Data Processing Agreement

1.1 “Company”, “Processor”, “we”, “our”, or “us”

Refers to Socialys Evidentia Global Consulting Private Limited, a company incorporated under the laws of India, including its affiliates, subsidiaries, contractors, service providers, and authorized subprocessors that process personal data on behalf of users of the Platform.

For the purposes of this Agreement, the Company generally acts as a Data Processor, providing the technological infrastructure and services that enable organizations to manage and process data through the Platform.

1.2 “Customer”, “Controller”, or “Organization”

Refers to any organization, institution, entity, or individual that uses 1BGrants.com to collect, upload, manage, store, or otherwise process personal data in connection with grant programs, applications, or related activities.

The Customer acts as the Data Controller, determining the purposes and means of processing personal data submitted to or processed through the Platform.

1.3 “Platform”

Refers to 1BGrants.com, including the website, applications, dashboards, databases, software systems, APIs, integrations, and other digital services provided by Socialys Evidentia Global Consulting Private Limited.

1.4 “Personal Data”

Refers to any information that identifies, relates to, describes, or could reasonably be used to identify an individual, directly or indirectly, as defined under applicable data protection laws.

Personal Data may include, but is not limited to:

• names
• email addresses
• phone numbers
• identification details
• professional or organizational information
• documents or application materials submitted through the Platform
• communications between users

1.5 “Data Subject”

Refers to any identified or identifiable individual whose Personal Data is processed through the Platform. Data subjects may include, but are not limited to:

• grant applicants
• employees or representatives of organizations
• reviewers or evaluators
• donors or partners
• beneficiaries or program participants
• platform users

1.6 “Processing”

Refers to any operation or set of operations performed on Personal Data, whether by automated or manual means, including collection, recording, organization, storage, structuring, adaptation, retrieval, consultation, use, disclosure, transmission, analysis, restriction, or deletion of Personal Data.

1.7 “Subprocessor”

Refers to any third-party service provider engaged by the Company to process Personal Data on behalf of the Company in connection with the operation of the Platform. Subprocessors may include cloud infrastructure providers, hosting services, communication platforms, analytics providers, or other technical service providers.

1.8 “Applicable Data Protection Laws”

Refers to all laws and regulations applicable to the processing of Personal Data under this Agreement, which may include, where applicable, the General Data Protection Regulation (GDPR), national data protection laws, and other relevant privacy or data protection regulations.

1.9 “Security Incident” or “Data Breach”

Refers to any confirmed or reasonably suspected incident involving the unauthorized access, disclosure, alteration, loss, or destruction of Personal Data processed through the Platform.

1.10 “Services”

Refers to the tools, features, and functionalities provided through the Platform that enable users and organizations to manage grant opportunities, applications, communications, and related activities.

1.11 Interpretation

Words used in the singular shall include the plural and vice versa where the context requires. The headings used in this Agreement are for convenience only and shall not affect the interpretation of the provisions contained herein. Terms not explicitly defined in this Agreement shall be interpreted in accordance with applicable data protection laws and the overall purpose of this Agreement.

2.1 Applicability of the Agreement

This DPA applies whenever a user or organization uses the Platform to collect, upload, store, manage, transmit, or otherwise process Personal Data relating to individuals, including but not limited to:

• grant applicants
• employees or representatives of organizations
• reviewers or evaluators
• donors or partners
• beneficiaries or program participants
• other individuals whose information may be submitted through the Platform

In such circumstances, the user or organization using the Platform acts as the Data Controller, and Socialys Evidentia acts as the Data Processor providing technical infrastructure and related services.

2.2 Purpose of Processing

The processing of Personal Data under this Agreement is carried out for the purpose of enabling the functionality of the Platform and the services provided through it. This may include activities such as:

• managing grant applications and related documentation
• administering funding opportunities and application workflows
• facilitating communication between organizations and applicants
• storing and organizing information submitted through the Platform
• providing analytics, reporting, and operational insights related to platform usage
• maintaining and improving the functionality and security of the Platform

2.3 Processing on Behalf of the Controller

Socialys Evidentia processes Personal Data on behalf of the Controller in accordance with the instructions provided through the use of the Platform and in accordance with the applicable Terms of Service, Privacy Policy, and this DPA.

The Company does not determine the purposes or means of processing Personal Data submitted by organizations using the Platform, except as necessary to operate, maintain, secure, and improve the services provided.

2.4 Responsibility of the Controller

The Controller is responsible for ensuring that the collection, submission, and processing of Personal Data through the Platform complies with applicable data protection laws and regulations.

The Controller is responsible for:

• obtaining any necessary consents from individuals whose data is processed
• ensuring that Personal Data submitted to the Platform is collected lawfully
• determining the legal basis for processing such Personal Data
• ensuring that the use of the Platform complies with applicable privacy and data protection laws

2.5 Scope of Processing Activities

The categories of Personal Data processed, the categories of Data Subjects involved, and the nature of the processing activities are described in this Agreement and may vary depending on how organizations choose to use the Platform.

