Data processing agreement

For an individual researcher using the service directly, Open Research Fund is the controller and our privacy policy applies. Where an institution or lab provides us with personal data about its members so that we can prepare applications for them, the institution is the controller (the organisation, in PDPA terms) and Open Research Fund is the processor (the data intermediary) acting on its documented instructions.

Names, contact details, institutional affiliation and role, career history, publication records, research descriptions, prior funding, and the content of applications and award correspondence. We do not require, and ask you not to send us, special category data such as health, ethnicity, or religious information unless a specific funder requires it, in which case it is processed only for that application.

We process personal data solely to identify funding opportunities, prepare and submit applications you approve, and administer awards. We do not use it for any other purpose, do not sell it, and do not use it to train models that are shared outside the service. If we believe an instruction breaches data protection law we will tell you before acting on it.

Everyone who accesses personal data at Open Research Fund is bound by confidentiality obligations and receives data protection training. Data is encrypted in transit and at rest, access is limited to the people who need it for the work, and every access to an application file is logged. We test our controls regularly and fix findings promptly.

We use a small number of providers to run the service: cloud hosting for the website and API, a managed database, an email provider, and Stripe for payments and held funds. Each is bound by a written agreement imposing equivalent obligations to this one. The current list is available on request, and we give at least 30 days' notice before adding or replacing one so you can object.

Data may be processed in Singapore, the United States and the European Union. Where personal data leaves the jurisdiction it was collected in, we meet the PDPA's transfer limitation obligation by binding the recipient to a comparable standard of protection, rely on the European Commission's standard contractual clauses or an equivalent lawful mechanism for EU and UK data, and assess the transfer before it happens.

We help you respond to data subject requests received about people whose data we process for you, and we forward any request we receive directly within three working days. We assist with data protection impact assessments and consultations with regulators where our processing is in scope.

If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay and in any case within 48 hours, with what we know about the nature of the breach, the data and people affected, and the steps we are taking. We do not notify regulators or data subjects on your behalf unless you ask us to.

We keep personal data for as long as we are preparing or administering applications for you. When the relationship ends, or earlier on your instruction, we delete or return it within 30 days, except for records we must retain to meet funder reporting or financial regulation, which are kept only as long as those obligations require and then deleted.

We make available the information you reasonably need to demonstrate compliance with this agreement, and permit audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice and no more than once a year unless a regulator requires otherwise or a breach has occurred.

This agreement is governed by the laws of Singapore and any dispute under it is subject to the exclusive jurisdiction of the courts of Singapore, except that where the GDPR or UK GDPR requires particular terms to apply to a transfer, those terms take precedence for that transfer.