gofundnode legal

GoFundNode — Data Processing Agreement (DPA) Template

Superseded by ADR-046 (2026-06-03). This document reflects the prior crypto-first posture, which is no longer GA scope. See ADR-046.

TEMPLATE — REQUIRES RETAINED COUNSEL REVIEW BEFORE PRODUCTION USE. NOT LEGAL ADVICE.

Effective date: TBD — executed alongside the Customer TOS where the tenant transmits applicant or other end-user personal data through the v1 vendor API.
Counterparties:

Source-of-truth: docs/architecture/GOFUNDNODE_ADRS.md (ADR-015 envelope, ADR-042 controller/processor allocation), CLAUDE.md §1, §7, docs/legal/terms/CUSTOMER_TOS.md, docs/legal/terms/PRIVACY_POLICY.md.

This DPA is incorporated by reference into the Customer TOS and applies to Personal Data the Controller submits to the Processor for processing in connection with the v1 vendor API services.

1. Definitions

Capitalized terms have the meanings given in the GDPR (Regulation (EU) 2016/679), unless otherwise defined here.

2. Allocation of roles

2.1 Controller responsibilities (apply.fun). With respect to Applicant PII:

2.2 Processor responsibilities (GoFundNode). With respect to Applicant PII:

2.3 Allocation rationale. GoFundNode operates the residential execution platform; apply.fun determines what tasks are submitted, on behalf of which applicants, and with what data. The Processor's only purpose for Applicant PII is to perform the task the Controller instructed. This is the textbook controller/processor allocation under GDPR Article 28, and the parties acknowledge it. Architectural basis: ADR-042 (D-7) and the counsel-pack §12.5 entry.

3. Subject matter, duration, and categories

3.1 Subject matter. Processing of Applicant PII by the Processor for the purpose of executing typed tasks (e.g., ats.application) on residential operator devices, returning results to the Controller.

3.2 Duration. The duration of the Customer TOS, plus the retention periods documented in docs/legal/terms/PRIVACY_POLICY.md §5 to the extent applicable.

3.3 Nature and purpose. Automated processing including transmission, sealed-envelope storage, projection to assigned operator device, mutation during task execution by Platform-controlled worker, sealed-envelope extraction, encrypted upload, durable storage, and final delivery to the Controller via webhook.

3.4 Categories of data subjects. Applicants — natural persons applying for employment via apply.fun who have authorized apply.fun to submit applications on their behalf.

3.5 Categories of personal data. Identity (name, contact details), employment history, education, resume content, ATS-required custom field responses, OTP retrieval tokens (transient, not durable storage), and the metadata of executed task leases (timing, success/failure, operator anonymized identifier).

4. Sub-processing

4.1 General consent. The Controller authorizes the Processor's use of Sub-processors listed in docs/legal/SUBPROCESSORS.md (maintained by the Processor under the L4 sovereignty workstream) at the date of this DPA's execution.

4.2 New Sub-processor notice. The Processor provides the Controller with at least 30 days' advance written notice of any addition or replacement of Sub-processors (e.g., via email to the Controller's primary contact and via the published Sub-processor list update). The Controller may object to a new Sub-processor on reasonable grounds related to GDPR compliance; on objection, the parties shall negotiate in good faith a resolution, including the Controller's right to terminate the affected Services if no resolution is reached.

4.3 Operators as Sub-processors. Master-node operators executing tasks under this DPA are Sub-processors by virtue of the Operator Contractor Agreement and the operator-side flow-down obligations summarized in §4.5. Their individual identifiers are not published in the public Sub-processor list; the category (community master-node operators) is documented in the Sub-processor list and is subject to the new-Sub-processor objection mechanism in §4.2 for category changes, not for individual operator turnover.

4.4 Flow-down to all Sub-processors. Each Sub-processor is bound by data protection terms substantially equivalent to those in this DPA, including the security obligations in §5, sub-processing limits, and audit cooperation. Architectural basis: §14.5 of the Legal Handoff and ADR-042 (D-7).

4.5 Operator-side flow-down clauses (substantive). The Operator Contractor Agreement at docs/legal/terms/OPERATOR_CONTRACTOR_AGREEMENT.md §7 binds operators to:

The Processor enforces these obligations technically (sealed three-layer envelope per ADR-015, worker isolation per ADR-009, lease TTL, supervisor canary updates per ADR-034) and contractually (Operator Agreement §§ 4, 7, 8).