The Company processes Personal Data only to the extent necessary to provide the services described in the Terms of Service and related platform documentation.

2.6 Relationship With Other Agreements

In the event of any conflict between the provisions of this DPA and other agreements governing the use of the Platform, the provisions of this DPA shall prevail with respect to matters relating specifically to the processing of Personal Data.

3.1 Role of the Controller

Organizations, institutions, or users that collect, upload, submit, manage, or otherwise process Personal Data through the Platform act as the Data Controller for the purposes of applicable data protection laws.

As the Controller, the organization determines:

• the purposes for which Personal Data is collected and processed
• the categories of Personal Data submitted to the Platform
• the categories of individuals whose data is processed
• the retention, disclosure, and use of such Personal Data within their programs or operations

The Controller is responsible for ensuring that:

• Personal Data submitted to the Platform has been collected lawfully
• the appropriate legal basis for processing exists
• any necessary consents or authorizations from Data Subjects have been obtained
• the use of the Platform complies with applicable privacy and data protection laws

The Controller also remains responsible for determining how Personal Data is used within its own programs, funding activities, or organizational processes.

3.2 Role of the Processor

Socialys Evidentia Global Consulting Private Limited, as the operator of 1BGrants.com, acts as a Data Processor when processing Personal Data on behalf of organizations using the Platform.

In this capacity, the Company provides the technological infrastructure, software systems, and services that enable organizations to manage grant opportunities, applications, communications, and related workflows.

The Processor processes Personal Data solely for the purposes of:

• operating and maintaining the Platform
• enabling the functionality of services available through the Platform
• supporting workflows related to grant management and funding opportunities
• maintaining the security, reliability, and integrity of the Platform
• providing technical support and system administration

3.3 Processing Based on Controller Instructions

The Processor processes Personal Data only on documented instructions from the Controller, which may include instructions communicated through the Controller’s use of the Platform and its available features.

Such instructions may include actions such as uploading information, managing applications, sharing documents, communicating with applicants, configuring platform settings, or otherwise using the services provided through the Platform.

3.4 Independent Processing Activities

In certain limited circumstances, Socialys Evidentia may process certain categories of data as an independent data controller where necessary to operate and manage the Platform.

Such activities may include:

• account registration and authentication
• system monitoring and platform security
• fraud detection and prevention
• service communications and operational notifications
• compliance with legal or regulatory obligations
• generation of aggregated or anonymized analytics related to platform usage and performance

Where Socialys Evidentia acts as an independent data controller, such processing activities are governed by the Privacy Policy and applicable laws.

3.5 Responsibility for Compliance

Each party is responsible for complying with the data protection obligations applicable to it under relevant data protection laws.

The Controller is responsible for ensuring that its use of the Platform complies with applicable privacy and data protection requirements, while the Processor is responsible for implementing appropriate safeguards and processing Personal Data in accordance with the Controller’s instructions and the provisions of this Agreement.

4.1 Nature of Processing

The processing activities performed by the Company are primarily technical and operational in nature and are carried out in order to provide and maintain the functionality of the Platform.

Such processing may include operations such as:

• collection and storage of Personal Data submitted by users
• organization and structuring of information within the Platform
• retrieval, consultation, and display of information through platform interfaces
• transmission of information between users and organizations through platform features
• processing of documents, grant applications, communications, and related materials submitted through the Platform
• maintenance of system logs, operational records, and security monitoring systems

Processing activities may be carried out using automated technologies, cloud-based infrastructure, or other systems necessary to operate and support the Platform.

4.2 Purpose of Processing

Personal Data processed through the Platform is used to support the functionality and services offered by 1BGrants.com. These purposes may include, but are not limited to:

• enabling organizations to publish and manage funding opportunities
• allowing applicants to submit grant applications and related documentation
• facilitating communication between applicants, reviewers, and organizations
• managing workflows related to grant evaluation and program administration
• organizing and storing documents, applications, and user information
• generating operational reports and platform analytics related to system functionality
• maintaining the security, reliability, and performance of the Platform

4.3 Processing Based on Platform Usage

The nature and scope of processing may vary depending on how organizations choose to use the Platform. Organizations may configure application forms, manage grant workflows, collect documents, communicate with applicants, or otherwise process information using the tools available through the Platform.

Socialys Evidentia processes Personal Data only to the extent necessary to support the services and functionalities made available through the Platform.

4.4 Platform Operation and Security

The Company may process certain technical and operational data in order to operate, maintain, and secure the Platform. This may include system monitoring, access logs, infrastructure performance monitoring, fraud detection, and protection against unauthorized access or misuse of the Platform.

