GDPR / Data Rights Policy

2.1 Individuals Covered by This Policy

This policy applies to individuals whose Personal Data may be processed through the Platform, including but not limited to:

• grant applicants submitting applications or related materials
• representatives of organizations using the Platform
• reviewers or evaluators involved in grant assessment processes
• donors, funders, or program administrators associated with funding opportunities
• users who create accounts or otherwise interact with the Platform
• individuals whose information may appear in documents, communications, or other materials submitted through the Platform

2.2 Geographic Scope

This policy is intended to address rights available under applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) applicable to individuals located in the European Economic Area (EEA) and similar privacy laws in other jurisdictions that grant individuals rights over their Personal Data.

Individuals located outside the European Economic Area may also exercise certain rights described in this policy where applicable under relevant privacy regulations.

2.3 Relationship With Other Policies

This policy should be read together with the following documents governing the use of the Platform:

• the Privacy Policy, which explains how Personal Data is collected, used, stored, and shared
• the Terms of Service, which govern the use of the Platform
• the Data Processing Agreement (DPA) applicable to organizations using the Platform

In the event of any conflict between this policy and the applicable Terms of Service or other agreements, the provisions of the applicable agreements shall govern to the extent permitted by law.

2.4 Platform Role

In many cases, organizations using 1BGrants.com to publish funding opportunities or manage grant applications act as Data Controllers, meaning they determine the purposes and means of processing Personal Data.

Socialys Evidentia Global Consulting Private Limited generally acts as a Data Processor, providing the technological infrastructure and services that enable such processing.

As a result, certain requests regarding Personal Data may need to be directed to the organization responsible for collecting the data, as further described in this policy.

3.1 Platform Operator

Socialys Evidentia Global Consulting Private Limited operates 1BGrants.com and provides the technological infrastructure and services that allow organizations to publish funding opportunities, receive grant applications, and manage related workflows.

In many cases, the Company processes Personal Data as part of operating and maintaining the Platform, including activities related to system functionality, platform security, technical support, and service communications.

3.2 Organizations Using the Platform

Organizations that use the Platform to publish funding opportunities, collect grant applications, review submissions, or manage program-related activities generally act as Data Controllers.

As Data Controllers, these organizations determine:

• what Personal Data is collected from individuals
• the purposes for which the data is processed
• how the data will be used within their programs or operations
• how long the data will be retained

These organizations are responsible for ensuring that their use of Personal Data complies with applicable privacy and data protection laws.

3.3 Role of Socialys Evidentia as Data Processor

When organizations use the Platform to collect or manage Personal Data, Socialys Evidentia Global Consulting Private Limited typically acts as a Data Processor.

In this role, the Company processes Personal Data on behalf of the organization and in accordance with the instructions communicated through the organization’s use of the Platform and the applicable Data Processing Agreement (DPA).

3.4 Independent Processing Activities

In certain circumstances, Socialys Evidentia may process certain categories of Personal Data as an independent Data Controller where necessary to operate and manage the Platform.

This may include processing related to:

• user account creation and authentication
• platform security and fraud prevention
• service communications and system notifications
• compliance with legal or regulatory obligations
• aggregated analytics or operational monitoring related to platform performance

Where Socialys Evidentia acts as a Data Controller for such activities, the processing of Personal Data is governed by the Privacy Policy and applicable laws.

3.5 Responsibility for Data Subject Requests

Individuals who wish to exercise their data protection rights may need to contact the organization that collected their Personal Data through the Platform, as that organization typically acts as the Data Controller responsible for determining how the data is used.

Socialys Evidentia may assist such organizations in responding to requests where appropriate and technically feasible in accordance with the applicable Data Processing Agreement and platform capabilities.

