Data Processing Addendum
In short
- This addendum applies where we process personal data on a subscriber's instruction.
- We process it only to deliver verification, never to build our own marketing datasets.
- We keep it secure, use vetted sub-processors, and help you answer data-subject requests.
- On termination we return or delete the data.
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the Platform Service Agreement between Evifound ("Processor") and the Subscriber ("Controller").
It applies to personal data about founders and other individuals that we process because the Subscriber asked us to run a verification. For our own account data, security logs and service operation we act as controller; see the Privacy Policy.
2. Subject matter of the processing
| Item | Detail |
|---|---|
| Subject matter | Verification of founders and companies for investment diligence. |
| Duration | For the term of the Agreement, plus the retention period below. |
| Nature and purpose | Collection, screening against public and official sources, matching, analysis, reporting, storage and export. |
| Data subjects | Founders and company officers named by the Subscriber; referees provided by them; the Subscriber's own users. |
| Personal data | Name and name variants, date of birth, nationality, country of residence, contact details, education and employment history, corporate roles, intellectual-property records, publications, press and social profile data, screening results, referee statements and uploaded documents. |
| Special categories | Data relating to criminal convictions and offences, and data revealing political exposure or insolvency status returned by screening sources. Processed only with the founder's explicit, versioned consent and only where lawful in the relevant jurisdiction. No biometric data is processed. |
| Processing locations | European Union, United Kingdom and North America, under the transfer safeguards in section 6. |
3. Our obligations
We will:
- process personal data only on the Controller's documented instructions, which include this DPA and use of the platform, unless required otherwise by law;
- ensure people authorised to process the data are bound by confidentiality;
- implement the security measures in clause 5;
- assist the Controller with data-subject requests, impact assessments and regulator consultations, taking account of the nature of the processing;
- notify the Controller without undue delay, and in any event within 48 hours of becoming aware, of a personal-data breach affecting their data, with the information available;
- make available the information needed to demonstrate compliance and allow audits under clause 7;
- not sell personal data, and not use it to train general-purpose models or for our own marketing.
4. Controller obligations
The Controller warrants that it has a lawful basis and a legitimate diligence purpose for each verification it orders, and that the instructions it gives do not require us to breach applicable law.
5. Security
Measures include encryption in transit and at rest, role-based access control with least privilege, tenant isolation of report data, tokenised and expiring share links, audit logging of access to reports, secret management, vulnerability and dependency scanning, backups, and staff access on a need-to-know basis.
6. Sub-processors
The Controller gives general authorisation for us to engage sub-processors. Current categories are listed on the Sub-processors page. We impose data-protection obligations on each sub-processor no less protective than this DPA and remain responsible for their performance. We will give notice of a material new category of sub-processor, and the Controller may object on reasonable data-protection grounds.
7. Audit
On reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, we will respond to a written security questionnaire and provide available third-party assessments. On-site audits are by agreement and at the Controller's cost.
8. International transfers
Where personal data is transferred out of its country of origin, we rely on an appropriate transfer mechanism, including the EU Standard Contractual Clauses and the UK Addendum where applicable, together with supplementary technical measures.
9. Retention, return and deletion
We retain verification data for the term of the Agreement and for the retention period set out in the Privacy Policy. On termination, the Controller may export its reports for 30 days, after which we delete or anonymise the personal data except where law requires us to keep it.
10. Data-subject requests
Where a founder contacts us directly, we will tell them to contact the Controller unless we are permitted to respond, and we will notify the Controller promptly. Corrections are also handled through the Accuracy, Correction and Dispute Policy.
11. Liability and precedence
Liability under this DPA is subject to the limits in the Agreement. Where this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails.