Data Processing Agreement

• "Customer Personal Data" means any personal data contained in User Content, or otherwise provided to Grantable by or for Customer through the Services, that Grantable processes on Customer's behalf.
• "Data Protection Laws" means the data protection and privacy laws that apply to the processing of Customer Personal Data under this DPA, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other U.S. state privacy laws, and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar provincial laws.
• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Sub-processor" means a third party Grantable engages that may process Customer Personal Data on Grantable's behalf.
• "Controller," "processor," "data subject," "personal data," "processing," "service provider," and similar terms have the meanings given in the applicable Data Protection Laws.

For Customer Personal Data, Customer is the controller (or a processor acting for its own controller), and Grantable is a processor acting on Customer's behalf. Where the CCPA applies, Grantable is Customer's service provider. Where PIPEDA or similar Canadian law applies, Customer remains accountable for the personal information it transfers to Grantable for processing.

Grantable is an independent controller of the personal data it collects to run its own business, such as account sign-in details, billing records, and product usage data. That processing is described in our Privacy Policy and is not covered by this DPA.

• Subject matter and purpose. Providing the Services to Customer under the Terms, including hosting and storing User Content, running AI features on Customer's instructions, sending and receiving email through the Services, and providing support.
• Nature of processing. Collection, storage, organization, retrieval, analysis, transmission, and deletion, as needed to provide the Services.
• Duration. For the term of Customer's use of the Services, and afterward until the data is deleted under Section 10.
• Categories of data subjects. Customer's authorized users, and any individuals whose personal data Customer chooses to submit to the Services, such as Customer's staff, board members, volunteers, partners, funder contacts, and the people Customer serves.
• Categories of personal data. Names, contact details, job titles and organizational affiliations, and any other personal data Customer includes in documents, messages, grant applications, or other User Content. Customer decides what personal data it submits.

Grantable will process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise. Customer's instructions are the Terms, this DPA, and Customer's use and configuration of the Services. Additional instructions require our written agreement. We will tell you if, in our opinion, an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of the personal data it submits, and for providing any notices and obtaining any consents or other legal bases that Data Protection Laws require for that data.

Where the CCPA applies, Grantable will not sell or share Customer Personal Data, and will not retain, use, or disclose it for any purpose other than providing the Services, or outside the direct business relationship between Grantable and Customer, except as the CCPA permits.

We do not sell Customer Personal Data, and we do not license User Content to third parties.

We do not use Customer Personal Data to train AI models. The AI providers we use process customer content under commercial agreements that contractually prohibit training their models on it.

Grantable will ensure that the people it authorizes to process Customer Personal Data are bound by appropriate obligations of confidentiality and have access only to the extent needed to provide the Services.

Grantable maintains commercially reasonable administrative, technical, and physical safeguards, appropriate to the risk, designed to protect Customer Personal Data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Role-based access controls and the principle of least privilege
• Regular security assessments and vulnerability testing
• Employee security training and background checks

Our current security practices are described on our Trust & Security page. We may update our safeguards over time, but will not reduce the overall level of protection they provide.

If Grantable becomes aware of a Security Incident, we will notify Customer without undue delay and in any event within 72 hours of becoming aware of it. Our notice will describe, to the extent known, the nature and scope of the incident, the measures taken in response, and recommended steps to mitigate potential harm. We will provide further information as it becomes available.

Grantable will take reasonable steps to contain and remediate the incident, and will reasonably assist Customer in meeting any obligation Customer has to notify regulators or affected individuals. Our notice of a Security Incident is not an admission of fault or liability.

Authorization. Customer authorizes Grantable to engage Sub-processors to provide the Services. Our current Sub-processors, what each does, what data it receives, and where it processes that data are listed at grantable.co/legal/sub-processors.

Obligations. Grantable will engage each Sub-processor under a written agreement that requires it to protect Customer Personal Data to a standard consistent with this DPA, and Grantable remains responsible for its Sub-processors' performance of those obligations.

New Sub-processors. We will give at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data, by updating the Sub-processor list. Customer may object on reasonable data protection grounds by writing to security@grantable.co during the notice period. We will work with Customer in good faith to address the objection. If we cannot, Customer may terminate its subscription in accordance with Section 18 of the Terms.

On account deletion or termination, Grantable will handle Customer Personal Data as set out in Section 6 of the Terms:

• Customer may export its User Content in a machine-readable format for 30 days following its request.
• After that export period, we will delete Customer Personal Data from our production systems within 90 days.
• Backup copies may persist for up to an additional 90 days before being automatically purged.

These timings apply except where the law requires us to keep the data longer, in which case we will continue to protect it under this DPA and process it only for that purpose. Anonymized, aggregated data that cannot reasonably be used to identify Customer or any individual is not Customer Personal Data.

Data subject requests. Taking into account the nature of the processing, Grantable will provide reasonable assistance to help Customer respond to requests from individuals exercising their rights under Data Protection Laws, such as access, correction, deletion, or portability. If we receive such a request about Customer Personal Data directly, we will refer the individual to Customer and will not respond further unless Customer instructs us to or the law requires it.

Assessments and regulators. Grantable will provide reasonable information to help Customer carry out data protection impact assessments and consult with supervisory authorities, where Data Protection Laws require it and the information is not otherwise available to Customer.

On written request, Grantable will make available the information reasonably necessary to demonstrate its compliance with this DPA, such as answers to security questionnaires and our security policies. Requests go to security@grantable.co. Information we share is our confidential information.

The current status of our independent audit, including our most recent SOC 2 Type II examination, is described on our Trust & Security page.

If that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may carry out an audit no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours, under a confidentiality agreement, and at Customer's expense. The parties will agree the scope and timing in advance, and the audit will be conducted so as not to disrupt Grantable's operations or expose other customers' data.

Where data is processed. Grantable is based in the United States, and Customer Personal Data is stored and processed in the United States. Our primary database and file storage are hosted in the United States (AWS, N. Virginia). The location of each Sub-processor is listed at grantable.co/legal/sub-processors.

Transfers from Europe. Where Data Protection Laws require a transfer mechanism for Customer Personal Data transferred from the European Economic Area, the United Kingdom, or Switzerland to the United States, the parties will rely on an appropriate mechanism, such as the European Commission's Standard Contractual Clauses and, for the United Kingdom, the UK International Data Transfer Addendum. Customer may request a copy of the applicable terms at security@grantable.co.

Transfers from Canada. Where PIPEDA or similar Canadian law applies, Grantable processes Customer Personal Data only for the purposes of providing the Services and protects it with the safeguards in this DPA. Customer acknowledges that personal information stored or processed in the United States is subject to the laws of the United States.

Grantable will disclose Customer Personal Data to a third party, including a government authority, only as required by law.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Terms, to the extent permitted by Data Protection Laws.

Term. This DPA remains in effect for as long as Grantable processes Customer Personal Data on Customer's behalf.

Order of precedence. If there is a conflict, any transfer terms adopted under Section 13 control over this DPA, and this DPA controls over the Terms. If Customer has signed a separate data processing agreement with Grantable, that agreement controls for Customer.

Changes. We may update this DPA from time to time, including to reflect changes in Data Protection Laws. We will give notice of material changes in the same way as for changes to the Terms, and no change will reduce the overall protection this DPA gives Customer Personal Data.

Governing law. This DPA is governed by the law that governs the Terms, except where Data Protection Laws or the transfer terms adopted under Section 13 require otherwise.