Such processing activities are necessary to maintain the integrity, reliability, and security of the services provided.

4.5 Aggregated and De-Identified Data

Socialys Evidentia may generate and use aggregated, anonymized, or de-identified data derived from Personal Data processed through the Platform for purposes such as:

• platform analytics and performance monitoring
• research and statistical analysis
• development and improvement of platform services
• benchmarking and industry insights
• product development and operational reporting

Aggregated or de-identified data will not be used to directly identify individual Data Subjects.

4.6 Duration of Processing

Personal Data will be processed by the Company for the duration of the Controller’s use of the Platform and for any additional period necessary to comply with applicable legal obligations, resolve disputes, enforce agreements, or maintain system security and operational integrity.

5.1 Grant Applicants

Individuals who submit grant applications, proposals, or supporting documentation through the Platform in response to funding opportunities published or managed by organizations using the Platform.

5.2 Organizational Representatives

Employees, contractors, consultants, or authorized representatives of organizations that use the Platform to publish funding opportunities, manage applications, review submissions, or administer grant programs.

5.3 Reviewers and Evaluators

Individuals responsible for reviewing, evaluating, scoring, or providing feedback on grant applications or other program submissions through the Platform.

5.4 Donors, Funders, and Program Administrators

Individuals associated with philanthropic organizations, foundations, corporate social responsibility programs, government agencies, research institutions, or other entities involved in administering or supporting funding opportunities through the Platform.

5.5 Beneficiaries or Program Participants

Individuals who may be identified in grant applications, project proposals, program documentation, or reports as beneficiaries, participants, or recipients of programs supported through funding opportunities managed on the Platform.

5.6 Platform Users

Individuals who create accounts or otherwise interact with the Platform, including users who browse funding opportunities, communicate with other users, submit information, or access platform features.

5.7 Other Individuals Identified in Submitted Materials

Individuals whose information may appear in documents, communications, application materials, reports, or other content submitted by organizations or applicants through the Platform.

This may include collaborators, team members, advisors, references, partners, or other individuals referenced within grant applications or related documentation.

The specific categories of Data Subjects involved may vary depending on how organizations choose to use the Platform and the nature of the funding programs or activities administered through 1BGrants.com.

6.1 Identification and Contact Information

Personal identifiers and contact details of individuals interacting with the Platform, which may include:

• full name
• email address
• phone number
• mailing address or location information
• professional title or role
• organizational affiliation

6.2 Professional and Organizational Information

Information related to an individual’s professional background, organizational involvement, or institutional affiliation, which may include:

• organization name
• position or role within an organization
• professional qualifications or experience
• organizational profiles or related details submitted through the Platform

6.3 Grant Application and Program Information

Information contained within grant applications, proposals, or supporting documentation submitted through the Platform, which may include:

• project descriptions and proposals
• resumes or curriculum vitae (CV)
• supporting documents or attachments
• budgets or financial estimates related to grant proposals
• program reports or progress updates

6.4 Communications and Correspondence

Information contained in communications between users, organizations, or reviewers conducted through the Platform, which may include:

• messages exchanged through platform tools
• comments, feedback, or evaluation notes
• attachments or documents shared during communication

6.5 Technical and Usage Data

Certain technical information may be processed in connection with the operation and security of the Platform, which may include:

• IP addresses
• device or browser information
• system access logs
• usage activity related to the Platform
• timestamps associated with platform interactions

6.6 Documents and Uploaded Files

Files and documents uploaded by users or organizations to the Platform, which may contain Personal Data depending on the nature of the materials submitted.

Such materials may include application forms, reports, identification documents, references, or other supporting documentation associated with grant applications or program administration.

6.7 Other Information Submitted by Users

Personal Data that users or organizations voluntarily submit through the Platform as part of grant applications, communications, organizational profiles, or other platform interactions.

The specific types of Personal Data processed may vary depending on the configuration of the Platform and the manner in which organizations choose to use the services provided by 1BGrants.com.

Users and organizations remain responsible for ensuring that any Personal Data submitted to the Platform complies with applicable data protection laws and that they have the necessary rights and permissions to process such information.

7.1 Processing in Accordance With Controller Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including instructions communicated through the Controller’s use of the Platform and its available functionalities.

The Processor will not process Personal Data for purposes other than those necessary to provide and maintain the services described in the Terms of Service, except where required to do so by applicable law.

7.2 Confidentiality

The Processor shall ensure that individuals authorized to process Personal Data, including employees, contractors, and service providers, are subject to appropriate confidentiality obligations and are required to handle Personal Data in accordance with applicable data protection requirements.

7.3 Security Measures

The Processor shall implement reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction.

Such measures may include, where appropriate:

• access control mechanisms
• system monitoring and logging
• encryption or secure transmission of data where applicable
• infrastructure security practices
• internal policies governing the handling of sensitive information

The Processor may update or modify its security practices from time to time in order to improve the protection of Personal Data and the security of the Platform.

