Data Processing Agreement

1. Scope and instructions

This agreement governs personal data processed by OVERMATCH OÜ on behalf of the customer that operates a Grantboard workspace. The customer is the controller; OVERMATCH OÜ is the processor. Annexes I to IV form part of this agreement and set out the parties, subject matter, duration, nature and purposes of processing, data types, data subjects, security measures and authorized sub-processors. The customer retains its rights and responsibilities as controller, including determining a lawful basis and giving required privacy notices.

We process that data only on the customer's documented instructions, including instructions about international transfers. This agreement, the Terms and the customer's use and configuration of Grantboard document its instructions to provide the service described in Annex II. An authorized workspace admin may give further instructions in writing to our data protection contact in Annex I. We will promptly tell the customer if we cannot follow an instruction and immediately inform it if, in our opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection law. We will suspend the affected processing while the parties resolve the instruction.

If Union or Member State law requires other processing, we inform the customer of that legal requirement before processing, unless that law prohibits doing so on important public interest grounds. We do not use workspace data for advertising or to train AI models.

2. Confidentiality and security

Anyone we authorize to access personal data must be bound to confidentiality by contract or an appropriate legal duty. Access is limited to what is necessary to provide, maintain and support the service. We implement all measures required by Article 32 GDPR, taking account of the state of the art, implementation costs, the processing and risks to individuals. Annex III describes the technical and organizational measures currently in place. We regularly assess their effectiveness and maintain security appropriate to those risks.

Grantboard is not designed to process sensitive data. The customer must not submit special categories of personal data under Article 9 GDPR, criminal conviction or offence data under Article 10 GDPR, identity documents or government identification numbers, account passwords, private keys, financial account credentials, or payment card numbers and security codes. This restriction also covers sensitive personal data under other applicable data protection law. Ordinary grant payment amounts, references and public wallet addresses are within the processing described in Annex II. If prohibited data is submitted accidentally, the customer must inform us so we can assist with its removal; our security and breach duties still apply.

3. Sub-processors and transfers

The customer gives general written authorization for the sub-processors in Annex IV. Before engaging another sub-processor or replacing one, we email every workspace admin at least 30 days in advance, update the public change history and provide enough information about the proposed processing for the customer to object on data protection grounds. Notices are handled directly by our team; a change cannot proceed for an existing customer's data until its notice period has elapsed. The customer may object in writing before engagement.

We will discuss an objection in good faith and seek an alternative that resolves it. Until it is resolved, we will not send the objecting customer's data to the proposed sub-processor. If no suitable alternative is available, the customer may end the affected service before the change, request return or deletion under section 6, and receive a refund of prepaid fees for the unused affected service. This does not limit the customer's statutory rights.

We engage sub-processors under a binding contract that imposes the same data protection obligations required by Article 28(3) GDPR, in particular sufficient guarantees for appropriate technical and organizational measures. We remain fully responsible to the customer for their performance. On request, we provide relevant sub-processor agreements and amendments, with redactions only as necessary to protect confidential information or other people's data. We notify the customer if a sub-processor fails to meet its obligations.

We transfer personal data outside the European Economic Area only on documented instructions and in compliance with Chapter V GDPR. Annex IV identifies processing locations and applicable safeguards. A transfer may rely on an applicable adequacy decision or, where required, appropriate safeguards such as the applicable international-transfer standard contractual clauses, with additional measures where necessary. This agreement itself is not an international-transfer safeguard.

4. Assistance and personal data breaches

Taking account of the nature of the processing, we assist the customer with appropriate technical and organizational measures to respond to requests under Chapter III GDPR. We promptly forward requests received directly from an individual and do not answer them ourselves except on the customer's instructions or where law requires it.

Taking account of the processing and information available to us, we assist the customer with Articles 32 to 36 GDPR: security, breach notification to authorities and individuals, data protection impact assessments and prior consultation with supervisory authorities. Annex III describes the relevant measures; assistance also includes available processing and incident information, export or erasure support and cooperation with the customer's assessments and regulatory inquiries.

