Data processing summary
Version: draft of 5 October 2026
Draft. This page is awaiting legal review and may change before MakeFounders is generally available. If you are evaluating MakeFounders now, ask us for the current version.
When a programme uses MakeFounders, it is the controller of its participants’ personal data and MakeFounders is its processor. A data processing agreement (DPA) is offered with the terms of service. This page summarises what it covers. The agreement itself is available on request from privacy@makefounders.com.
What is processed
| Subject matter and duration | Providing the MakeFounders service, for the term of the subscription |
|---|---|
| Nature and purpose | Hosting and processing programme, startup and participant records on the customer’s instructions |
| People concerned | The customer’s staff, mentors, reviewers, founders, applicants, investors invited to demo days, and people founders record as interview contacts |
| Kinds of data | Identity and contact details; role and participation records; what people write (check-ins, evidence, notes, messages); optional demographic answers given with consent. No special-category data is requested, and customers are asked not to upload it |
What MakeFounders commits to
- To act only on the customer’s documented instructions.
- To keep the data confidential, and to make sure our staff do.
- To apply the security measures described on the security page.
- To help the customer answer requests from individuals, with the export and erasure tools built into the product.
- To tell the customer about a personal-data breach without undue delay, and within 72 hours of becoming aware of it.
- To delete or return the data when the contract ends.
- To allow audits on reasonable notice.
Sub-processors
The suppliers that process data for us are listed in the privacy notice. We give notice before adding or replacing one, and customers can object.
International transfers
Where data leaves the UK or the European Economic Area, the transfer is made under the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
Singapore
For customers in Singapore, MakeFounders acts as a data intermediary under the PDPA, protects the data it holds with reasonable security arrangements, and stops retaining it when it is no longer needed for the customer’s purposes.