7.4 Assistance to the Controller

Where reasonably necessary and subject to the nature of the processing activities, the Processor may assist the Controller in fulfilling certain obligations under applicable data protection laws. Such assistance may include support related to:

• responding to data subject requests
• investigating security incidents
• implementing appropriate data protection safeguards

The extent of such assistance may depend on the functionality of the Platform and the information available to the Processor.

7.5 Security Incident Notification

If the Processor becomes aware of a confirmed or reasonably suspected Security Incident affecting Personal Data processed on behalf of the Controller, the Processor will take reasonable steps to investigate the incident and notify the Controller within a reasonable timeframe, where required by applicable law.

Such notification may include information reasonably available to the Processor regarding the nature of the incident and the steps taken to address it.

7.6 Compliance With Applicable Laws

The Processor shall comply with applicable data protection laws to the extent they apply to the Processor’s role in providing the Platform and processing Personal Data on behalf of Controllers.

If the Processor believes that an instruction from the Controller violates applicable data protection laws, the Processor may notify the Controller and may suspend the relevant processing activity until the issue is resolved.

7.7 Limitations of Processor Responsibility

The Processor is responsible for processing Personal Data in accordance with this Agreement and the instructions of the Controller. However, the Processor is not responsible for verifying the legality of Personal Data submitted by the Controller or ensuring that the Controller has obtained appropriate legal authority or consent to process such data.

The Controller remains responsible for ensuring that Personal Data submitted to the Platform is collected and processed in compliance with applicable laws and regulations.

8.1 Authorization to Use Subprocessors

The Controller acknowledges and agrees that the Processor may engage Subprocessors to process Personal Data on behalf of the Processor where such services are necessary for the operation of the Platform.

Such Subprocessors may include providers of:

• cloud hosting and infrastructure services
• data storage and backup systems
• communication and notification services
• analytics and monitoring tools
• technical support or operational services

8.2 Responsibilities of the Processor

Where the Processor engages a Subprocessor to process Personal Data, the Processor shall take reasonable steps to ensure that such Subprocessor is subject to appropriate contractual obligations designed to protect Personal Data and to process such data in accordance with applicable data protection requirements.

The Processor shall remain responsible for the performance of its obligations under this Agreement with respect to the processing of Personal Data carried out by its Subprocessors.

8.3 Changes to Subprocessors

The Processor may update or change its Subprocessors from time to time as necessary to support the operation, security, and improvement of the Platform.

Where reasonably appropriate, the Processor may make available information regarding the categories of Subprocessors used in connection with the services.

8.4 Location of Subprocessors

Subprocessors engaged by the Processor may operate in different jurisdictions depending on the infrastructure and services used to operate the Platform.

The Controller acknowledges that Personal Data may be processed or stored by Subprocessors located in various countries as necessary to provide the services.

8.5 Responsibility for Subprocessor Services

Subprocessors process Personal Data solely for the purpose of providing services to the Processor in connection with the operation of the Platform. The Processor shall take reasonable measures to ensure that Subprocessors process Personal Data in a manner consistent with the obligations described in this Agreement.

9.1 Cross-Border Data Processing

Socialys Evidentia Global Consulting Private Limited may process Personal Data using cloud-based infrastructure, service providers, or technical systems that operate in multiple countries. As a result, Personal Data may be transferred to and processed in jurisdictions that may have data protection or privacy laws that differ from those in the Controller’s country.

Such cross-border processing may occur where necessary to operate, maintain, secure, or improve the Platform and the services provided through it.

9.2 Global Infrastructure

The Platform may rely on distributed cloud infrastructure, hosting services, technical providers, or operational support services that maintain data centers in different regions of the world. Personal Data may therefore be stored or processed in locations selected by the Processor or its authorized service providers based on operational, security, or performance considerations.

9.3 Controller Authorization

By using the Platform and submitting Personal Data through the services, the Controller acknowledges and authorizes the transfer, storage, and processing of Personal Data across international borders where such transfers are necessary to provide and support the services available through 1BGrants.com.

The Controller remains responsible for ensuring that its use of the Platform and the transfer of Personal Data to the Processor complies with applicable data protection laws in the Controller’s jurisdiction.

9.4 Safeguards for Data Transfers

Where applicable, the Processor will implement reasonable safeguards designed to protect Personal Data during international transfers. Such safeguards may include contractual commitments with service providers, internal policies, security practices, and operational measures designed to protect the confidentiality, integrity, and availability of Personal Data.

9.5 Processing by Affiliates and Group Entities

Socialys Evidentia Global Consulting Private Limited may process Personal Data through its affiliates, subsidiaries, or entities under common ownership or control, where such entities assist with activities related to the development, operation, support, or administration of the Platform.

