FUNDING matters Suite — Data Processing Agreement

Draft — not reviewed by counsel and not published. Extracted from the page source on 2026-09-19; the page is the original. Supporting detail — what is held, where, and for how long — is in fmi-admin, docs/data-inventory.md.

This agreement applies where FUNDING matters® Inc. (“we”) processes personal information on behalf of a client organization (“you”) in the course of providing FUNDING matters Suite. It forms part of the written agreement between us and sits alongside the terms of service.

Which of us decides what

You are the organization responsible for the personal information you put into the Suite and for the personal information of your donors and supporters that passes through it. You decide why it is collected and what happens to it.

We process it on your behalf and only on your instructions, which are these documents plus anything you ask in writing. For our own staff, and for your people’s sign-in records, we are responsible in our own right and the privacy notice covers that.

What is processed

Subject matter and duration — providing the Suite, for as long as the written agreement runs.

Nature and purpose — storing, displaying, transmitting, backing up and deleting your content, and giving the people you authorize access to it.

Categories of people — your staff and the contacts you record; visitors to a tour you publish, who are otherwise anonymous to us.

Types of information — names, work email addresses and telephone numbers; the roles and access you assign; records of actions taken in the products; the content you upload. And, if a visitor uses the AI guide in a tour, the text they type.

We do not ask for and the Suite is not built to hold health information, government identifiers, or payment card numbers. Please do not put them into it.

Our obligations

We process personal information only on your documented instructions; we keep it confidential and limit access to the few people at FUNDING matters® Inc. who need it to do their work; we maintain the safeguards described below; and we help you meet your own obligations, including responding to a person who asks what is held about them.

Sub-processors

You authorize the following, each bound to terms no less protective than these:

Auth0, an Okta company — sign-in and identity. Stored in Canada. Supabase — the databases. Stored in Canada, on AWS in Montréal. Cloudflare — hosting, delivery of sign-in email, backups and tour media. See transfers, below. OpenAI — the AI guide only, and only the text a visitor types into it. United States.

We will tell you before we add or replace a sub-processor that handles your data. If you object on reasonable grounds, we will work with you to find an alternative, and if there is none you may end the agreement for the affected service without penalty.

Where it is stored

Databases and identity records are stored in Canada.

Backups and tour media are held by Cloudflare in eastern North America. Cloudflare places this data close to where it is used and does not guarantee a particular country, so these copies may rest in Canada or in the eastern United States. Text typed into the AI guide is sent to the United States.

If Canadian storage of backups is a requirement for you, tell us before signing; it is a change we can make.

Security

Data in transit is encrypted. Sign-in uses a one-time code rather than a password, so there is no password to steal or reuse. Access to each product is granted per person and every change to it is recorded. Data is stored by providers who encrypt it at rest. We keep the number of people who can reach client data small, and review it.

If there is a breach

We will notify you within 72 hours of establishing that personal information we process for you has been lost or exposed, with what is known at that point, and we will keep you informed as more becomes clear. We will help you meet your own reporting obligations, including to the Office of the Privacy Commissioner of Canada and to the people affected.

Helping you answer your people

If someone asks us directly for access to, correction of or deletion of information that belongs to your account, we will not answer for you: we will refer them to you and give you what you need to respond. We will do that promptly enough for you to meet the thirty days Canadian law allows.

Return and deletion

When the agreement ends you may ask for a copy of your content in a usable format. We will delete your content within thirty days of the later of the end of the agreement and your request, except where the law requires us to keep something, and except for backups, which are deleted as they age out on their ordinary cycle.

Our record of who was granted or removed access, and when, is kept. It carries no content, and it exists so that your organization can always answer that question about its own account.

Audit

On request, and no more than once a year unless there has been a breach affecting you, we will answer a reasonable security questionnaire and provide the documentation we hold about how the Suite is built and operated, including the current sub-processor list and where data is stored.

Governing law

This agreement is governed by the laws of the Province of Ontario and the laws of Canada that apply there.

Contact

Our privacy contact is William Petruck, wpetruck@fundingmatters.com. FUNDING matters® Inc., 333 Dundas Street East, Toronto, Ontario M5A 2A2, Canada.