Data Processing Agreement

The organisation that manages a project in Haul is the Controller: it decides which participant data is entered and why. Haul is the Processor: it processes that data only to provide the service, on the Controller's documented instructions (which include using the tool as designed).

Processing consists of storing and computing grant estimates and generating budget documents for European youth mobility projects. It lasts for as long as the Controller keeps a project in Haul.

• Data subjects: project participants (which may include minors), group leaders, facilitators, accompanying persons, and coordinator account holders.
• Data: names, roles, sending country, origin city and travel distance, green-travel and fewer-opportunities flags, and any documents the Controller chooses to upload; coordinator email and organisation name.
• No special-category data is required by the tool. A “fewer opportunities” flag is a yes/no indicator only.

• Process personal data only on the Controller's documented instructions.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see section 7).
• Assist the Controller in responding to data-subject requests (access, rectification, erasure).
• Notify the Controller without undue delay after becoming aware of a personal-data breach.
• Delete or return all personal data at the end of the service, unless retention is legally required.
• Make available information needed to demonstrate compliance and allow for reasonable audits.

The Controller authorises the following sub-processors:

• Supabase — database, authentication and file storage. Hosted on AWS in the European Union (region eu-central-1, Frankfurt, Germany).
• Vercel — application hosting and delivery. Server functions run in the European Union (region fra1, Frankfurt, Germany).
• Resend — transactional email, solely for sending login codes and service emails to account holders. It receives the account holder's email address only; no participant data is ever sent through it. Resend, Inc. is established in the United States (see section 6).
• Stripe — payment processing. It receives only the billing details entered on Stripe's own checkout page and the organisation identifier; no project or participant data.

Haul remains responsible for its sub-processors and will inform the Controller of intended changes, giving the opportunity to object.

Personal data is stored in the European Union. Where any sub-processor operates outside the EU, transfers are covered by appropriate safeguards (such as Standard Contractual Clauses).

• Per-organisation data isolation enforced at the database level (row-level security on every table).
• Encryption of data in transit (HTTPS/TLS).
• Private file storage — uploaded documents are never publicly accessible.
• Access to production secrets restricted to server-side use; no secrets exposed to browsers.
• An append-only audit log of key actions.
• Data minimisation — the tool asks only for what the funding rules require.
• Weekly encrypted backups of the database, kept for four weeks and stored within the European Union.

At any time, from the Settings page, the Controller can download a complete export of its data and delete all of it without contacting us. Deleting an organisation removes its projects, activities, participants, documents and calculation records from the live database immediately. Copies held in encrypted backups are overwritten within 30 days.

contact@byhaul.com