4.1 Identification Information

Information used to identify individuals interacting with the Platform, which may include:

• full name
• date of birth (where provided)
• identification details contained in application materials
• other identifiers submitted through grant applications or platform interactions

4.2 Contact Information

Information used to communicate with individuals or organizations using the Platform, including:

• email address
• phone number
• mailing address or geographic location
• professional contact details

4.3 Professional and Organizational Information

Information related to an individual’s professional background, employment, or organizational affiliation, which may include:

• organization name
• job title or professional role
• professional qualifications or experience
• organizational profiles or institutional information

4.4 Grant Application and Program Information

Information submitted as part of grant applications, proposals, or program-related documentation, which may include:

• project descriptions or proposals
• resumes or curriculum vitae (CV)
• supporting documents and attachments
• program reports or related materials
• financial or budget information included in grant applications

4.5 Communications and Correspondence

Information contained in communications exchanged through the Platform or related services, which may include:

• messages sent between users or organizations
• comments or feedback from reviewers
• evaluation notes or scoring information
• attachments or documents shared in communications

4.6 Technical and Usage Information

Certain technical information may be processed in connection with the operation and security of the Platform. This may include:

• IP addresses
• device or browser information
• system access logs
• timestamps associated with platform activity
• usage patterns related to platform interactions

4.7 Documents and Uploaded Materials

Users or organizations may upload files or documents to the Platform that contain Personal Data. These may include application forms, supporting materials, identification documents, references, reports, or other documentation associated with grant applications or program administration.

4.8 Other Information Provided by Users

Personal Data that users or organizations voluntarily submit through the Platform as part of account creation, communications, grant applications, organizational profiles, or other platform interactions may also be processed as part of the services provided.

The specific categories of Personal Data processed may vary depending on how organizations configure and use the services available through 1BGrants.com.

5.1 Processing by Organizations Using the Platform

Organizations that use 1BGrants.com to publish funding opportunities, collect grant applications, or manage program-related activities typically act as Data Controllers and determine the lawful basis for processing Personal Data submitted through the Platform.

Such lawful bases may include, but are not limited to:

• Consent, where individuals voluntarily provide their Personal Data in connection with grant applications or program participation
• Performance of a contract, where processing is necessary to administer applications, programs, or related services
• Legitimate interests, where organizations process data for purposes reasonably necessary to administer funding opportunities or evaluate applications
• Legal obligations, where processing is required to comply with applicable laws or regulatory requirements

Individuals submitting Personal Data in connection with a specific grant opportunity or program should review the privacy policies or notices provided by the relevant organization responsible for that program.

5.2 Processing by the Platform Operator

Socialys Evidentia Global Consulting Private Limited may process certain Personal Data as part of operating and maintaining the Platform.

Such processing may be based on lawful grounds including:

• legitimate interests, such as maintaining platform security, improving system performance, and preventing fraud or misuse
• performance of a contract, where processing is necessary to provide services to users of the Platform
• legal obligations, where processing is required to comply with applicable legal or regulatory requirements

5.3 User-Provided Information

Where individuals voluntarily submit Personal Data through the Platform, such submission may constitute consent to the processing of such information for the purposes described in the Privacy Policy, Terms of Service, and related platform policies.

Individuals remain responsible for reviewing the relevant privacy notices associated with any specific funding opportunity or program to understand how their data will be used by the organization administering that program.

6.1 Right to Access

Individuals may have the right to request confirmation of whether their Personal Data is being processed and to obtain access to such data.

Where applicable, individuals may request a copy of their Personal Data and information regarding how their data is processed.

6.2 Right to Rectification

Individuals may request the correction of inaccurate or incomplete Personal Data relating to them.

Where appropriate, individuals may also request that incomplete information be updated or supplemented.

6.3 Right to Erasure (Right to be Forgotten)

In certain circumstances, individuals may request the deletion of their Personal Data.

This right may apply where the data is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is no longer lawful.

However, this right may be limited where the retention of data is required for legal obligations, dispute resolution, or legitimate operational purposes.

6.4 Right to Restrict Processing

Individuals may have the right to request that the processing of their Personal Data be restricted in certain circumstances, such as when the accuracy of the data is contested or when the individual objects to the processing.

During the period of restriction, the Personal Data may be stored but not actively processed except where permitted by law.

6.5 Right to Data Portability

Where applicable, individuals may request that Personal Data they have provided be made available in a structured, commonly used, and machine-readable format, and may request that such data be transferred to another service provider where technically feasible.

6.6 Right to Object

Individuals may have the right to object to the processing of their Personal Data in certain circumstances, particularly where processing is based on legitimate interests or is used for direct marketing purposes.

Where a valid objection is received, processing may be restricted or stopped unless there are compelling legitimate grounds to continue processing.

6.7 Rights Related to Automated Decision-Making

Individuals may have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significant impacts.

