of the processing and the information available. Features that support this include access history, per-user export and account erasure.
9Personal data breaches
TrustNet notifies the operator without undue delay after becoming aware of a personal data breach affecting data processed on the operator's behalf, and provides the information needed for the operator's own notification. The breach runbook is maintained internally and made available to the operator on request.
10Deletion and return
On termination, TrustNet deletes or returns personal data as instructed, subject to legal retention. The RP-facing purge webhook and the audited account-erasure workflow implement deletion in the live service. The PII-free audit skeleton is retained for the periods described in the Privacy Policy.
11Audit
TrustNet makes available the information needed to demonstrate compliance and allows for audits, including inspections, by the operator or another auditor mandated by it, subject to confidentiality and reasonable notice. The audit trail and export surface support this.
12International transfers
The current deployment hosts the service and its processors in the EEA. If an optional adapter outside the EEA is enabled, TrustNet puts an appropriate transfer mechanism in place before the transfer and updates the Subprocessors page.
13Liability
Each party's liability under this DPA is subject to the limitations in the agreement between the parties and to mandatory law.
14Precedence and changes
If this DPA conflicts with the agreement, this DPA prevails for the processing it covers. Changes are agreed in writing; a change required by law may take effect when the law requires it.
15Contact
Data protection and DPA contact: privacy@trustnet.app.