1 · Terms of Service

Version 1.0 · Effective 27 May 2026

1.1 Who we are

"IWHF", "we", "our", and "us" refer to the International Women's Health Fund platform, currently operated by Elle International NPC, a South African nonprofit company. IWHF operates a global intelligence platform for the women's-health capital ecosystem, comprising a public dashboard, a Founder Portal for grant-seekers, a Donor Desk for foundations, sovereign programs, and pharma portfolios, an editorial briefing service, and supporting APIs (together, the "Services"). Formal contracting details, invoicing entity details, and service address are provided in the applicable Order Form, invoice, or written agreement.

1.2 Acceptance and authority to bind

By creating an account, accessing the Services, or subscribing to the editorial briefing, you accept these Terms. If you accept on behalf of an organisation, you confirm you have authority to bind that organisation, and "you" means both you personally and that organisation. If you do not have that authority, or you do not accept these Terms, you must not use the Services.

1.3 Eligibility

You must be at least 18 years old (or the age of legal majority in your jurisdiction, if higher) to create an account. The Services are designed for organisational use and are not directed at children. If we become aware that we hold personal data of a person under 16 collected without an appropriate lawful basis, we will delete it.

1.4 The Services

1. Public Dashboard. A free, read-only directory of funding opportunities, donor profiles, sector analyses, and the Friday Funding Intelligence Briefing.
2. Founder Portal. Subscriber-tier access to the proposal studio, eligibility-match engine, deadline sentinel, alerts, and saved pipeline.
3. Donor Desk. A multi-tenant workspace for capital allocators to publish RFPs, receive applications, conduct reviews, and manage portfolios.
4. Editorial outputs. The Friday briefing, newsroom pieces, quarterly flagship reports, and sponsored-research engagements, each governed by the editorial-independence commitments in Section 8.
5. APIs. Programmatic access on tiers and rate limits set out in the relevant API documentation or Order Form.

1.5 Accounts and tenancy

You may register a free Observer account or a paid tier (Pro, Institutional, Enterprise) on the Founder Portal, or a Donor Desk plan via the order page or a separately negotiated Order Form. Each paying customer is provisioned as an "organisation" (the "Org") within our multi-tenant architecture. Content you submit is scoped to your Org and is not visible to other Orgs except through cross-tenant flows you explicitly opt into (for example, submitting an application to a published RFP).

You are responsible for safeguarding your credentials and for all activity under your account. Notify security@iwhf.org promptly if you suspect unauthorised access.

1.6 Subscriptions, billing, and term

Pricing, billing currency, seat count, and feature inclusion are set out on the order page or in your Order Form. All fees are exclusive of applicable taxes, which we will add at the prevailing rate where required by law. Subscriptions renew automatically at the end of each billing cycle unless you cancel through the Founder Portal billing centre or by emailing billing@iwhf.org at least one billing cycle in advance (or the longer period set out in your Order Form).

Payments in South African Rand are processed by Paystack Payments Limited. Payments in United States Dollars are (or, where the rail is being activated, will be) processed by PayPal, Inc. You authorise us and the applicable processor to charge the agreed fees to your chosen payment method. Failed payments may result in suspension of the Services after reasonable notice.

Refunds are governed by the Refund Policy in Section 3.

1.7 Acceptable use

Your use of the Services is governed by the Acceptable Use Policy in Section 5, which is incorporated by reference. Material breach of the Acceptable Use Policy may result in suspension or termination under Section 1.16.

1.8 AI-generated content

The Founder Portal and Donor Desk include assistive AI workflows for drafts, eligibility matches, reviewer summaries, and signal interpretation. You acknowledge that:

1. AI outputs are draft material requiring your human review before submission, publication, or external use;
2. you retain responsibility for any content you submit, publish, or transmit from the Services, including verifying factual accuracy and source citations;
3. IWHF applies a human-in-the-loop checkpoint to every word published under the IWHF byline (briefings, newsroom, sponsored research). Your private AI outputs (your proposal drafts, RFP rubrics, reviewer comments) are not pre-reviewed by IWHF and remain your sole responsibility.

We do not use your private content to train foundation models. Aggregated, de-identified usage statistics may inform Service improvements.