Where automated tools or systems are used within the Platform, such systems are generally intended to assist with platform functionality and do not replace independent decision-making by organizations administering funding opportunities.

7.1 Submitting a Request

Data rights requests may be submitted by contacting us through one of the following channels:

To help ensure that your request is received and processed promptly, you are encouraged to copy all the above email addresses when sending your request.

7.2 Information Required

To help us process a request efficiently, individuals may be asked to provide certain information necessary to identify the relevant data and verify the identity of the requester. This may include:

• name and contact details
• a description of the request
• information that helps identify the data or account involved
• verification information where necessary to confirm identity

This verification process helps protect Personal Data from unauthorized access or disclosure.

7.3 Response Time

Where applicable under relevant data protection laws, requests will be reviewed and addressed within a reasonable timeframe.

In many cases, responses may be provided within thirty (30) days, although the time required to process a request may vary depending on the complexity of the request and the information available.

Where additional time is required to process a request, the requester may be informed accordingly.

7.4 Requests Related to Organizations Using the Platform

In many cases, Personal Data processed through 1BGrants.com is submitted and controlled by organizations that use the Platform to manage grant opportunities and related activities.

In such cases, individuals may be directed to contact the organization responsible for collecting the data, as that organization typically acts as the Data Controller and is responsible for responding to data rights requests related to that information.

Where appropriate and technically feasible, Socialys Evidentia may assist such organizations in responding to requests in accordance with the applicable Data Processing Agreement (DPA) and platform capabilities.

8.1 Responsibility of Organizations

When individuals submit Personal Data in connection with a specific funding opportunity, grant program, or application process, the organization administering that program is generally responsible for determining how that Personal Data is used, stored, and managed.

As a result, requests relating to Personal Data submitted through a specific program or funding opportunity should generally be directed to the organization responsible for collecting the data.

8.2 Contacting the Relevant Organization

Individuals wishing to exercise their data protection rights in relation to information submitted to a particular grant program or organization may need to contact that organization directly.

Such requests may include:

• requests to access application information
• requests to correct inaccurate or incomplete data
• requests to delete submitted information
• requests to restrict or object to certain processing activities

The relevant organization is typically in the best position to review and respond to such requests.

8.3 Role of Socialys Evidentia

Socialys Evidentia Global Consulting Private Limited, as the operator of 1BGrants.com, generally acts as a Data Processor for Personal Data processed on behalf of organizations using the Platform.

Where a request relating to Personal Data controlled by an organization is received directly by Socialys Evidentia, the Company may direct the individual to contact the relevant organization responsible for the data or may notify the organization where appropriate.

8.4 Assistance to Organizations

Where technically feasible and appropriate, Socialys Evidentia may assist organizations using the Platform in responding to data rights requests in accordance with the applicable Data Processing Agreement (DPA) and the technical capabilities of the Platform.

9.1 Purpose of Verification

Identity verification helps ensure that Personal Data is disclosed, modified, or deleted only at the request of the individual to whom the data relates or a person legally authorized to act on their behalf.

This process helps prevent unauthorized access, fraud, or misuse of Personal Data.

9.2 Verification Information

Depending on the nature of the request and the information available, individuals may be asked to provide information necessary to confirm their identity. This may include:

• name and contact details associated with the request
• email address or account information used on the Platform
• additional information reasonably necessary to confirm the identity of the requester

The level of verification required may vary depending on the sensitivity of the data involved and the nature of the request.

9.3 Authorized Representatives

If a request is submitted by an authorized representative on behalf of an individual, the requester may be asked to provide documentation demonstrating their authority to act on behalf of the individual concerned.

9.4 Inability to Verify Identity

If Socialys Evidentia is unable to reasonably verify the identity of the individual making the request, the Company may be unable to fulfill the request in order to protect the security and confidentiality of Personal Data.

Where possible, the requester may be asked to provide additional information necessary to verify their identity.

10.1 Legal and Regulatory Obligations

In certain situations, Socialys Evidentia Global Consulting Private Limited may be required to retain or process Personal Data in order to comply with legal or regulatory obligations. Where such obligations apply, requests to access, delete, or restrict processing of Personal Data may be limited to the extent necessary to comply with applicable laws.

