Data Processing Agreement (AVV)

Updated: 13 August 2026 · Version 2026-08-13

This agreement is between the Customer as controller (the “Controller”) and System Error MM GmbH, Lehrter Straße 49, 10557 Berlin, as processor (“FundingOS” or the “Processor”), insofar as FundingOS processes personal data on the Customer’s instructions. On registration, it becomes part of the contract in electronic form together with its documented version, in accordance with Art. 28(9) GDPR.

The technical and organisational measures and the current list of subprocessors below form part of this agreement. This published version is the electronic AVV; it is not merely a summary of another document that is unavailable.

§ 1 Subject matter, nature and purpose

The subject matter is the processing of personal data to provide the FundingOS portal. This includes collecting, recording, storing, organising, retrieving, linking, transferring data to approved subprocessors, creating editable working documents, and erasing and returning data.

Purposes include, in particular, managing organisations, profiles and funding initiatives; matching them with funding programmes; saved lists; deadline management; tasks and notifications; creating AI-generated initial drafts when deliberately initiated by a user; and providing English-language guidance for a selected match when deliberately initiated by a user. An initial draft is not generated automatically for every programme.

§ 2 Duration

Processing begins with the main contract and generally continues until that contract ends. Statutory evidence and retention obligations, and the technically necessary limited continuation of data in backups, remain unaffected.

§ 3 Categories of data and data subjects

Depending on use, the following data may be processed in particular:

Account, contact, role and authentication data
Organisation, profile, project and initiative data
Match, saved-list, deadline, task and status data
Text and metadata relating to AI-generated initial drafts
Source-programme data, saved match rationale, suggested approach, assessment score and profile slug processed for English-language match guidance, and the cached guidance
Usage, log and security data

Data subjects may include the Customer’s users and employees, contacts at organisations it supports, and people named by the Customer in free-text fields. Special categories of personal data under Art. 9 GDPR are not intended for use and should not be entered.

§ 4 Instructions and obligations of the Controller

FundingOS processes data on the Customer’s behalf only on documented instructions. The initial instruction is set out in the main contract, the selected plan, this AVV and the functions initiated by the Customer. Further instructions may be given in text form to contact@fundingos.app. FundingOS will inform the Customer if, in its view, an instruction breaches data protection law.

The Customer remains responsible for lawfulness, transparency, data minimisation and upholding data subjects’ rights. The Customer must ensure that it is entitled to process the data entered and transmit it to FundingOS.

§ 5 Obligations of FundingOS

If European Union or Member State law requires FundingOS to process data other than on a documented instruction, FundingOS will inform the Customer of that legal requirement before processing. This does not apply where the law prohibits such notification for important reasons of public interest.

FundingOS will:

Process data only within the agreed scope and on documented instructions
Require authorised persons to observe confidentiality
Assist with data subject rights and the obligations under Arts. 32 to 36 GDPR
Notify the Customer of known personal data breaches without undue delay
Provide evidence and reasonable cooperation with necessary audits
Erase or return data as set out in § 9

§ 6 Technical and organisational measures

The measures are developed further on a risk-oriented basis. They may be changed provided that the level of protection is not materially reduced. The currently evidenced technical arrangements include:

Database and authentication with Supabase in AWS eu-central-1 and Vercel Functions in fra1; Vercel delivery itself is global.
Encryption in transit using HTTPS/TLS and encrypted storage media provided by the platforms.
A role and permissions model, server-side authentication checks and Row-Level Security for all tables in the public application schema.
Server-side secrets and separate public and privileged keys; direct access using privileged keys or roles is intended for server and operator tasks.
Cloudflare Turnstile on registration, sign-in, contact and advisory forms.
Version-controlled code changes and traceable deployments.
An operator support tool for straightforward account-deletion cases; fully automated or self-service account deletion is not currently available.

Row-Level Security is a protective layer, not proof of absolute freedom from error. A live audit on 13 August 2026 identified 16 privileged database functions executable through the public data API. Fifteen are currently tenant-bound; one other can provide the funding-programme catalogue, which is not excluded, outside table-level RLS. No access to other customers’ data, profiles or projects was evidenced. These permissions are an open hardening item and are not presented as already fixed.

