Data Processing Agreement

Ollegacy processes Personal Data as necessary to provide the Ollegacy platform and associated services as described in the Terms of Service, and as further specified in this DPA.

Ollegacy processes Personal Data for the duration of the Organisation's active use of the Service, and for a retention period of up to 30 days following termination of the Organisation's account, after which Personal Data is permanently deleted (subject to legal retention obligations described in Section 9).

Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, erasure, and destruction of Personal Data to provide the Service features described in the Terms of Service.

To deliver the Ollegacy community portal platform, including member profile management, event and meeting management, forum and support wall features, fundraising campaign facilitation, birthday tracking, transactional email notifications, and related features — solely as instructed by the Organisation.

• Identification data: full name, email address
• Authentication data: hashed password, OAuth identifiers (Google, LinkedIn)
• Profile data: profile photo, city/state/country, biography, professional story
• Demographic data: birthday month and day (not year), life stage, career stage
• Preference data: "open to" connection preferences, privacy settings
• Community activity data: forum posts and replies, event and meeting RSVPs, support wall posts, solidarity reactions, birthday wishes sent and received
• Fundraising data: fundraising page goals, donation amounts (pledge or payment), donor names
• Technical data: IP addresses (in server logs, retained max 90 days), login timestamps, first login date

Members of the Organisation's community portal (including alumni, faith community members, professional network members, or other individuals admitted by the Organisation), and Organisation Admins to the extent their data is processed as part of the platform service.

Ollegacy will process Personal Data only on documented instructions from the Organisation, as set out in this DPA and the Terms of Service. If Ollegacy is required by Applicable Data Protection Law to process Personal Data for another purpose, Ollegacy will inform the Organisation before such processing, unless the law prohibits such notification.

Ollegacy will ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations (whether contractual or statutory) and have received appropriate data protection training. Ollegacy will not permit any person to process Personal Data unless that person is subject to those obligations.

Ollegacy will implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 of the GDPR and as further described in Section 7 of this DPA.

Ollegacy will assist the Organisation in responding to Data Subject requests to exercise their rights under Applicable Data Protection Law (access, rectification, erasure, portability, objection, restriction), by making available the technical tools within the Service to fulfil those requests. Where a Data Subject contacts Ollegacy directly, Ollegacy will forward the request to the Organisation without undue delay. Ollegacy will provide reasonable additional assistance on request, at the Organisation's cost for any work beyond standard platform functionality.

Ollegacy will assist the Organisation in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to Ollegacy.

Ollegacy will not use Personal Data processed under this DPA for its own marketing, advertising, research, or any purpose beyond the provision of the Service to the Organisation. Ollegacy will not sell, rent, or otherwise make available Personal Data to any third party for that third party's own purposes.

The Organisation grants Ollegacy general written authorisation to engage the sub-processors listed in Schedule A of this DPA (and in Ollegacy's Privacy Policy at ollegacy.com/privacy) for the specific purposes described therein.

Before engaging any sub-processor, Ollegacy will enter into a written data processing agreement with that sub-processor imposing data protection obligations no less protective than those in this DPA. Ollegacy remains fully liable to the Organisation for the performance of each sub-processor's data protection obligations.

Ollegacy will inform the Organisation of any intended changes to the list of sub-processors (additions or replacements) by updating the sub-processor list at ollegacy.com/privacy and notifying Organisation Admins via email at least 14 days before the change takes effect. The Organisation may object to a new sub-processor within 14 days of notification on reasonable, documented grounds relating to data protection. If the parties cannot resolve the objection, the Organisation may terminate the Service on written notice, without penalty for the remainder of the current billing period.

Without undue delay and, where feasible, within 48 hours of becoming aware of a Security Incident involving Personal Data processed under this DPA, Ollegacy will notify the Organisation. The notification will include, to the extent available at the time: (a) the nature of the Security Incident, including categories and approximate number of Data Subjects and Personal Data records affected; (b) the likely consequences of the Security Incident; (c) the measures taken or proposed to address the Security Incident and mitigate its effects.

Where the information listed in 6.1 cannot be provided simultaneously, Ollegacy may provide it in phases without undue further delay.

The Organisation acknowledges that it is solely responsible for determining whether and how to notify the relevant supervisory authority (under Article 33 GDPR, within 72 hours) and affected Data Subjects (under Article 34 GDPR). Ollegacy's notification to the Organisation under Section 6.1 does not constitute a determination that notification is required or that a reportable breach has occurred.

Nothing in this Section 6 constitutes an admission by Ollegacy of fault or liability in connection with any Security Incident.

Personal Data processed under this DPA may be transferred to and stored in the United States, where Ollegacy's infrastructure and most sub-processors are located. The United States does not have an adequacy decision from the European Commission for general data transfers.

For transfers of Personal Data from the EEA to the United States made under this DPA, the parties agree that the EU Standard Contractual Clauses (Module 2: Controller to Processor) in Commission Implementing Decision (EU) 2021/914 are hereby incorporated into this DPA by reference. For transfers from the United Kingdom, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs (as appropriate) applies. The parties agree that the details required to complete those templates are as follows:

• Data exporter: the Organisation (as described in the Organisation's account details)
• Data importer: Transversal Group LLC (Ollegacy)
• Categories of data subjects and personal data: as described in Section 2 of this DPA
• Frequency of transfer: continuous, for the duration of the Service
• Nature of processing: as described in Section 2 of this DPA
• Retention period: as described in Section 9 of this DPA
• Technical and organisational measures: as described in Section 7 of this DPA

Ollegacy ensures that transfers to sub-processors in third countries are covered by appropriate transfer mechanisms (SCCs or adequacy decisions) under Applicable Data Protection Law, as described in Section 5.2 and Schedule A.

Upon termination of the Organisation's Ollegacy account or upon written request, Ollegacy will, at the Organisation's choice: (a) return to the Organisation a complete export of all Personal Data processed under this DPA in a machine-readable format (JSON or CSV); or (b) permanently and irreversibly delete all such Personal Data. The Organisation may make this request within 30 days of account termination. After 30 days, Ollegacy will permanently delete all Personal Data associated with the terminated account without further notice.

Notwithstanding 9.1, Ollegacy may retain Personal Data to the extent required by Applicable Data Protection Law or other applicable law (for example, financial transaction records for 7 years as required by U.S. tax law). Such retained data will be processed only for the purposes of complying with the retention obligation and will be protected in accordance with this DPA.

Upon request, Ollegacy will provide written certification that all Personal Data has been deleted in accordance with this Section 9.

Ollegacy will make available to the Organisation all information reasonably necessary to demonstrate compliance with this DPA. Ollegacy will allow for and contribute to audits, including inspections, conducted by the Organisation or an auditor mandated by the Organisation, no more than once per calendar year and upon at least 30 days' written notice.

Any audit will be conducted during Ollegacy's normal business hours, in a manner that does not unreasonably interfere with Ollegacy's business operations, and subject to the Organisation's auditor entering into a reasonable confidentiality agreement with Ollegacy. The Organisation will bear all costs associated with such an audit.

Ollegacy may satisfy its audit obligations by providing a current SOC 2 Type II report or equivalent third-party security certification covering the relevant processing, where available, in lieu of a direct audit.