Data Processing Notice
DATA PROCESSING NOTICE
Foundation Israel
This Data Processing Notice (the “DPA”) forms an integral part of, and is incorporated by reference into:
- the Platform Terms of Service (“TOS”),
- the applicable role NDA (Broker or Operator),
- the applicable Program Terms, and
- the Privacy Policy.
By accessing or using the Platform, you acknowledge the data processing practices described herein. This DPA applies to brokers, sourcers, operators, and their authorized representatives on Foundation Israel.
1. Parties and Roles
1.1 Controller. Foundation Israel (the “Foundation,” “we,” “us,” or “Controller”) is the primary data controller of personal data processed in connection with the Platform for admissions, onboarding, portal use, legal vault, Opportunity review, and Project administration.
1.2 Processors. Foundation engages processors (identity verification, sanctions screening, hosting, email, e-signature, and similar vendors) under written contracts. Those processors act only on Foundation’s instructions.
1.3 Data subjects. Data subjects include individual brokers/sourcers/operators and authorized representatives of entity participants (and directors, beneficial owners, licensed agents listed for entity firms, or other persons whose data is collected for KYC or license checks).
2. Categories of Personal Data Processed
2.1 Personal data
- Identification and contact data (name, email, phone, date of birth, address, nationality, government ID).
- Tax and identity numbers required for KYC.
- Account and profile data (role, admissions track, onboarding responses).
- License and professional data (Israeli real-estate agent license number and evidence, fitness declarations, entity agent lists and personal licenses, operator trade permits where applicable).
- Entity data (legal name, registrar/formation details, directors, beneficial owners, authorized representative).
- KYC/AML data (identity documents, sanctions/PEP responses, supporting vault uploads).
- Deal and project data you submit (Opportunity materials, counterparty details you include, milestone Update Content).
- Platform usage and technical data (portal activity, signature events, IP address, device data, access logs).
2.2 Special category data
Foundation does not seek special-category data for standard broker or operator paths. If you voluntarily provide such data, it is processed only as needed to handle your request and secure the Platform.
3. Purposes and Legal Bases
| Purpose | Legal basis (typical) | | --- | --- | | Provide Platform access, onboarding, legal vault, role tools | Performance of contract (TOS, NDA, Program Terms) | | KYC/AML, sanctions, license verification | Legal obligation + performance of contract + legitimate interests (compliance integrity) | | Review Opportunities; administer assigned Projects | Performance of contract | | Process Update Content and project communications | Performance of contract | | Security, fraud prevention, audit logging | Legitimate interests + legal obligation | | Respond to regulators or lawful requests | Legal obligation | | Service notices and compliance refresh | Performance of contract + legitimate interests | | Improve security and reliability (prefer de-identified data) | Legitimate interests |
4. Sub-Processors and Service Providers
4.1 Categories of sub-processors (current list available on written request to [email protected]):
- Cloud hosting and infrastructure.
- Identity verification and KYC vendors.
- Sanctions and PEP screening providers.
- License-verification or public-record lookup tools where used.
- E-signature and document vault providers.
- Email and transactional messaging providers.
- Security monitoring tools (access-controlled).
4.2 Sub-processors are bound by contracts requiring appropriate security and confidentiality. Foundation will provide reasonable notice of material changes to the sub-processor set where required by law.
5. International Data Transfers
Foundation Israel may use infrastructure or vendors in Israel, the EU, UK, US, or other countries, and may share limited data with Foundation Capital or other Foundation affiliates for referral and Project administration. Where transfers require safeguards, Foundation uses appropriate mechanisms (such as Standard Contractual Clauses, adequacy decisions, or other tools required by applicable law).
6. Data Security
Foundation maintains administrative, technical, and organizational measures appropriate to KYC and deal data, including encryption in transit, access controls, logging, and vendor diligence. Incident response includes notification where required by law.
7. Data Retention and Deletion
Personal data is retained for the relationship life, for statutory AML/tax/contract retention, and as needed for the purposes above. NDA confidentiality obligations survive as stated in the NDA. Upon a valid deletion request, Foundation will delete or irreversibly anonymize data where feasible, subject to legal and contractual retention duties.
8. Data Subject Rights
Depending on your jurisdiction, you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent where processing is consent-based, including rights under the Israeli Privacy Protection Law 5741-1981. EEA/UK residents have GDPR rights where applicable. California residents may have CCPA/CPRA rights; Foundation does not sell personal information.
To exercise rights, contact [email protected]. Foundation responds within statutory timeframes. AML, license-verification, and active contract records may be exempt from erasure while retention duties apply.
9. Children
The Platform is not directed to individuals under 18. Foundation does not knowingly process children’s data for broker or operator accounts.
10. Audit Information
Upon reasonable written request, and subject to confidentiality, Foundation will provide information reasonably necessary to demonstrate compliance with this DPA, consistent with applicable law and security constraints.
11. Liability
Each party is responsible for its own breaches of data-protection law. Foundation’s liability related to Platform data processing remains subject to the limitations in the TOS, except where liability cannot be limited by law.
12. Governing Law and Miscellaneous
12.1 This DPA is governed by the laws of the State of Israel, without regard to conflict-of-laws rules that would require another law, except that mandatory data-protection rights in your country of residence continue to apply where they cannot be waived. 12.2 This DPA supplements the Privacy Policy. On pure data-processing obligations, this DPA controls if there is a direct conflict. 12.3 The binding language of this DPA is English. Any Hebrew translation is a convenience presentation only, unless mandatory law requires otherwise for a specific provision. 12.4 Amendments will be published on the Platform or notified as required by law. Electronic acknowledgment is binding.
By using the Platform or submitting an Application, you acknowledge and agree to this document.