Data Processing Agreement (art. 28 GDPR)

1. Subject matter

1.1. This agreement governs the processing of personal data that the Processor carries out on behalf of the Customer when providing FounderFold to it. The details (subject matter, duration, nature, purpose, types of data and categories of data subjects) are in appendix 1.

1.2. It does not cover the processing for which the Processor is the controller (accounts, security, billing, AI usage, the settings in clause 9 of the terms, third-party data that appears incidentally on the public pages the Explorer reads, the key people of candidate companies and, if the Customer takes part in the design partner program, the comments in the «Send feedback» channel, including follow-ups). That processing is governed by the service privacy policy.

1.3. It prevails over the terms in everything relating to personal data.

2. Instructions

2.1. The Processor processes the data only on the documented instructions of the Customer, including for international transfers, unless the law of the Union or of Spain requires otherwise. In that case it will tell the Customer beforehand, unless the law prohibits it (art. 28.3.a GDPR).

2.2. The following are instructions of the Customer:

• this agreement and the terms;
• the use that the Customer and its Users make of the functions of the panel (for example, asking an agent for a response, generating or sending a report, configuring the Explorer or launching one of its rounds, switching on proactivity);
• the settings that the owner switches on;
• the use of the development connector, if the Customer uses it: sending the text of the task to the tool used by its person, which is not a sub-processor of Network Place S.L., is an instruction of the Customer (clause 8.6 of the terms);
• and any other written instruction accepted by both parties.

2.3. The Processor will notify the Customer without delay if it believes that an instruction infringes the GDPR or another data protection rule (art. 28.3, last paragraph).

2.4. Prohibition on own purposes. The Processor does not process the Customer's data for its own purposes. In particular, it does not use it to train AI models, for advertising or to create profiles that it uses outside the service to the Customer. The only exception is the processing that the Customer authorizes specifically and in writing through the settings in appendix 4, for which the Processor becomes the controller of that specific processing. AI usage per person is processed only on behalf of the Customer: the Processor does not use it in its internal cost dashboards, in its alerts or for any purpose of its own.

2.5. The Explorer: allocation of roles.

• a) The Processor processes on behalf of the Customer the configuration of the Explorer of each portfolio (criteria, notes, exclusion lists and the conversation to configure it), the rounds (who requested each one, queries, counts and result), their detail, the memory of what has already been seen and the records and reports it generates, with the periods in appendix 1, except for the key people of candidate companies, for whom the Processor is the controller (point b).
• b) The Processor is the controller of third-party personal data that appears incidentally on the public pages the Explorer reads and of the key people of candidate companies (clause 8.7.11 of the terms), even if they are stored within the records, the rounds and their detail: it decides how they are searched for and how they are filtered, informs those people in its privacy policy and handles their objection and their other rights.
• c) If any of that data is not recognized by the filter and remains in the records or in the logs in point a), the Customer instructs the Processor to delete it when the data subject requests it or when the Processor detects it, and to add the website to the list of excluded domains if it belongs to that person and they object. The Processor notifies the Customer of each deletion in a record, without repeating the data.
• d) The Customer does not enter third-party personal data in the configuration of the Explorer (clause 8.7.7 of the terms). If it does, the Processor may delete it and notify the Customer.
• e) Neither the Customer nor the Processor uses the Explorer to search for natural persons as such, profile them or create records about them. Identifying the key people of candidate companies, in their role in those companies, is permitted in order to evaluate the company and engage with it (clause 8.7.11 of the terms).
• f) If a person contacts the Customer about data in point b), the Customer forwards the request to us at privacy@founderfold.com within a maximum of 5 working days, without processing the data for any other purpose, and we handle it as controller.
• g) If an authority or a court were to consider that the parties are joint controllers of the processing in point b), this section stands as their arrangement (art. 26 GDPR): Network Place S.L. informs the data subjects, handles their rights and is their point of contact; the Customer complies with points c), d), e) and f) and clause 8.7.11 of the terms. The essence of this allocation is set out in section 10 of the service privacy policy and in the section «Public information about companies» of the founderfold.com privacy policy.

3. Confidentiality

The Processor ensures that the persons authorized to process the data have committed themselves to confidentiality or are under a legal obligation of confidentiality (art. 28.3.b). Only the staff who need it access the Customer's data, in the cases in clause 5.5 of the terms.

4. Security

The Processor applies the technical and organizational measures in appendix 2 (art. 32 GDPR). It may improve them. It may not reduce their level of protection.