Such entities may be located in different jurisdictions and may provide services including platform development, infrastructure management, technical support, customer support, analytics, or other operational functions necessary for the provision of the Platform.

Where Personal Data is processed by such affiliated entities, the Processor will take reasonable steps to ensure that such entities are subject to appropriate confidentiality, security, and data protection obligations consistent with the terms of this Agreement.

10.1 Technical and Organizational Safeguards

The Processor may implement a variety of security practices and controls appropriate to the nature of the Platform and the services provided. Such measures may include, where appropriate:

• access control mechanisms to limit access to authorized personnel
• authentication procedures for user accounts
• secure data transmission methods where applicable
• system monitoring, logging, and auditing of platform activity
• protection of infrastructure and network systems
• backup and recovery systems designed to maintain service continuity
• internal policies governing the handling of data and information security practices

The specific security measures implemented may evolve over time as the Platform develops and as new technologies, operational practices, or security requirements emerge.

10.2 Platform Infrastructure and Cloud Services

The Platform may rely on cloud-based infrastructure providers and other technical service providers for hosting, storage, and operational support.

Such providers may operate data centers in multiple geographic locations and may implement their own security practices, certifications, and operational safeguards designed to protect the infrastructure used to support the Platform.

10.3 Access Controls

Access to Personal Data processed through the Platform is limited to authorized personnel, contractors, or service providers who require access to perform their responsibilities related to the operation, maintenance, or support of the Platform.

Individuals granted such access may be subject to confidentiality obligations and internal policies governing the handling of sensitive information.

10.4 Security Monitoring and Incident Response

The Processor may implement monitoring systems, operational procedures, and security practices designed to detect and respond to potential security incidents affecting the Platform.

Where a confirmed Security Incident involving Personal Data processed on behalf of a Controller occurs, the Processor will take reasonable steps to investigate the incident and respond in accordance with applicable legal requirements and internal incident response procedures.

10.5 Shared Responsibility

The Controller acknowledges that maintaining the security of Personal Data processed through the Platform is a shared responsibility. Controllers and users are responsible for maintaining the confidentiality of their account credentials, implementing appropriate access controls within their organizations, and ensuring that Personal Data submitted to the Platform is handled in compliance with applicable laws.

10.6 Evolution of Security Practices

The Processor may update or modify its security practices and safeguards from time to time in order to improve the security, reliability, and resilience of the Platform, to address emerging threats, or to comply with evolving legal or regulatory requirements.

11.1 Identification of Security Incidents

A Security Incident refers to any confirmed or reasonably suspected event that results in unauthorized access to, disclosure of, alteration of, loss of, or destruction of Personal Data processed through the Platform.

Security Incidents may include incidents affecting systems, infrastructure, or services used in connection with the operation of the Platform.

11.2 Notification to Controllers

If the Processor becomes aware of a confirmed Security Incident affecting Personal Data processed on behalf of a Controller, the Processor will take reasonable steps to notify the affected Controller within a reasonable timeframe after becoming aware of the incident.

Such notification may include, to the extent reasonably available:

• a description of the nature of the Security Incident
• the categories of data potentially affected
• the measures taken or proposed to address the incident
• any recommended steps that the Controller may take to mitigate potential risks

The timing and content of notifications may depend on the information available to the Processor at the time of the incident and the nature of the investigation.

11.3 Investigation and Mitigation

Upon becoming aware of a Security Incident, the Processor will take reasonable steps to investigate the incident, mitigate potential impacts, and implement measures designed to prevent similar incidents where appropriate.

Such actions may include system reviews, infrastructure adjustments, security updates, or other operational measures necessary to maintain the integrity and security of the Platform.

11.4 Controller Responsibilities

The Controller remains responsible for determining whether any notifications to regulatory authorities, affected individuals, or other third parties are required under applicable data protection laws.

Where reasonably possible and appropriate, the Processor may assist the Controller in providing information necessary for such notifications.

11.5 Limitations

The Processor’s obligation to notify the Controller applies only to Security Incidents affecting systems or services under the Processor’s control. The Processor is not responsible for Security Incidents resulting from actions or omissions of the Controller, the Controller’s users, or third parties not under the Processor’s control.

12.1 Responsibility of the Controller

The Controller is responsible for responding to requests made by Data Subjects regarding the Personal Data processed through the Platform.

Since the Controller determines the purposes and means of processing Personal Data, requests from Data Subjects related to access, correction, deletion, or restriction of processing should generally be directed to the organization that collected the Personal Data.

12.2 Assistance by the Processor

Where reasonably feasible and consistent with the functionality of the Platform, Socialys Evidentia may assist the Controller in responding to Data Subject requests relating to Personal Data processed through the Platform.