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data. We provide the nature of the breach, affected categories and approximate numbers of people and records where known, a contact for further information, likely consequences and measures taken or proposed to address it and mitigate harm. If details are incomplete, we provide available information promptly and further information as it becomes available without undue delay. We cooperate with investigation and remediation.

5. Information and audits

We make available all information necessary to demonstrate compliance with Article 28 GDPR and this agreement. We allow and contribute to audits, including inspections, by the customer or an auditor it appoints. Audits may take account of relevant provider reports and certifications; those do not replace a legally required audit. We coordinate reasonable notice, scope and confidentiality protections without preventing the customer or a supervisory authority from exercising their legal rights. Both parties provide relevant compliance information to the competent supervisory authority on request.

6. Return, deletion and termination

After processing services end, we return the personal data or delete it, at the customer's choice, and delete remaining copies unless Union or Member State law requires retention. An admin communicates its choice to our data protection contact. We certify completion of deletion on request. Until return or deletion is complete, this agreement continues to protect the data. Legally retained data is isolated and processed only for the required purpose. Backup copies expire under the retention schedule described in Annex II, are protected throughout and are not restored to active use without reapplying required deletions.

If we cannot comply with this agreement, we promptly tell the customer. It may require suspension of affected processing until compliance is restored, or terminate the affected service for a substantial or persistent breach, failure to comply with a binding court or supervisory decision, or failure to restore compliance within one month after suspension. Return and deletion obligations apply on termination.

7. Applicable law and priority

Terms used here have the meanings in the GDPR. Where Swiss data protection law applies, this agreement also covers the applicable Swiss Federal Act on Data Protection, including assistance and notices to the competent Swiss authority. Estonian law governs this agreement, subject to mandatory applicable law. This agreement prevails over conflicting Terms of Service provisions. Nothing here limits statutory rights or responsibilities under applicable data protection law, including our responsibility under Article 28(4) GDPR or individuals' rights and remedies.

Controller(s):

Name:

The customer: the organization that operates the Grantboard workspace, as named in the workspace’s settings.

Address:

The address in the customer’s billing details, or another address the customer gives us in writing.

Contact person’s name, position and contact details:

The workspace’s admins, at the email addresses of their Grantboard accounts. To name a data protection officer or another contact, write to hello@grantboard.co.

Signature and accession date:

No signature is needed. The customer agrees to this agreement by accepting the Terms of Service that include it, or by signing it. Earlier customers must accept the revised Terms or sign this agreement before it applies to them.

Processor(s):

Name:

OVERMATCH OÜ, which operates Grantboard. Registry code 17564126 in the Estonian Business Register.

Address:

Tartu mnt 67/1-13B, 10115 Tallinn, Harju County, Estonia

Contact person’s name, position and contact details:

Data protection contact: hello@grantboard.co.

Signature and accession date:

Agreed with each customer as part of the Terms of Service, on the same day as the customer. A copy signed by OVERMATCH OÜ is available on request at hello@grantboard.co.

Categories of data subjects whose personal data is processed

• The controller’s workspace members (admins, managers, reviewers and viewers) and the people it invites to join.
• Grantees and applicants: the contacts named in grant records and anyone who uses a grant’s private portal link.
• Anyone else whose personal data the controller, its members or its grantees put in grant records, documents, messages or evidence, or in files sent to us for setup help.

Categories of personal data processed

• Names, email addresses, roles and membership of workspace members and invitees.
• Grantee contact details: name, email address and organization.
• Grant records: titles, descriptions, amounts, currencies, dates, statuses, internal notes, assigned managers and milestones.
• Evidence and reviews: submission narratives, files and review decisions with reasons.
• Documents uploaded by the team or the grantee, with their names, types and sizes, and whatever personal data they contain.
• Messages between the team and grantees, internal notes and mentions.
• Payment records: amounts, currencies, due and paid dates, statuses, methods, references and notes. Grantboard records payments; it does not make them.
• If the workspace uses the optional crypto features: wallet and Safe addresses, transaction hashes, and the ENS names those addresses resolve to.
• Activity history: who did what in the workspace, and when.
• Technical data: IP addresses used to limit abuse, sign-in events, and records of the emails we send.
• Spreadsheets and other files the controller sends to hello@grantboard.co for setup help, and their contents.