5. Sub-processors

5.1. General authorization. The Customer gives the Processor general authorization to engage the sub-processors in appendix 3, published and kept up to date at founderfold.com/subprocessors (art. 28.2).

5.2. Prior notice. Before adding or replacing a sub-processor, the Processor will notify the owner by email and in the panel at least 15 days in advance, stating who it is, what it will do and where. If a provider of ours gives us shorter notice of a change in its own chain, we will notify the Customer as soon as we know.

5.3. Right to object. The Customer may object in writing, on reasonable data protection grounds, within 15 days of the notice. The parties will seek a solution in good faith; if the sub-processor is direct, the solution may be not to use it for the Customer's data or to switch off the affected function, and if it is a sub-processor of one of our sub-processors, to switch off the affected function for the Customer's organization. If there is no solution before the change takes effect, the Customer may terminate the contract without penalty, with a refund of the unused proportional part of the period paid for.

5.4. Same obligations. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, with sufficient guarantees of appropriate technical and organizational measures. The Processor is liable to the Customer for the compliance of its sub-processors (art. 28.4).

5.5. Urgent cases. If a sub-processor has to be replaced urgently for security or for continuity of the service, the Processor may do so before the notice period ends, notifying immediately; the right to object remains.

6. International transfers

6.1. The Processor stores the Customer's data in the European Union (database in region eu-west-1, Ireland). Some sub-processors process it or may access it from outside the EEA, as appendix 3 indicates. The AI model and the Explorer's web search are processed outside the European Union.

6.2. Those transfers are covered by the standard contractual clauses of Implementing Decision (EU) 2021/914 (module 3, processor to processor, or whichever applies) or by an adequacy decision (art. 45 GDPR), including the EU-US Data Privacy Framework when the sub-processor is certified.

6.3. At the Customer's request, the Processor provides a copy of the safeguards, from which it may omit confidential commercial information.

7. Assistance to the Customer

7.1. Data subject rights. The Processor assists the Customer, with the functions of the panel and with reasonable measures, in responding to rights requests (arts. 15 to 22). If a person contacts the Processor, it will forward the request to the Customer within 5 working days and will not answer it on its own unless the Customer instructs it to (art. 28.3.e). Requests about the data in clause 2.5.b are handled by the Processor as controller, and the Customer forwards to it those it receives as stated in clause 2.5.f.

7.2. Security, breaches, DPIA and prior consultation. The Processor assists the Customer in complying with arts. 32 to 36 with the information available to it (art. 28.3.f). In particular, it makes available a description of the processing and of the risks that the Customer can use for its impact assessment, when it needs one (for example, for proactivity or the Explorer).

7.3. Breaches. The Processor will notify the Customer of any security breach affecting the Customer's data without undue delay and, where possible, within 48 hours of becoming aware of it, with the information in art. 33.3 that it has available, and will complete it in phases. The notification does not constitute an admission of fault.

8. End of the processing

When the contract ends, and as the Customer chooses, the Processor will return the data (clauses 13.4 to 13.6 of the terms) and then delete it, including at its sub-processors and in backups, within a maximum of 90 days from the end of the export period, unless the law of the Union or of Spain requires it to be kept (art. 28.3.g). In the meantime, it does not use it. On request, the Processor will certify the deletion. This includes the Explorer's configuration, rounds, records and memory of what has been seen.

9. Information and audits

9.1. The Processor makes available to the Customer the information necessary to demonstrate compliance with this agreement (art. 28.3.h): this agreement, the description of the measures, the list of sub-processors and, when they exist, the audit reports of its providers that it is able to share.

9.2. The Customer may audit, itself or through an independent auditor bound by confidentiality, once a year, with 30 days' prior notice, at its own expense and without affecting the service or other customers, unless there are signs of non-compliance or an authority requires it. Audits of sub-processors are governed by their contracts.

10. Records and cooperation

The Processor keeps the record in art. 30.2 and cooperates with the supervisory authority when asked.

11. Liability, duration and changes

11.1. Liability is governed by art. 82 GDPR and, between the parties, by clause 11 of the terms.

11.2. This agreement lasts as long as the service contract, and its confidentiality and deletion obligations continue after it ends.

11.3. Changes. The Processor may update this agreement because of legal changes or to improve protection, with 30 days' notice. A change that reduces the protection of the data requires the Customer's acceptance. Each version has its number and its date, and the version accepted by each Customer is recorded.

11.4. Module annexes. If the Customer takes out a module that processes data in another way (for example, «Portfolio intelligence»), its own annex is signed, which supplements this agreement for that module and prevails in what it expressly states.