Such assistance may include providing access to relevant data stored within the Platform or supporting technical actions requested by the Controller, such as updating or removing data where permitted by the Platform’s capabilities.

12.3 Requests Received by the Processor

If Socialys Evidentia receives a request directly from a Data Subject concerning Personal Data processed on behalf of a Controller, the Processor may, where appropriate, direct the Data Subject to contact the relevant Controller responsible for the processing of that data.

The Processor may also notify the Controller of such requests where reasonably necessary to facilitate an appropriate response.

12.4 Limitations

The Processor’s ability to assist with Data Subject requests may depend on the information available to the Processor and the technical capabilities of the Platform. The Processor shall not be responsible for responding directly to Data Subject requests except where required by applicable law.

13.1 Retention During the Provision of Services

Personal Data submitted to the Platform may be retained for as long as the Controller maintains an active account or continues to use the Platform to manage grant opportunities, applications, communications, or related activities.

During this period, Personal Data may be stored and processed within the Platform in order to enable the functionality of the services provided.

13.2 Deletion Upon Request or Termination

Upon termination of the Controller’s use of the Platform, or upon request by the Controller where technically feasible, the Processor may take reasonable steps to delete or return Personal Data processed on behalf of the Controller.

Such deletion may be subject to operational constraints, system limitations, or the nature of the data stored within the Platform.

13.3 Retention for Legal and Operational Purposes

Notwithstanding the above, the Processor may retain certain categories of data where necessary to:

• comply with applicable legal or regulatory obligations
• resolve disputes or enforce contractual agreements
• maintain system security and integrity
• prevent fraud or misuse of the Platform
• maintain internal records required for operational or compliance purposes

Where possible, retained data may be restricted, archived, or de-identified to limit further processing.

13.4 Backup and Archival Systems

Personal Data may continue to exist in backup systems, archived storage, or disaster recovery systems for a limited period of time following deletion from active systems.

Such data may not be immediately removed from all backup environments but will remain protected by appropriate security safeguards and may be deleted in accordance with the Processor’s standard data retention and backup management practices.

13.5 Controller Responsibility

The Controller is responsible for determining the retention periods applicable to Personal Data submitted through the Platform and for ensuring that the retention and deletion of such data complies with applicable data protection laws and organizational policies.

14.1 Confidentiality Obligations

The Processor shall ensure that employees, contractors, service providers, or other individuals authorized to process Personal Data are subject to appropriate confidentiality obligations and are required to protect the confidentiality of Personal Data processed through the Platform.

Such obligations may arise through employment agreements, contractual terms, internal policies, or other legally binding arrangements.

14.2 Authorized Access

Access to Personal Data processed through the Platform will be limited to authorized personnel who require such access to perform their responsibilities related to:

• operation and maintenance of the Platform
• technical support and troubleshooting
• infrastructure management and system monitoring
• security and fraud prevention activities

The Processor will take reasonable steps to ensure that such individuals process Personal Data only as necessary to fulfill these responsibilities.

14.3 Internal Policies and Controls

The Processor may implement internal policies, procedures, and operational practices designed to ensure that Personal Data is handled in accordance with confidentiality requirements and applicable data protection standards.

Such practices may include access management procedures, internal security guidelines, and operational controls governing the handling of sensitive information.

14.4 Exceptions

The confidentiality obligations described in this section do not apply to information that:

• becomes publicly available through no fault of the Processor
• is required to be disclosed under applicable law, legal process, or regulatory requirement
• is disclosed with the authorization or instruction of the Controller

Where disclosure is required by law, the Processor may take reasonable steps, where permitted, to notify the Controller prior to such disclosure.

15.1 Processor Compliance

Socialys Evidentia Global Consulting Private Limited shall implement reasonable policies, procedures, and safeguards designed to ensure that Personal Data processed through the Platform is handled in accordance with the obligations described in this Data Processing Agreement.

15.2 Information Requests

Where reasonably necessary to demonstrate compliance with the obligations described in this Agreement, the Processor may provide the Controller with information regarding its data protection practices, security measures, or operational procedures related to the processing of Personal Data.

Such information may be provided in the form of written responses, policy documentation, security descriptions, or other relevant materials made available by the Processor.

15.3 Limitations on Audits

To protect the confidentiality, security, and integrity of the Platform and the data of other users, the Processor is not required to permit direct access to its internal systems, infrastructure, or facilities for audit purposes unless required by applicable law or agreed upon in a separate written agreement.

Any information shared with the Controller for audit purposes may be subject to reasonable confidentiality obligations.

15.4 Frequency and Reasonableness

Any requests for information or verification of compliance must be reasonable in scope, limited in frequency, and conducted in a manner that does not interfere with the normal operation, security, or performance of the Platform.

15.5 Costs

Where the Processor incurs significant costs or operational burdens in responding to extensive audit or information requests that exceed standard compliance documentation, the Processor may require the requesting Controller to cover reasonable costs associated with fulfilling such requests.