Sensitive data processed (if applicable) and applied restrictions or safeguards

The customer must not submit special categories of personal data under Article 9 GDPR, criminal conviction or offence data under Article 10 GDPR, identity documents or government identification numbers, passwords, private keys, financial account credentials, payment card numbers or security codes, or other sensitive personal data under applicable law. Ordinary grant payment amounts, references and public wallet addresses are allowed. The customer must tell us about accidental submission so we can assist with removal. Our security and breach obligations continue to apply to any such data while held.

Nature of the processing

Collecting, storing, organizing, displaying, sending and deleting workspace data in the Grantboard web app and grantee portal. That includes hosting the workspace, emailing notifications and reminders to the controller’s team and grantees on its behalf, giving grantees a private portal, producing exports and printable reports, setting up grants from files the controller sends for setup help, and, if the controller uses the optional crypto features, reading public blockchain data about the addresses it enters, from the Safe Transaction Service (api.safe.global) and public RPC endpoints, mainly PublicNode (publicnode.com) with other public endpoints as fallbacks. These services receive the public address being looked up from our servers. Public wallet addresses can still be personal data.

Purpose(s) for which the personal data is processed on behalf of the controller

To provide Grantboard to the controller under the Terms of Service: managing grants, milestones, evidence, payments, documents, messages and reports; communicating with the controller’s team and grantees on its behalf; setting up the controller’s grants from files it sends for that purpose; keeping the service secure, including limiting abuse and fixing errors; and answering the controller’s support requests.

Duration of the processing

For as long as the Terms of Service apply between the controller and OVERMATCH OÜ. Until then, the controller decides how long workspace data is kept and can delete it in Grantboard. In addition:

• Account deletion in Settings → Your data normally follows a 30-day restoration window, with an immediate option. Deletion can be held while workspace administration, billing or ownership of older files needs to be resolved. We explain the hold and help resolve it through support. Records contributed to a workspace stay there, under the name recorded at the time.
• Stored copies of notification emails are deleted 30 days after delivery finishes.
• Records of grantee submission attempts are deleted after 90 days.
• Records of denied requests to reveal a grantee portal link are deleted after 90 days, and short-lived rate counters within about two days.
• Files sent for setup help are used only to set up that workspace. We keep them in our support mailbox and delete them when the controller asks us to, which it can do at any time.

When the agreement ends, section 6 applies: at the controller’s choice, we delete the personal data or return it and then delete the remaining copies. An admin makes that choice by writing to hello@grantboard.co. Our Supabase Pro database backups expire after seven days; Storage objects are not included in those backups.

For processing by (sub-) processors, also specify subject matter, nature and duration of the processing

Each sub-processor’s processing is described in Annex IV.

The measures OVERMATCH OÜ implements for Grantboard, under the processing and security headings below.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller

Each sub-processor is bound by its data processing terms with OVERMATCH OÜ to protect the data, to tell us about personal data breaches and to help with requests from data subjects, so that we can give the controller the assistance section 4 requires.

Description of the specific technical and organisational measures to be taken by the processor to be able to provide assistance to the controller

• Requests from data subjects: the controller’s admins can find, correct and export workspace records in Grantboard, and delete many of them; we help with anything they cannot change themselves. If a data subject contacts us about workspace data, we pass the request to the controller and do not answer it ourselves unless the controller authorizes us to, or the law requires it.
• Personal data breaches: we email the workspace’s admins without undue delay, with the information section 4 lists, and answer follow-up questions at hello@grantboard.co.
• Impact assessments and consultations: we give the controller the information in this agreement and answer its questions at hello@grantboard.co.

This is the agreed list under section 3. We give at least 30 days’ notice of any change, as described above, and publish the list with its change history at grantboard.co/subprocessors.

