Data Processing Addendum
This page is a structural placeholder. Section headings outline what the document will cover; the binding wording will be supplied by our legal counsel.
This Data Processing Addendum (DPA) forms part of the agreement between Grant Fund (processor) and the customer (controller) where Grant Fund processes personal data on the customer’s behalf, in accordance with Art. 28 GDPR.
1. Subject matter & duration
The subject matter, duration, nature and purpose of the processing are set out in the main agreement and in our Privacy Policy.
2. Nature of processing & categories
The categories of data subjects and personal data, and the processing operations, will be specified in an annex to this DPA.
3. Processor obligations
- Process personal data only on documented instructions from the controller.
- Ensure confidentiality of personnel authorised to process the data.
- Implement appropriate technical and organisational security measures.
- Assist the controller with data subject requests and security obligations.
4. Sub-processors
A current list of authorised sub-processors will be maintained and made available; the controller will be informed of intended changes.
5. International transfers
Any transfer outside the EU/EEA relies on an adequacy decision or Standard Contractual Clauses.
6. Security measures (Annex)
[PLACEHOLDER — technical and organisational measures (TOMs) annex]
7. Signing
A signable copy of this DPA is available on request at privacy@grantfund.eu.
Questions about your data?
For any privacy request or question, contact us at privacy@grantfund.eu.
Data Protection Officer: [PLACEHOLDER — to be appointed; name and contact details added here].