16.1 Responsibility of the Controller

The Controller is responsible for ensuring that the collection, submission, and processing of Personal Data through the Platform complies with applicable data protection laws and regulations.

The Controller shall ensure that:

• Personal Data submitted to the Platform has been collected lawfully
• appropriate legal bases or consents for processing exist where required
• the Personal Data submitted is accurate and appropriate for the intended purpose
• the use of the Platform complies with applicable privacy and data protection laws in the relevant jurisdiction

The Processor shall not be responsible for verifying the legality, accuracy, or appropriateness of Personal Data submitted by the Controller.

16.2 Processor Liability

Socialys Evidentia Global Consulting Private Limited shall be responsible for processing Personal Data in accordance with the obligations described in this Data Processing Agreement and for implementing reasonable safeguards designed to protect Personal Data processed through the Platform.

The Processor shall not be liable for any processing activities carried out by the Controller, the Controller’s users, or other third parties that are outside the Processor’s control.

16.3 Limitation of Liability

To the maximum extent permitted by applicable law, the total liability of the Processor arising out of or relating to this Data Processing Agreement, including claims related to the processing of Personal Data, shall be limited to the amount paid by the Controller for the use of the Platform during the twelve (12) months preceding the event giving rise to the claim.

If the Platform is used without payment or under a free service tier, the Processor’s liability shall be limited to the maximum extent permitted by applicable law.

16.4 Indirect or Consequential Damages

To the maximum extent permitted by applicable law, the Processor shall not be liable for any indirect, incidental, consequential, special, or punitive damages arising out of or related to the processing of Personal Data or the use of the Platform.

This includes, but is not limited to, damages related to loss of business, loss of funding opportunities, reputational harm, loss of data, or interruption of operations.

16.5 Allocation of Liability

Each party shall remain responsible for its own compliance with applicable data protection laws and for any actions or omissions under its control that may result in a violation of such laws.

Nothing in this Agreement shall be interpreted as expanding the liability of the Processor beyond the limits permitted under applicable law or the provisions of the applicable Terms of Service.

17.1 Term of the Agreement

This Agreement becomes effective when the Controller begins using the Platform or otherwise accepts the applicable Terms of Service that incorporate this DPA.

The Agreement shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller in connection with the services provided through 1BGrants.com.

17.2 Termination of Platform Use

If the Controller terminates its use of the Platform, closes its account, or otherwise ceases to use the services, the processing of Personal Data on behalf of the Controller will be limited to activities necessary to:

• complete any remaining operational processes
• comply with applicable legal obligations
• resolve disputes or enforce contractual agreements
• maintain system integrity, security, and operational records

17.3 Deletion or Return of Personal Data

Following termination of the Controller’s use of the Platform, the Processor may take reasonable steps, where technically feasible, to delete or return Personal Data processed on behalf of the Controller, subject to the data retention provisions described in this Agreement and the applicable Terms of Service.

Certain data may continue to be retained in accordance with legal, operational, or security requirements.

17.4 Survival of Certain Provisions

Provisions of this Agreement that by their nature are intended to survive termination shall remain in effect after termination of this Agreement.

Such provisions may include, but are not limited to:

• confidentiality obligations
• data security obligations
• limitations of liability
• dispute resolution provisions
• data retention requirements

These provisions shall remain applicable for as long as Personal Data processed under this Agreement remains in the possession or control of the Processor in accordance with applicable laws and operational requirements.

18.1 Jurisdiction

Any disputes, claims, or legal proceedings arising out of or relating to this Agreement, including matters related to the processing of Personal Data through 1BGrants.com, shall be subject to the exclusive jurisdiction of the courts located in Bankura, West Bengal, India, unless otherwise required by applicable law.

18.2 Compliance With Applicable Laws

Nothing in this Agreement shall prevent either party from complying with mandatory legal obligations imposed by applicable data protection or privacy laws in jurisdictions where Personal Data may be processed.

Where a provision of this Agreement conflicts with mandatory requirements of applicable data protection laws, the relevant legal requirement shall apply to the extent necessary to ensure compliance.

18.3 International Users

Controllers and users accessing the Platform from jurisdictions outside India acknowledge that the Platform is operated by Socialys Evidentia Global Consulting Private Limited, a company incorporated in India, and agree that the governing law and jurisdiction described in this section shall apply to the extent permitted under applicable law.

19.1 Use of Automated Systems

The Platform may utilize automated systems or AI-based tools to support certain platform functionalities. Such systems may be used for purposes including, but not limited to:

• organizing and categorizing funding opportunities
• improving search and discovery of grants or programs
• assisting with matching applicants and funding opportunities
• generating analytics or insights related to platform usage
• detecting potential fraud, misuse, or security risks
• improving platform performance and user experience

These systems may process information submitted through the Platform as part of the services provided.

