Data processing agreement

This agreement is part of the terms of service. It binds Sway SRL ("Sway") and each founder that runs a campaign or starts a paid plan on fundmysaas (the "founder"). It has two parts: the backer data a founder receives, where each party is an independent controller, and the data Sway processes on the founder's behalf, where Sway is a processor.

Part A - Backer data: independent controllers

What is shared

When a backer pledges to a founder's campaign, Sway makes available to the founder the backer's name, email address, reward and pledge status. Sway is the controller of that data on fundmysaas; the founder is the controller of the copy it receives or reads. The parties are independent controllers, not joint controllers.

What the founder agrees to

• Delivery only. Use backer data only to deliver the reward, to inform backers about it, to handle their rights (withdrawal, refunds, guarantee) and to meet its own legal duties. Never sell it, rent it or share it with others except a processor acting for the founder.
• No other marketing without consent. Do not use it to market other products or services unless the backer gave separate, recorded consent to the founder.
• Tell backers. Give backers the information articles 13 and 14 GDPR require about the founder's own processing, for example in the founder's privacy policy linked from its product.
• Keep it safe. Protect the data with appropriate technical and organizational measures, and delete it when it is no longer needed for delivery and the founder's legal duties.
• Rights requests. Answer backers' requests about the founder's copy. If Sway receives such a request, it passes it on and the founder answers it.
• Breaches. Tell Sway at contact@fundmysaas.io without undue delay, and in any case within 48 hours, of a breach affecting backer data received from fundmysaas.
• Transfers. A founder established outside the European Economic Area, or in a country without an adequacy decision, receives backer data under the European Commission's standard contractual clauses of 2021, module 1 (controller to controller), which are incorporated into this agreement by reference with Sway as data exporter and the founder as data importer. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies as well. Belgian law governs the clauses and the Belgian courts have jurisdiction.

Part B - Data Sway processes for the founder: article 28 GDPR

Roles and instructions

When the founder puts personal data into its fundmysaas organization for its own purposes (for example the members it invites to its team, or personal data it writes into campaign drafts, rewards or uploaded files before they are published), the founder is the controller and Sway processes that data as its processor, only on the founder's documented instructions. Those instructions are this agreement, the terms and the founder's use of the service. Sway tells the founder if it believes an instruction breaks the law.

What is processed

• Data subjects: the founder's team members and any person the founder names in its content.
• Data: names, email addresses, roles, and what the founder writes or uploads.
• Purpose and nature: storing the data and showing it in the dashboard and on fundmysaas as the founder chooses.
• Duration: as long as the organization exists, then 30 days after its deletion, after which it is deleted, except where the law requires Sway to keep it.

Sway's commitments

• It processes the data only to provide the service and never for its own purposes.
• The people who can reach it are bound to confidentiality.
• It applies the security measures below.
• It helps the founder answer data subjects' requests and meet its duties on security, breach notification and impact assessments, as far as the processing allows.
• It tells the founder of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it.
• At the end of the service, it deletes the data after the 30-day window, or returns it on request before then.
• It makes available the information needed to show compliance with article 28 GDPR and allows audits by the founder or an auditor it mandates, on 30 days' written notice, at most once a year unless a breach or an authority requires more, at the founder's cost.

Security measures

• Data is encrypted in transit (HTTPS) and at rest.
• Access to production is limited to the people who need it, with two-factor authentication.
• Each organization's data is separated from every other's in the database and in file storage.
• Sign-ins are protected by rate limits and a bot check; actions in an organization are recorded in an audit log.
• Backups are encrypted and access to them is limited.

Sub-processors

The founder gives Sway general authorization to use sub-processors. The current ones are:

Sway tells founders by email at least 30 days before it adds or replaces a sub-processor. A founder may object within 10 business days on reasonable data protection grounds; if the parties cannot resolve the objection, the founder may end its paid plan and close its organization without cost. Sway imposes on each sub-processor data protection obligations equivalent to this agreement and remains responsible for it.

Transfers

When a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the standard contractual clauses of 2021.

General

This agreement lasts as long as the founder uses fundmysaas and as long as either party holds data covered by it. It is governed by Belgian law, and the courts of the place of Sway's registered office have jurisdiction. If it conflicts with the terms, this agreement prevails on data protection.