The controller has authorised the use of the following sub-processors:

1. 1.

   Name:

   Supabase Pte. Ltd.

   Address:

   65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513

   Contact person’s name, position and contact details:

   Data protection contact: privacy@supabase.com

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Hosts the database, sign-in accounts and uploaded files, so it stores all workspace data for as long as that data exists. Supabase Pro keeps daily database backups for seven days; Storage objects are not included.

   Where the data is processed:

   London, United Kingdom

   Safeguard for transfers outside the European Economic Area:

   United Kingdom: European Commission adequacy decision. Any access by Supabase from other countries: standard contractual clauses in Supabase’s data processing addendum, part of its terms of service.

2. 2.

   Name:

   Vercel Inc.

   Address:

   440 N Barranca Ave #4133, Covina, CA 91723, United States

   Contact person’s name, position and contact details:

   Data protection contact: privacy@vercel.com

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Runs the Grantboard app and website. Every page, request and response, and every email before it is handed to Resend, passes through Vercel’s servers while it is processed.

   Where the data is processed:

   Washington, D.C., United States, for the app; Vercel’s global network for delivery

   Safeguard for transfers outside the European Economic Area:

   EU-US Data Privacy Framework: Vercel is certified. Vercel’s data processing addendum, which applies to our Pro plan, adds standard contractual clauses (Decision (EU) 2021/914).

3. 3.

   Name:

   Plus Five Five, Inc. (Resend)

   Address:

   2261 Market Street #5039, San Francisco, CA 94114, United States

   Contact person’s name, position and contact details:

   Data protection contact: privacy@resend.com

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Sends the emails Grantboard sends to workspace members and grantees, so it receives each recipient’s email address and the content of the email, and keeps a record of each delivery.

   Where the data is processed:

   Ireland (European Union) for sending; United States for Resend’s other processing

   Safeguard for transfers outside the European Economic Area:

   EU-US Data Privacy Framework, and standard contractual clauses in Resend’s data processing addendum, part of its terms of service.

4. 4.

   Name:

   Functional Software, Inc. (Sentry)

   Address:

   45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States

   Contact person’s name, position and contact details:

   Data protection contact: compliance@sentry.io

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Receives reports of errors in the app and the grantee portal, and a 10% sample of performance traces from other pages, never sign-in or grantee portal pages. Before a report or trace leaves our servers or the browser, email addresses, wallet addresses, portal link tokens, passwords, credentials and cookies are removed from it. Sentry keeps them for its standard retention period.

   Where the data is processed:

   Frankfurt, Germany (Sentry’s EU data region)

   Safeguard for transfers outside the European Economic Area:

   Stored in the European Union. Any access by Sentry from the United States: EU-US Data Privacy Framework, under which Sentry is certified, with standard contractual clauses (Decision (EU) 2021/914) in Sentry’s data processing addendum as the fallback.

5. 5.

   Name:

   Upstash, Inc.

   Address:

   A Delaware corporation; Upstash publishes no postal address

   Contact person’s name, position and contact details:

   Data protection contact: privacy@upstash.com

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Counts requests to slow down abuse, using IP addresses and account identifiers as keys. The counters expire within about two days.

   Where the data is processed:

   Frankfurt, Germany

   Safeguard for transfers outside the European Economic Area:

   Stored in the European Union. Any access by Upstash from the United States: EU-US Data Privacy Framework, with standard contractual clauses in Upstash’s data processing addendum, part of its terms, as the fallback.

6. 6.

   Name:

   Proton AG

   Address:

   Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland

   Contact person’s name, position and contact details:

   Data protection contact: legal@proton.me

   Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorised):

   Hosts our support mailbox, hello@grantboard.co, and the messages and files people send to it, including spreadsheets sent for setup help. We use setup files only to set up that workspace, and we delete them whenever the workspace asks us to.

   Where the data is processed:

   Switzerland, Germany or Norway

   Safeguard for transfers outside the European Economic Area:

   Switzerland: European Commission adequacy decision. Germany and Norway are in the European Economic Area.