Data processing terms
How FinNGO processes personal data on behalf of your organisation.
Roles
For the records your organisation keeps in FinNGO, your organisation is the controller and [legal entity name] is the processor. These terms form part of the terms of service.
What we do with the data
We process personal data only to provide FinNGO as your users direct through the application, and on your documented instructions. Data categories include staff, volunteers, donors, vendors and beneficiaries named in your records.
Confidentiality and security
- Staff with access are bound by confidentiality.
- Each organisation's records are isolated in the database.
- Data is encrypted in transit and at rest.
- Changes to financial records are kept in an audit trail.
Sub-processors
The sub-processors we use are listed in the privacy policy. We will give account owners [30] days' notice before adding one, so you can object.
Assistance and breaches
We help you answer data subject requests and will tell you without undue delay, and within [48] hours, after becoming aware of a personal data breach affecting your records.
End of service
When the agreement ends you can export your records. We delete them [within 90 days], except where the law requires us to keep them.
Audits
[Audit rights and international transfer clauses to be drafted by counsel.]