4.6 Liability for Sub-processors. The Processor remains fully liable to the Controller for the acts and omissions of its Sub-processors, including operators acting as Sub-processors, with respect to Applicant PII.

5. Security

5.1 The Processor implements technical and organizational measures appropriate to the risk:

5.2 The Processor will provide the Controller with sufficient information to demonstrate compliance with the measures in §5.1 upon reasonable request, including by way of audit per §9 and through written summaries of audit reports.

6. Personal data breaches

6.1 The Processor notifies the Controller of a personal data breach (as defined in GDPR Article 4(12)) without undue delay and at most within 72 hours of becoming aware.

6.2 The notification will, to the extent known at the time, include: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records, likely consequences, and measures taken or proposed to address the breach.

6.3 The Processor provides ongoing updates as additional information becomes available.

6.4 The Processor assists the Controller with the Controller's downstream notification obligations under Articles 33-34 GDPR.

7. Data subject rights

7.1 The Processor implements technical and organizational measures to assist the Controller with the Controller's obligations to respond to DSAR requests.

7.2 If a data subject contacts the Processor directly with a DSAR concerning Applicant PII, the Processor will forward the request to the Controller and inform the data subject that the Controller is the responsible party. The Processor does not respond substantively to applicant DSARs.

7.3 The Processor returns Applicant PII or assists with deletion within thirty (30) days of the Controller's documented instruction, except where retention is legally required and notified to the Controller.

8. International transfers

8.1 The parties acknowledge that some Sub-processing may take place outside the EEA, including:

8.2 Where transfer outside the EEA occurs, the parties rely on:

8.3 The Processor maintains a Transfer Impact Assessment for high-risk transfers, available to the Controller upon reasonable request.

8.4 Solana settlement data. The Controller acknowledges that on-chain settlement data (operator wallet addresses, transactions) is necessarily public and globally replicated; this is unavoidable feature of the chosen settlement rail and is not a defect of the Processor's measures.

9. Audit

9.1 The Processor permits the Controller to audit Processor's compliance with this DPA once per calendar year on reasonable advance notice (at least 30 days) during normal business hours.

9.2 The Controller may engage an independent third-party auditor at the Controller's cost; the auditor must be bound by confidentiality terms reasonably acceptable to the Processor.

9.3 The Processor may satisfy audit requirements by providing the Controller with attestation reports (e.g., SOC 2 Type II if/when available) covering the relevant subject matter.

9.4 Audits triggered by a regulatory directive or by a substantive breach event are permitted outside the once-per-year cadence.

10. Return and deletion

10.1 At the Controller's option, on termination of the Services or earlier upon Controller's documented instruction, the Processor will return Applicant PII to the Controller or delete it.

10.2 Deletion is performed within thirty (30) days of the instruction, save where retention is required by law (in which case the Processor identifies the data, the retention basis, and the period). The Processor confirms deletion in writing.

10.3 On-chain data exception. On-chain settlement data cannot be deleted from the public ledger; the Processor will not retain pointers to it in the Processor's controllable databases beyond the retention period documented in the Privacy Policy.

11. Liability

11.1 The aggregate liability of either party under this DPA is subject to the limitations in the Customer TOS, save where caps are not enforceable under GDPR or applicable consumer-protection law.

11.2 Nothing in this DPA limits a data subject's rights under GDPR Article 82.

12. Term and termination

12.1 This DPA enters into force on the same date as the Customer TOS.

12.2 This DPA terminates on the later of (a) termination of the Customer TOS or (b) completion of the return / deletion obligations in §10.

13. Governing law

13.1 This DPA is governed by Estonia law, subject to the data subject's mandatory rights under GDPR.

14. References

Annex A — Sub-processor list reference

The current Sub-processor list is at docs/legal/SUBPROCESSORS.md, maintained by the GoFundNode L4 (GDPR/sovereignty) workstream. Updates are notified per §4.2.

Annex B — Standard Contractual Clauses

For transfers outside the EEA, the parties incorporate the Standard Contractual Clauses (Module 2: Controller to Processor) from EC implementing decision 2021/914, with the following module-specific selections:

END — TEMPLATE — REQUIRES RETAINED COUNSEL REVIEW BEFORE PRODUCTION USE. NOT LEGAL ADVICE.