1. Roles and instructions
The customer acts as controller or business, and Fundamentl acts as processor or service provider, for customer personal data. Fundamentl will process that data only to provide, secure, support, and improve the contracted service; follow documented customer instructions; comply with law; and perform obligations in the agreement.
2. Processing details
- Subject matter: operation and support of FoundationOS.
- Duration: the customer relationship plus agreed retention and deletion periods.
- Data subjects: customer personnel, applicants, reviewers, nonprofit contacts, employees, donors, volunteers, and other people represented in customer workflows.
- Data types: identity, contact, organization, application, review, grant, award, employee-impact, transaction-support, communication, usage, audit, and uploaded-file data.
- Purpose: workflow administration, reporting, security, support, communications, and customer-enabled AI assistance.
3. Confidentiality and security
Personnel authorized to process customer personal data are subject to confidentiality duties. Fundamentl will maintain reasonable technical and organizational measures appropriate to the service, including authentication, role and organization scoping, server-side validation for critical actions, storage rules, transport encryption, and security-event logging as described in the Security Overview.
4. Subprocessors
The customer authorizes Fundamentl to use subprocessors needed to provide the service. Current provider categories include Google Cloud/Firebase, Vercel, Resend when email is enabled, Supabase for public directory services, analytics providers when enabled, payment providers when enabled, and approved AI providers for customer-enabled features. Fundamentl remains responsible for imposing appropriate data-protection obligations on subprocessors.
5. Assistance
Taking into account the nature of processing, Fundamentl will provide reasonable assistance with data-subject requests, security inquiries, impact assessments, and regulator consultations when required by applicable law. The customer remains responsible for the substance and lawfulness of its responses.
6. Security incidents
Fundamentl will notify the customer without undue delay after confirming a breach of customer personal data when notification is required, and will provide available information needed for the customer’s response. Notification is not an admission of fault.
7. Return, export, and deletion
During the service relationship, available product exports may be used to retrieve customer records. At termination, Fundamentl will return or delete customer personal data as stated in the agreement, subject to legal requirements, security records, and normal backup rotation.
8. International processing and audits
Managed providers may process data in provider-managed locations. Any required transfer mechanism or specific residency commitment must be documented in the executed agreement. Fundamentl will provide reasonable security and compliance information; on-site or expanded audit rights require written scope, confidentiality, scheduling, and cost terms.
9. Order of precedence
If this DPA conflicts with the customer agreement on personal-data processing, the DPA controls for that subject. Liability and commercial terms remain governed by the executed customer agreement.