10.2 Protection of Rights and Interests

Certain requests may be limited where fulfilling the request could adversely affect the rights, privacy, or freedoms of other individuals or organizations.

For example, where Personal Data forms part of grant evaluation processes, communications, or program records involving multiple parties, certain information may not be disclosed if doing so would reveal confidential information about other individuals or organizations.

10.3 Platform Security and Fraud Prevention

Requests may also be limited where processing is necessary to maintain the security, integrity, and reliability of the Platform, including activities related to fraud detection, prevention of misuse, investigation of suspicious activity, or enforcement of the Platform’s policies and agreements.

10.4 Ongoing Disputes or Legal Claims

Where Personal Data is required for the establishment, exercise, or defense of legal claims, the Company may retain or continue processing such data as necessary to protect its legal rights or the rights of other parties.

10.5 Technical and Operational Constraints

In certain circumstances, the ability to fulfill a request may be limited by the technical architecture of the Platform, the nature of the data stored, or operational requirements related to system security and backup processes.

For example, data may continue to exist in backup systems or archived environments for a limited period of time following deletion from active systems.

10.6 Requests Related to Controller Data

Where Personal Data is processed on behalf of an organization using the Platform, certain requests may need to be directed to that organization acting as the Data Controller, as they determine the purposes and means of processing the data.

In such cases, Socialys Evidentia may direct the individual to the relevant organization responsible for the data.

11.1 Cross-Border Processing

Socialys Evidentia Global Consulting Private Limited may process Personal Data using cloud infrastructure, service providers, or operational systems that operate in multiple jurisdictions. This may involve transferring Personal Data to countries that may have data protection laws different from those in the country where the data was originally collected.

Such transfers may occur where necessary to provide, operate, maintain, secure, or improve the services offered through 1BGrants.com.

11.2 Global Infrastructure

The Platform may rely on distributed cloud infrastructure, hosting providers, or technical service providers that maintain data centers in various regions around the world. Personal Data may therefore be stored or processed in locations selected by the Company or its authorized service providers based on operational, performance, or security considerations.

11.3 Processing by Affiliates and Service Providers

Personal Data may also be processed by affiliates, subsidiaries, or authorized service providers of Socialys Evidentia that assist with activities related to platform development, infrastructure management, technical support, security monitoring, analytics, or other operational functions necessary to operate the Platform.

Such entities may be located in different countries and may process Personal Data only in accordance with applicable contractual obligations and data protection requirements.

11.4 Safeguards for Data Transfers

Where applicable, Socialys Evidentia may implement reasonable safeguards designed to protect Personal Data transferred across borders. Such safeguards may include contractual protections, operational policies, and technical measures designed to maintain the confidentiality, integrity, and security of Personal Data during international transfers.

11.5 User Acknowledgment

By using 1BGrants.com or submitting Personal Data through the Platform, users acknowledge that their information may be transferred to and processed in jurisdictions outside their country of residence where necessary to operate and support the services provided by the Platform.

12.1 Retention During Platform Use

Personal Data submitted through the Platform may be retained for as long as an account remains active or as long as the organization responsible for the data continues to use the Platform to administer funding opportunities, manage applications, or conduct related program activities.

During this period, Personal Data may be stored and processed in order to support the functionality of the Platform and the services provided.

12.2 Retention by Organizations Using the Platform

Organizations using 1BGrants.com to manage grant programs or collect applications typically act as Data Controllers and are responsible for determining how long Personal Data submitted through their programs is retained.

Individuals should review the privacy notices or policies provided by the relevant organization responsible for the program to understand how long their Personal Data may be retained.

12.3 Retention for Legal and Operational Purposes

Notwithstanding the above, Socialys Evidentia may retain certain categories of data where necessary to:

• comply with applicable legal or regulatory obligations
• resolve disputes or enforce contractual agreements
• maintain system security and operational integrity
• prevent fraud or misuse of the Platform
• maintain internal records required for operational, security, or compliance purposes

12.4 Backup and Archival Systems

Personal Data may continue to exist in backup systems, archived storage, or disaster recovery systems for a limited period of time following deletion from active systems.

Such data may not be immediately removed from all backup environments but will remain protected by appropriate security safeguards and may be deleted in accordance with the Company’s standard backup management and data retention practices.