19.2 Role of the Controller

Controllers using the Platform remain responsible for determining how Personal Data is submitted to the Platform and how the results generated by the Platform are used within their own programs or decision-making processes.

Any outputs, insights, or recommendations generated by automated systems are provided as informational or technical assistance and should not be interpreted as final decisions or guarantees regarding funding eligibility, grant outcomes, or organizational actions.

19.3 Limitations of Automated Processing

Automated tools used within the Platform may rely on available data and system models that may evolve over time. As a result, automated outputs may not always be complete, accurate, or appropriate for all contexts.

Controllers and users should independently review and verify information or results generated through automated features before relying on them for decision-making.

19.4 Use of Data for System Improvement

To improve the functionality, performance, and reliability of the Platform, Socialys Evidentia may use aggregated, anonymized, or de-identified data derived from platform usage to develop, train, evaluate, or improve automated systems and related technologies.

Such processing will not be used to identify individual Data Subjects.

19.5 Human Oversight

Where applicable, automated tools may be supplemented with human oversight or review processes. The use of automated systems does not replace the responsibility of organizations using the Platform to make independent decisions regarding grant administration, funding programs, or related activities.

20.1 Creation of Aggregated Data

In the course of operating the Platform, the Processor may transform or combine data submitted through the Platform into aggregated, statistical, or anonymized datasets that do not identify individual Data Subjects.

Such aggregated data may be created through processes that remove or obscure personal identifiers and combine information across multiple users, organizations, or datasets.

20.2 Permitted Uses of Aggregated Data

The Processor may use aggregated, anonymized, or de-identified data for purposes including, but not limited to:

• platform analytics and system performance monitoring
• research and statistical analysis
• benchmarking and industry insights
• development and improvement of platform features and services
• product development and innovation
• internal operational reporting

Such aggregated data may also be used to better understand trends related to funding ecosystems, grant programs, and platform usage patterns.

20.3 Non-Identification of Individuals

Aggregated or anonymized data will not be used by the Processor to identify individual Data Subjects.

The Processor will take reasonable steps to ensure that aggregated datasets do not contain information that can reasonably be used to identify specific individuals.

20.4 Ownership of Aggregated Data

To the extent permitted by applicable law, aggregated, anonymized, or de-identified data generated through the operation of the Platform may be used by the Processor as part of its operational and analytical activities related to the Platform and its services.

Such aggregated data may be retained and used independently of the Personal Data originally submitted to the Platform.

20.5 Protection of Confidential Information

The creation or use of aggregated data shall not permit the disclosure of confidential information belonging to individual Controllers or Data Subjects in a manner that would reasonably identify specific individuals or organizations.

21.1 Platform Monitoring

The Processor may monitor systems, infrastructure, and platform activity in order to:

• detect unauthorized access or misuse of the Platform
• identify potential security threats or vulnerabilities
• monitor system performance and operational stability
• investigate suspicious or malicious activity
• maintain the security and integrity of the Platform

Such monitoring may involve automated tools, security systems, operational logs, and other technical measures used to manage and protect the Platform.

21.2 Collection of Security-Related Information

As part of platform security and monitoring activities, the Processor may collect and analyze certain technical or operational information associated with the use of the Platform. This may include:

• system access logs
• IP addresses and connection metadata
• device or browser information
• activity logs related to user interactions with the Platform
• system alerts, diagnostics, and operational metrics

This information may be used to identify unusual activity, investigate potential incidents, and improve the overall security and reliability of the Platform.

21.3 Fraud and Abuse Prevention

The Processor may analyze platform activity in order to detect, prevent, and investigate fraudulent behavior, abuse of the Platform, or activities that violate the Terms of Service, Acceptable Use Policy, or applicable laws.

Such monitoring may include automated detection systems, internal reviews, or other security measures designed to identify activities such as:

• fraudulent grant listings or funding opportunities
• fake organizations or impersonation attempts
• scams targeting applicants or organizations
• automated bots or scraping activities
• misuse of platform services for unlawful purposes

Where suspicious activity is identified, the Processor may take reasonable actions to investigate the matter and protect the Platform and its users.

21.4 Platform Integrity and Infrastructure Protection

Security monitoring may also be used to protect the infrastructure and systems that support the Platform, including cloud infrastructure, databases, application servers, and network systems.

These measures may help safeguard the Platform from threats such as unauthorized access attempts, denial-of-service attacks, malware activity, or other forms of cyber threats.

21.5 Compliance With Applicable Laws

Security monitoring activities will be conducted in accordance with applicable laws and internal operational practices governing the protection of user data and platform security.

The Processor may retain security-related logs or records where necessary to maintain system integrity, investigate incidents, comply with legal obligations, or enforce the Platform’s policies and agreements.