§ 7 Subprocessors

The Controller approves the individually named subprocessors below. Before using a new subprocessor or replacing a named one, FundingOS will obtain the Controller’s prior approval in text form.

Supabase, Inc.: PostgreSQL database and authentication; project region AWS eu-central-1, Frankfurt. Provider support and subprocessor access may involve third countries.
Vercel Inc.: hosting, server-side Functions in fra1 and global delivery. The Vercel DPA identifies primary processing in the United States and possible worldwide processing; it incorporates the EU SCCs.
Cloudflare, Inc.: Turnstile and protection against misuse. Cloudflare may process data outside the EEA and relies, among other things, on EU SCCs and the Data Privacy Framework.
Hetzner Online GmbH: own server, scoring and SMTP infrastructure in Germany. The scoring pipeline primarily processes funding-programme and match data.
Requesty Ltd., United Kingdom: gateway for AI-generated initial drafts and English-language match guidance initiated by the user. Requesty identifies AWS Frankfurt as its gateway infrastructure, states that it does not store request or response text, and publishes its subprocessors.
Mistral AI SAS, France: model inference for the currently configured AI-generated initial drafts and English-language match guidance. Requesty identifies Mistral inference as EU processing without provider-side retention.

FundingOS is required to bind each subprocessor contractually, before it processes data on the Customer’s behalf, to at least the same data protection obligations as those in this AVV. FundingOS remains fully responsible to the Customer for the subprocessor’s performance of those obligations.

Requesty and Mistral receive only the programme, profile and match data described under “AI-generated initial drafts” and the data described there for English-language match guidance in the Privacy Notice. Stripe processes payment and subscriptions under a role that varies by service; organisation and initiative text is not sent to Stripe. Details are in the Privacy Notice.

Requesty is in technical use. An executed Requesty DPA specific to FundingOS and evidence of the EU endpoint or EU router policy used in production are not yet recorded in the current internal contract register. This is an open contractual and approval record and, until resolved, conflicts with the intended process set out in this § 7. Until the evidence is complete, this processing is not represented as exclusively European or as having final data-protection approval.

§ 8 Transfers to third countries

Selecting Frankfurt for the database and Function regions does not fully rule out access from third countries. Where a recipient is outside the EEA or accesses data from there, the relevant provider states in its contractual documents that it uses an applicable adequacy decision, the EU-US Data Privacy Framework or EU Standard Contractual Clauses together with supplementary measures. The United Kingdom is currently covered by an EU adequacy decision.

§ 9 Erasure and return

After processing ends, FundingOS will erase or return the data processed on the Customer’s behalf, at the Controller’s choice, unless a legal obligation requires further storage. Deletion requests are currently reviewed and carried out case by case by an operator. The existing support tool does not yet cover every possible project, saved-list, contact, email, Stripe, log and backup relationship for an account. For shared organisations, only the membership is removed where other authorised users still need the data. Provider and backup deletion cycles are reviewed by data class; they are not yet fully documented in the operational register.

§ 10 Data subject rights and supervisory authorities

Taking account of the nature of the processing and the information available to it, FundingOS will assist the Controller with access, rectification, erasure, restriction, data portability and objection. Direct requests that relate exclusively to the Customer’s sphere of responsibility will be forwarded to the Customer.

§ 11 Personal data breaches

After becoming aware of a breach affecting the Customer’s data processed on its behalf, FundingOS will notify the Customer without undue delay and provide the information available about the nature and scope of the breach, possible consequences and measures. Statutory reporting decisions remain the Controller’s responsibility.

§ 12 Evidence and audits

FundingOS will provide the information needed to assess compliance with Art. 28 GDPR. Audits should primarily use technical documentation, provider reports and suitable evidence. If these are insufficient, the parties will agree a proportionate and confidential review that protects the security and rights of other customers.

§ 13 Final provisions

This AVV supplements the main contract. If the terms conflict, its data protection provisions govern processing on the Customer’s behalf. Amendments will be provided electronically in versioned form. German law applies unless mandatory data protection law provides otherwise.

Questions, instructions and enquiries about this version may be sent to contact@fundingos.app.

German original