12.5 Deletion Requests

Where applicable under relevant data protection laws, individuals may request the deletion of their Personal Data. However, such requests may be subject to the limitations described in this policy, including situations where data must be retained to comply with legal obligations or to protect the legitimate interests of the Platform or its users.

13.1 Technical and Organizational Measures

The Company may implement a variety of security measures appropriate to the nature of the services provided and the risks associated with processing Personal Data. Such measures may include, where appropriate:

• access control mechanisms to limit access to authorized personnel
• authentication and account security procedures
• secure transmission of data where applicable
• system monitoring and logging of platform activity
• infrastructure security and network protections
• data backup and recovery procedures
• internal policies governing the handling of sensitive information

13.2 Cloud Infrastructure and Service Providers

The Platform may rely on cloud-based infrastructure providers and other service providers that support the hosting, storage, and operation of the Platform.

These providers may operate data centers in multiple jurisdictions and may implement their own security practices and operational safeguards designed to protect the infrastructure used to support the Platform.

13.3 Access Controls

Access to Personal Data processed through the Platform is limited to authorized personnel, contractors, or service providers who require access to perform responsibilities related to platform operations, maintenance, technical support, security monitoring, or service administration.

Individuals granted such access may be subject to confidentiality obligations and internal policies governing the handling of sensitive information.

13.4 Shared Responsibility

Maintaining the security of Personal Data processed through the Platform is a shared responsibility. Organizations using the Platform and individual users are responsible for maintaining the confidentiality of their account credentials, implementing appropriate internal access controls, and ensuring that Personal Data submitted to the Platform is handled in accordance with applicable laws.

13.5 No Absolute Security

While the Company implements reasonable safeguards designed to protect Personal Data, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure. As a result, the Company cannot guarantee absolute security of Personal Data processed through the Platform.

The Company will take reasonable steps to respond to and address security incidents in accordance with applicable laws and internal operational procedures.

14.1 Policy Updates

Any updates or modifications to this policy will be published on 1BGrants.com or the relevant website associated with the Platform. The updated version of the policy will become effective upon publication unless otherwise stated.

Users are encouraged to review this policy periodically to remain informed about how Personal Data rights are addressed and how requests may be submitted.

14.2 Notification of Changes

Where appropriate, the Company may provide notice of significant changes to this policy through platform notifications, email communications, or other reasonable communication channels. However, the Company is not obligated to provide individual notice for every update.

14.3 Continued Use of the Platform

Continued use of 1BGrants.com after the publication of an updated version of this policy constitutes acknowledgment of the updated terms to the extent permitted under applicable law.

If a user does not agree with the updated policy, the user may discontinue use of the Platform and may contact the Company regarding any data-related concerns.

16.1 Role of the Platform

The Platform provides a digital environment where organizations may publish funding opportunities, collect applications, communicate with applicants, and manage program-related activities. Socialys Evidentia provides the technical infrastructure that enables these services.

In many cases, organizations using the Platform act as Data Controllers, meaning they determine the purposes and means of processing Personal Data submitted through their funding opportunities or programs.

16.2 Responsibility of Organizations

Organizations that publish funding opportunities, receive applications, or manage grant programs through 1BGrants.com are responsible for:

• determining how Personal Data submitted through their programs is used
• ensuring that their data processing activities comply with applicable privacy and data protection laws
• providing appropriate privacy notices or policies to individuals submitting data to their programs

16.3 Role of Socialys Evidentia

Socialys Evidentia generally acts as a Data Processor for Personal Data processed through the Platform on behalf of organizations using the services.

The Company does not independently determine how Personal Data submitted to specific grant programs is used by the organizations administering those programs, except where necessary to operate, secure, and maintain the functionality of the Platform.

16.4 No Verification of Organizational Data

The Platform may allow organizations to publish information about funding opportunities, programs, or related activities. Socialys Evidentia does not independently verify all information provided by organizations using the Platform.

Users are responsible for independently reviewing and verifying information related to funding opportunities or programs before relying on such information.

16.5 Independent Decisions by Users

Any decisions made by applicants, organizations, donors, or other users based on information available through 1BGrants.com are made independently by those users.

Socialys Evidentia is not responsible for decisions made by organizations administering funding programs or by individuals choosing to apply for funding opportunities through the Platform.