Last updated: July 21, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between CIQ Technologies Ltd (“CharityIQ,” “we”) and the customer organization (“Customer,” “you”). It applies where CharityIQ processes personal data on your behalf. If you need a countersigned copy for your records, email legal@charityiq.us.
1. Roles
For personal data you submit about your programs, beneficiaries, and contacts, you are the controller (or “business”) and CharityIQ is the processor (or “service provider”). CharityIQ processes such data only to provide the service and only on your documented instructions, including as set out in the Terms and this DPA.
2. Scope of processing (Annex A)
- Subject matter: provision of CharityIQ’s grant, compliance, and impact tools.
- Duration: the term of your subscription, plus limited retention as described in section 9.
- Nature and purpose: hosting, grounding and generating cited AI output, matching, storage, and support.
- Types of personal data: account and contact details; and any personal data you choose to include in program, beneficiary, outcome, or application content.
- Categories of data subjects: your staff, board members, volunteers, and (where you provide it) your beneficiaries and contacts.
You are responsible for having a lawful basis and any required consents to provide personal data to CharityIQ, and for not sending special-category or highly sensitive data beyond what the service is intended to handle.
3. Our obligations
- Process personal data only on your instructions and for the purposes above.
- Ensure personnel authorized to process data are bound by confidentiality.
- Implement appropriate technical and organizational security measures (see our Security page).
- Assist you, taking into account the nature of processing, with data subject requests and with your security, breach-notification, and impact-assessment obligations.
- Make available information needed to demonstrate compliance and allow for reasonable audits (section 8).
4. Sub-processing
You provide general authorization for CharityIQ to engage sub-processors to operate the service (covering hosting, AI model processing, payments, email, and analytics). We impose data-protection obligations on each sub-processor no less protective than this DPA and remain responsible for their performance. A current list of named sub-processors is available from privacy@charityiq.us; we will give notice of intended changes and a chance to object on reasonable data-protection grounds.
5. AI and training
CharityIQ does not use your personal data to train public AI models, and our model providers are contractually restricted from doing so on data we route through them.
6. Personal data breach
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, and provide information reasonably available to help you meet your notification obligations.
7. International transfers
CharityIQ processes data in the United States and the European Union. Where personal data is transferred across borders in a way that triggers transfer requirements, we rely on appropriate safeguards such as the Standard Contractual Clauses or equivalent mechanisms.
8. Audits
On reasonable prior notice and no more than once per year (unless required by a regulator), we will make available the information necessary to demonstrate compliance with this DPA, which may take the form of up-to-date certifications, reports, or a written questionnaire response.
9. Return and deletion
On termination, and on your request, we will delete or return personal data we process on your behalf, except where retention is required by law. Residual copies in routine backups are deleted on our standard backup cycle.
10. US state privacy terms
Where the CCPA/CPRA or similar state laws apply, CharityIQ acts as a service provider/processor. We will not sell or share personal information; will not retain, use, or disclose it except to provide the service (the “business purpose”) or as permitted by law; will not combine it with data from other sources except as permitted; and we certify that we understand and will comply with these restrictions.
11. General
This DPA is governed by the same law and limitations of liability as the Terms of Service. If any conflict arises between this DPA and the Terms regarding the processing of personal data, this DPA controls.
To request a signed DPA or ask a question, email legal@charityiq.us. CharityIQ is a product of CIQ Technologies Ltd, a company registered in England and Wales (company no. 17338776).