Record of Processing Activities

Last updated: 12 September 2026 · Applies to: Converight v1.1.0 Maintained by: Thinkdata Labs LLP, trading as Converight

Kept under GDPR Article 30(2) for the processing we carry out on customers' behalf, and under Article 30(1) for the processing we carry out for our own purposes. Two roles, two records, kept in one document because the same systems serve both and separating them would invite drift.

Why this exists before the territorial-scope question is settled. Whether Art. 30 binds us directly depends on whether Art. 3(2) reaches our own processing, which is with counsel — see our Data Processing Map §7, available on request to security@converight.com. The record is required either way: Art. 28(3)(h) obliges us to make information available to demonstrate compliance, and the Standard Contractual Clauses require processing documentation independently of Art. 30. Only the legal basis for keeping it is pending, not the need.

Part A — Processing as a processor (Art. 30(2))

A1. The parties · Art. 30(2)(a)


Processor	Thinkdata Labs LLP, LLP AAI-9081, #176 First Floor, Sector-10, Panchkula, Haryana 134109, India
Trading name	Converight
Contact	`privacy@converight.com` · `security@converight.com`
Data protection officer	None appointed. Art. 37 does not require one: core activities do not consist of large-scale monitoring, and special-category data is not processed as a core activity.
Art. 27 representative	Undetermined, pending the Art. 3(2) analysis. Do not read the absence as a conclusion either way.
Controllers	Each customer whose Intercom workspace is connected. Maintained as a register in the `accounts` and `workspaces` tables and reproducible on request.

At the date above, no third-party customer workspace is connected. Every connected workspace belongs to Thinkdata Labs LLP itself.

A2. Categories of processing · Art. 30(2)(b)

Carried out on each controller's documented instructions, given through the product's own configuration — connecting a workspace, setting retention, placing a Legal Hold, requesting an erasure or an export.

Activity	What it involves
Collection	Read-only retrieval from the controller's Intercom workspace under OAuth, limited to five read scopes. An initial full backup, then daily synchronisation: conversations and contacts fetched incrementally by update time; other record types re-listed and stored only when changed
Storage	Encrypted archival to object storage under write-once retention
Indexing	Extraction of searchable identifiers so the controller can find a record
Retrieval	Search, transcript display, version history
Export	Generation of JSON, CSV and PDF with checksums, at the controller's request
Retention enforcement	Applying the controller's retention policy and Legal Holds
Erasure	Destroying a record's encryption key on the controller's instruction
Restriction	Blocking search, retrieval, export and ordinary access while preserving encrypted storage
Logging	Recording every access and every backup run to a tamper-evident log

No processing for our own purposes. Archived content is not used for product development, analytics, advertising, or training machine-learning models.

Categories of data subject

The controller's end users — people who contacted them through Intercom — and the controller's own staff, as authors of replies. End users have no relationship with us and have agreed to nothing with us. That is the defining feature of this processing.

Categories of personal data

Conversation content and metadata as held by Intercom: message bodies, author identity, names, email addresses, tags, timestamps, company associations, and help-centre articles.

Special categories are not requested and not filtered. A support conversation may contain anything an end user chose to type — health, financial or other special-category data can appear incidentally. We cannot inspect for it without reading the content we are paid not to read. Whether that risk is acceptable is the controller's assessment.

Not processed: attachments. A transcript referencing a file is archived; the binary is not.

A3. Transfers to third countries · Art. 30(2)(c)

Leg	Importer	Country	Status
Controller (via Intercom) → us	Thinkdata Labs LLP	India	This is the transfer. Mechanism conditional pending the Article 3 conclusion — see DPA §14.3 to §14.5.
Thinkdata → AWS India	Amazon Web Services India Private Limited	India (contracting); services operated in `us-east-1`	Contractual leg India to India; archive, exports, backups and Amazon SES
AWS onward infrastructure	Amazon Data Services, Inc.	United States (Northern Virginia)	Onward sub-processor operating the `us-east-1` infrastructure
Thinkdata → Render	Render Services, Inc.	United States (Virginia)	Application hosting, PostgreSQL including plaintext search identifiers, Key Value, environment secrets
Our staff accessing our own systems	—	India	Not a transfer. Internal processing within one legal entity; EDPB Guidelines 05/2021 criterion 2 requires disclosure to another controller or processor.

The transfer mechanisms and the documents establishing them are set out in the Data Processing Addendum and the transfer documents register.

The transfer impact assessment required by Clause 14 is outstanding, and until it is complete — together with the UK transfer risk assessment — we accept enquiries from EEA and UK customers but do not begin production processing involving a Restricted Transfer.

A4. Security measures · Art. 30(2)(d)

Set out in full at Security measures, written to drop into Annex II of the SCCs unchanged. In summary: envelope encryption with per-record keys and a root key held outside the database; per-workspace key isolation verified by test; five read-only OAuth scopes enforced by test; write-once storage with an organisation policy denying the bypass permission; a hash-chained audit log the database refuses to update or delete; reconciliation of archived counts against the source; and restore testing.

That document also lists what we do not have.

Part B — Processing as a controller (Art. 30(1))

For data we process for our own purposes rather than a customer's.

B1. Controller

Thinkdata Labs LLP, as above. privacy@converight.com.

B2. Purposes, subjects, data, recipients and retention

Purpose	Data subjects	Personal data	Recipients	Retention
Providing the service — accounts, authentication, access control	Our customers' staff	Email address, name, role, creation and last sign-in times	Render (hosting), Amazon SES (sign-in links)	For the life of the account
Security and accountability	Anyone acting in the product	Audit entries recording who did what, including actor email address	Render	Indefinite. The log is append-only by database trigger — see the note below.
Sales enquiries	Prospective customers	Email address, company, plan of interest, free-text notes	Render, Amazon SES	365 days from the date handled, or from arrival if never handled
Billing	Billing contacts	Name, email, company, invoices and subscription status	None — invoiced directly	For the life of the account and as tax law requires
Error diagnosis	Anyone triggering an error	Stack traces and request metadata, with cookies, tokens and key material redacted	Sentry, only if a DSN is configured	Per Sentry's retention
Transactional email	Our customers' staff	Email addresses and message content	Amazon SES	Per SES's retention

On the audit log's indefinite retention. It is the tamper-evidence the product sells, and a log that can be pruned proves nothing. It is append-only at the storage layer — the database rejects UPDATE and DELETE on that table by trigger, not by convention. It contains actor email addresses, so this is a deliberate retention decision rather than an oversight, and it is one counsel should confirm is proportionate.

Lawful bases. Performance of a contract for service provision and billing; legitimate interests for security logging and sales enquiries.

B3. Transfers

Our own processing runs on the same infrastructure: Render and AWS in the United States, administered from India. As the controller of this data we are the exporter, and the same mechanisms pending in A3 apply.

B4. Security measures

As A4. The same systems hold both.