Funderce - Crowdfunding & Ecommerce Strategy

Data Processing Terms

Last updated: 21 October 2026

These terms form part of our Terms of Service (funderce.com/terms) and apply without a separate signature whenever, while delivering a service, we process personal data on your behalf. "We" is Khachatur Martirosyan, autónomo, NIF Z1494828V, Valencia, Spain. "You" is the client who ordered the service.

1. When these terms apply

They apply when you give us access to personal data of other people as part of a service, for example:

  • your store's orders and customers, when you connect or share your Shopify or other store
  • subscribers and engagement in your email platform
  • visitor data in your analytics or heatmap tools (GA4, Clarity)
  • customer or audience data you share for analysis

They do not apply to your own contact and payment details as our client. Those are covered by our Privacy Policy (funderce.com/privacy).

2. Roles

  • You are the controller. You decide why and how the data is processed, and you are responsible for having a lawful basis to share it with us.
  • We are the processor. We process it only on your documented instructions (the order, the proposal and your messages) and only to deliver the service.

3. The processing

  • Subject matter and purpose: analysis, reporting, optimization and setup work described in your order.
  • Duration: while the service runs, then until deletion under section 9.
  • Types of data: names, email addresses, phone numbers, postal addresses, order, pledge and purchase history, website behaviour, ad interaction data, location, device information and IP addresses, as present in the accounts and files you share.
  • People concerned: your customers, crowdfunding backers and subscribers, website visitors, email subscribers and ad audiences.

4. Our obligations

  • We process the data only on your instructions, and tell you if we believe an instruction breaks data protection law.
  • We use it for no other purpose, and avoid accessing it where the work allows.
  • Only we work on it. Anyone else given access first agrees in writing to keep it confidential, and gets only the access the task needs.
  • We keep appropriate security measures in place (section 10).

5. Requests from the people concerned

If someone asks us directly to access, correct, delete or move their data, we tell you promptly and do not answer them ourselves unless you ask us to. We help you answer such requests, and with data protection impact assessments where the law requires one.

6. Data breaches

We tell you without undue delay, and within 72 hours of becoming aware of it, of any breach affecting the data we process for you: what happened, the categories and approximate number of people concerned, the likely consequences, what we have done and will do, and who to contact. We cooperate with you on the investigation and keep a record of every breach.

7. Sub-processors

  • You authorise us to use providers in these categories: hosting, databases and file storage (including encrypted backups), application logging, email and productivity, video calls, and AI tools that analyse data or draft deliverables. AI tools are not allowed to use your data to train their models.
  • The current providers in each category are listed on request to legal [at] funderce.com.
  • We tell you at least 14 days before adding a provider that will process your data in a new category. You can object within those 14 days with your reasons; if we cannot accommodate the objection, either side may end the affected service with 30 days' notice.
  • We bind every sub-processor to data protection obligations at least as protective as these, and we remain responsible to you for them.

8. Transfers outside the EEA

Some providers process data outside the European Economic Area. Where the destination has no adequacy decision, the transfer relies on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), which are incorporated into these terms by reference with the modules that match the roles in section 2.

9. Deletion and return

When the service ends, or when you ask in writing, we delete or return the data we process for you within 30 days, working copies on our own computer included, and confirm the deletion in writing if you ask. Copies inside our encrypted database backups are erased automatically when those backups expire, no later than 91 days after the deletion, and are never restored except to recover from a failure. We may keep what the law requires us to keep, such as tax records, still protected by these terms.

10. Security measures

  • Access only for the people who need it, with strong, unique passwords on administrative accounts and key-only logins to our server.
  • The access to your accounts the work needs: read-only where the work only reads, write access only for work that changes your account. We remove our access, or ask you to, when the work is delivered.
  • Encryption in transit (TLS); stored data encrypted by our hosting, database and storage providers; database backups encrypted before they leave our server.
  • Only the data the work needs, pseudonymised where feasible.
  • Software kept up to date, and nightly encrypted backups of our tools database.
  • Hosting, database and storage providers with SOC 2 or ISO 27001 certifications; our own server sits in a professional data centre in Spain.

11. Checking compliance

You can ask in writing for information about how we protect your data, and see the relevant certifications or documentation. An audit by you or an independent auditor bound by confidentiality needs 30 days' written notice, takes place in normal business hours without disrupting our work, covers only the processing of your data, and is at your cost. We cooperate reasonably.

12. Liability, duration and law

  • Liability follows the liability section of our Terms of Service and Article 82 GDPR.
  • These terms last as long as we process data for you. Sections 8, 9, 11 and this section continue after the service ends.
  • Processing of EEA personal data is governed by the GDPR and Spanish law; everything else by the law of our Terms of Service.

13. Contact

Data protection questions: legal [at] funderce.com.