Signature. For Network Place S.L.: its legal representative, October 30, 2026. For the Customer: electronic acceptance in the panel by the owner who accepts, with a record of the organization, person, version and date.

Appendix 1. Details of the processing

Appendix 2. Technical and organizational measures

• Isolation between customers: row-level security (RLS) in the database, by organization and role. The reads the panel makes on behalf of a user use their session and RLS. The service key is only used on the server, for limited tasks: saving conversations and usage, saving and showing conversation screenshots (private bucket with no access from the browser, signed links valid for 10 minutes), running and saving the Explorer's rounds, preparing scheduled reports, serving shared links and synchronizing.
• Encryption in transit: TLS in all communications.
• Access: Supabase authentication; invitation tokens and link tokens stored only as a hash and with expiry; secret keys only on the server and on the administration computer; administration access limited to the Network Place people who need it.
• Administration workstation: the computer from which FounderFold is administered has an encrypted disk, automatic lock and access with its own credentials; the local tools that use the service key listen only on the computer itself; if the computer is lost or compromised, the service key is rotated immediately; internal synchronization tools are not installed on customers' computers, and no customer portfolio is synchronized with a repository.
• Minimization: only what is necessary for each request is sent to the AI; free-form texts have size limits.
• Explorer: personal data filter on the server before each write; quotations taken only from the provider's quotations field (up to 150 characters); names of people only as key people, in a separate table with its own period; forums only as a count, with the address sanitized; list of excluded domains applied in each round; the agent that reads the web cannot change the configuration or the statuses; page content treated as data, not as instructions; spending and record limits per round.
• Spending and abuse control: limits before each AI call and limits on sends.
• Retention: scheduled daily purges.
• Backups: those of the database provider, in the EU.
• Incident management: the notification procedure in clause 7.3.
• Providers: only with a data processing agreement and with the guarantees in Chapter V of the GDPR (adequacy decision, art. 45, or appropriate safeguards, art. 46).
• Staff: confidentiality commitment. Network Place S.L. undertakes to train its staff in data protection and in the use of AI (art. 4 of Regulation (EU) 2024/1689) before giving them access to customer data.

Appendix 3. Authorized sub-processors

List as of October 30, 2026. The current one is at founderfold.com/subprocessors.

Second-tier sub-processors (for example, the cloud of Railway or of Supabase, or Anthropic's search providers) appear in each provider's public lists, linked from founderfold.com/subprocessors. We notify the Customer, as in clause 5.2, of the changes our sub-processors communicate to us about their own chain, and the Customer may object to them as in clause 5.3; if there is no other solution, the affected function is switched off for its organization.

Appendix 4. Specific authorizations for the Processor's purposes

They are only given when the owner switches on the setting in the panel, with unticked boxes. Until they switch it on, there is no authorization and the Processor does not carry out this processing. Who, when and which version are recorded. It can be revoked by switching off the setting.

4.A. FounderFold Expert product signals (ADR-0041).

• What it authorizes: that the Processor obtains, from Users' questions to FounderFold Expert, pseudonymized signals (type, topic, whether it was resolved, rating, week, manual version and, in requests and failures, a sentence written by the AI), without text, user or conversation.
• What for: solely to improve FounderFold. With clause 9.1 of the terms.
• Role: the Processor is an independent controller of the signals.
• Compatibility analysis (art. 6.4 GDPR), which the Customer assumes: a) link between purposes: close; the questions are about the product itself and the improvement feeds back into the help; b) context: B2B service relationship; the assistant belongs to the provider and talks about its product; c) nature: questions of use; the signal does not collect special categories; d) consequences: no decision about people and no profile; e) safeguards: pseudonymization (week instead of time, no user or text), no-cross-referencing rule, validation of the summary, threshold of 3 organizations, 12-month retention and individual objection without grounds. Conclusion: compatible with those safeguards.
• Information and objection: the Customer delegates the information to the Processor, which gives it in the panel and handles each User's objection.

4.B. Cross-customer recipes and metrics (ADR-0026). Same scheme as 4.A: only if the owner switches on the setting.

• What it authorizes: obtaining statistics on patterns (type of proposal, type of business and of organization, stage, acceptance and retention) and on the acceptance rate of proposals, without content, to improve FounderFold's method and proposals.
• Safeguards: a pattern is only used if present in 5 or more organizations; it does not identify the Customer; it can be switched off at any time.
• Without activation, the metrics of the Customer's proposals are seen only by the Customer itself.