Legal
Data processing agreement
Last updated: 27 September 2026
This agreement applies when [registered company name to be confirmed], a company registered in England and Wales with company number [company number to be confirmed]("Processor") processes personal data for a customer organisation ("Controller") through the Fun In Raising platform. It meets Article 28 of the UK GDPR and forms part of our Terms of service.
1. Scope of processing
| Subject matter | Providing the Fun In Raising platform to the Controller. |
|---|---|
| Duration | The subscription, plus up to 30 days for export and deletion. |
| Nature and purpose | Hosting, storage, display, analysis, training, coaching, scheduling, location sharing during shifts, and reporting, as configured by the Controller. |
| Data subjects | The Controller's staff, fundraisers, recruitment candidates, charity client contacts, and supporters or residents recorded in the course of fundraising. |
| Categories of data | Identity and contact details; role and team; shift, attendance and location during shifts; performance and funnel data; training and certification records; coaching notes and development plans; practice recordings and transcripts; complaints and incidents; sign-up references and validation outcomes. |
| Special category data | Only where the Controller records it for a lawful purpose, such as a safeguarding or incident report. |
2. Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions, which are these terms and the Controller's configuration and use of the platform, unless the law requires otherwise, in which case it will tell the Controller first unless the law forbids that;
- make sure everyone authorised to process the data is bound by confidentiality;
- apply the technical and organisational measures in section 5;
- use sub-processors only as set out in section 3;
- help the Controller answer requests from data subjects, including with data exports and corrections;
- help the Controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to the Processor;
- at the end of the service, delete or return the data as described in section 6;
- make available the information needed to show compliance with this agreement, and allow audits as described in section 7.
3. Sub-processors
The Controller authorises the Processor to use these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| [hosting provider to be confirmed] | Server hosting and backups | [hosting location to be confirmed] |
| Cloudflare, Inc. | Content delivery, encryption in transit and attack protection | Global network |
| Anthropic PBC (only when AI features are enabled) | Generating coaching, practice and knowledge responses | United States |
| Google LLC (only when mapping is enabled) | Maps, geocoding and routing | Global |
The Processor will give at least 30 days' notice of a new sub-processor. The Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may end the affected service. The Processor remains responsible for its sub-processors and puts equivalent data protection terms in place with them.
4. International transfers
Where personal data is transferred outside the UK, the Processor makes sure the transfer is covered by UK adequacy regulations, the International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses.
5. Security measures
- Encryption in transit for all connections.
- Isolation of each customer's data enforced by the database, with row-level security.
- Passwords stored with a slow, salted hash (argon2id). Session tokens stored only as keyed digests.
- Two-step verification required for administrator roles and platform owners; authenticator secrets encrypted at rest.
- Role-based access with the least privilege needed, and re-authentication for sensitive actions.
- An append-only audit log of changes, and, when location sharing is enabled, a log of every view of location data.
- Rate limits on sign-in, and database and cache services not exposed to the internet.
- Nightly database backups, kept for 35 days.
6. Deletion and return
The Controller can ask for a complete export of its data at any time. After the subscription ends, the Processor keeps the data for 30 days for export, then deletes it from live systems. Backups are overwritten within a further 35 days. Data the law requires the Processor to keep is kept only for that purpose.
7. Audits
The Processor will answer reasonable written security questionnaires. Once a year, or after a personal data breach, the Controller may carry out an audit, or appoint an independent auditor bound by confidentiality, with at least 30 days' notice, during working hours, and at its own cost.
8. Personal data breaches
The Processor will tell the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. It will give the information the Controller needs to meet its own obligations, and will take reasonable steps to contain the breach.
9. Liability and precedence
Liability under this agreement is subject to the limits in the Terms of service. If this agreement and the Terms conflict about personal data, this agreement wins.
10. Signed copies
Customers who need a countersigned copy can request one from [email protected].