Data Processing Agreement

1. Roles

The customer is the controller of the personal data it uploads, including personal data concerning its own clients and their staff. ONE PERCENT NETWORK LLC, a New Mexico domestic limited liability company, Business ID 0008028669, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States (“we” or “us”), acts as processor and processes that data only on the customer’s documented instructions.

For the customer’s own account data (the names and email addresses of its users, and its billing records), we act as controller. That processing is described in the Privacy Policy.

2. Subject matter, duration, nature and purpose

Subject matter: preparing, drafting and assembling grant applications and their supporting evidence. Duration: for as long as the customer’s workspace exists, plus the return and deletion periods in clause 9. Nature and purpose: storage, retrieval, text extraction, AI-assisted drafting and verification, and export of the resulting documents.

Categories of data subjects: the customer’s staff and users; the staff, officers and legal representatives of the customer’s clients; and any person named in the documents the customer uploads. Categories of personal data: identification and contact details, professional and organizational data, and whatever personal data appears inside the uploaded documents. Special categories of data under Article 9 are not requested and should not be uploaded unless the application requires them and the customer has a legal basis to process them.

3. Instructions

We process customer data only to provide the service, and only as instructed by the customer through the product itself or in writing. We do not process it for our own purposes, and we do not use it to train or improve any model, ours or a third party’s. If we believe an instruction infringes the GDPR, we will tell the customer immediately, before acting on it.

4. Confidentiality

Everyone authorized to process customer data is bound by a duty of confidentiality that survives the end of their engagement. Access is limited to what each role needs to operate the service.

5. Security (Article 32)

Sensitive fields, documents and their extracted text are encrypted in the application with AES-256-GCM; passwords are stored with bcrypt; traffic is encrypted with TLS. Every authenticated route limits the data it reads and writes to the caller’s own workspace. Access to production is limited to authorized operators.

6. Sub-processors

The customer gives general authorization for the sub-processors listed below. We will give at least 30 days’ notice before adding or replacing one, and the customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the customer may terminate the affected service without penalty. We impose on each sub-processor, by written contract, data protection obligations equivalent to those in this DPA, as Article 28(4) GDPR requires.

7. International transfers

We are established in the United States. Where the customer’s provision of customer data to us is a transfer to a third country, the parties rely on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference. The customer is the data exporter and we are the data importer. Under Clause 17 (Option 2), the Clauses are governed by the law of the EU Member State in which the data exporter is established; where that law does not allow for third-party beneficiary rights, they are governed by the law of the Netherlands. Under Clause 18(b), disputes are resolved by the courts of the EU Member State in which the data exporter is established.

Under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in clause 6. The information required by the Annexes to the Clauses is set out in clauses 1, 2, 5 and 6 of this DPA.

8. Assistance and breach notification

We assist the customer, at no extra cost and within a reasonable time, in responding to requests from data subjects exercising their rights, and in meeting its obligations under Articles 32 to 36. We notify the customer of any personal data breach affecting customer data without undue delay and in any case within 48 hours of becoming aware of it, with the information the customer needs for its own notification duty.

9. Return and deletion

The customer’s admins can export the workspace, its clients and its projects as JSON at any time. An admin can delete the workspace, which removes it immediately and permanently from the live database, trash included. Deleted projects and clients stay in the trash for 30 days, during which they can be restored, and are then permanently deleted. When the service ends, and at the customer’s choice, we return or delete customer data within 30 days of the customer’s request, except where retention is required by law. Our database, Cloudflare D1, can be restored to any minute within the last 30 days (Time Travel), so data removed from the live database can still be recovered that way for up to 30 days, and not after that.

10. Audit

We make available the information needed to demonstrate compliance with Article 28 and allow audits, including inspections, by the customer or an auditor it mandates, on reasonable notice, no more than once a year unless a supervisory authority or a security incident requires otherwise.

11. Governing law and precedence

Where the GDPR applies to the processing of customer data, this DPA is governed by the same law as the Standard Contractual Clauses under Clause 17. Otherwise, it is governed by the law that governs the Terms of Service. In the event of a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service in matters of personal data.

12. Contact

Data protection inquiries: hello@grantmastermind.com