Data Processing Addendum

1. Roles

The institution acts as the Data Controller for personal data it uploads (faculty, program, contact records). University Connect acts as the Data Processor for that data.

2. Categories of data

• Institutional profile data (name, country, programs, research assets).
• Faculty and staff contact details (name, email, role) submitted by the institution.
• Account data for authorized users (email, authentication metadata).
• Interaction data (partnership requests, messages, analytics events).

3. Subprocessors

• Supabase — database, authentication, storage.
• Algolia — public university search index.
• Brevo (Sendinblue) — transactional email.
• Google (Gemini via Lovable AI Gateway) — AI matchmaking and outreach drafts.
• Cloudflare — edge hosting and DNS.

We will notify institutional customers of material changes to this list.

4. Security measures

• Row-level security on every customer table, enforced at the database layer.
• Encryption in transit (TLS 1.2+) and at rest for the managed database and storage.
• Role-based access with platform admin, university admin, and faculty scopes.
• Audit logs for claim decisions, admin actions, and email sends.
• Least-privilege service credentials with periodic rotation.

5. Data subject rights

Institutions can update or delete faculty, contact, and program records directly in the management dashboard. For access, correction, or deletion requests from individual data subjects, email privacy@8b.finance and we will respond within 30 days.

6. International transfers

Data is processed in the regions supported by our subprocessors, primarily the United States and the European Union. Standard Contractual Clauses are used where required.

7. Incident response

We will notify affected institutions without undue delay after becoming aware of a personal data breach that impacts their data, and coordinate on the required notifications.

8. Contact

Data protection questions: privacy@8b.finance.