1.9 Intellectual property

IWHF Materials. The Services, including the funder graph, editorial content, workflow prompts, methodologies, trademarks, and software, are owned by IWHF or its licensors. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Services as permitted by your subscription tier.

Your Content. You retain ownership of content you submit (organisation profile, prior wins, drafts, applications, reviews, portfolio entries). You grant IWHF a worldwide, royalty-free, sub-licensable (only to our sub-processors as listed in Section 7) licence to host, process, transmit, display, and back up your content as necessary to operate the Services for you.

Editorial outputs. IWHF's editorial outputs are © IWHF and are licensed to subscribers for internal organisational use. Republication, redistribution, or external use beyond fair-dealing/fair-use exceptions requires written permission from editor@iwhf.org.

Feedback. If you send us suggestions or feedback, you grant us a perpetual, irrevocable, royalty-free licence to use that feedback for any purpose without obligation to you.

1.10 Donor Desk-specific terms

If you are a Donor Desk customer:

1. You are solely responsible for the lawfulness, accuracy, and fairness of any RFP you publish.
2. You will require reviewers to disclose conflicts of interest before scoring; the platform enforces a hard COI gate where prior award relationships are detected.
3. Award decisions and the resulting grant agreements are between you and the grantee; IWHF is not a party to those agreements.
4. You will not use applicant content for any purpose other than evaluating the relevant application and, where the applicant has separately consented, communicating about the outcome.

1.11 Data protection

Our processing of personal data is described in the Privacy Policy in Section 2. Where we process personal data on your behalf as a processor (notably for Donor Desk applicant data), the Data Processing Addendum in Section 6 applies and is incorporated by reference. Donor Desk Orgs must accept the DPA before any RFP is published.

1.12 Service levels and support

Pro and Institutional subscriptions include best-efforts support during UK business hours via support@iwhf.org. Enterprise and Donor Desk contracts include the SLA terms set out in the relevant Order Form, including uptime, response, and resolution targets. Planned maintenance windows are notified at least 72 hours in advance via the status page and to billing contacts on file.

1.13 Editorial independence

IWHF maintains editorial independence over the Friday briefing, newsroom, quarterly flagship reports, and any sponsored-research outputs. Sponsored research carries the editorial-independence clause as a non-negotiable schedule, the Editor-in-Chief signs every editorial publication, and funder relationships are disclosed in the published output. The full disclosure framework is in Section 8.

1.14 Warranties and disclaimers

We warrant that we will provide the Services with reasonable skill and care and in accordance with the description in this Section 1. Except for that warranty and any warranties that cannot be excluded by applicable law, the Services are provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all other warranties, express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising out of course of dealing or trade usage.

We do not warrant that the Services will be uninterrupted, error-free, or that AI-generated outputs will be free from inaccuracy. The funder graph and editorial outputs are an aid to decision-making, not a substitute for your own professional judgement.

1.15 Limitation of liability

To the maximum extent permitted by applicable law:

1. neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, goodwill, anticipated savings, or data, arising out of or in connection with these Terms, whether in contract, tort (including negligence), statute, or otherwise;
2. each party's total aggregate liability arising out of or in connection with these Terms in any 12-month period will not exceed the greater of (a) the fees paid or payable by you to IWHF in that 12-month period and (b) USD 100 or the equivalent in your billing currency.

Exceptions. Nothing in these Terms limits or excludes either party's liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; any liability that cannot be limited or excluded under applicable law; your obligation to pay fees due; or breach of the Acceptable Use Policy or confidentiality obligations.

If you are a consumer in the European Union, the United Kingdom, or any other jurisdiction whose law grants you non-waivable rights, the limitations above apply only to the extent permitted by that law, and your statutory consumer rights are unaffected.

1.16 Indemnification

You will defend, indemnify, and hold harmless IWHF, its affiliates, and their respective directors, officers, employees, and representatives from and against any third-party claim arising out of (a) your breach of these Terms or the Acceptable Use Policy, (b) your unlawful use of the Services, or (c) your infringement of any third party's intellectual property or privacy rights through content you submit. We will promptly notify you of any such claim, give you reasonable cooperation, and not settle without your consent (not to be unreasonably withheld).

We will defend you from and against any third-party claim that the Services as provided by us and used in accordance with these Terms infringe that third party's intellectual property rights, and will indemnify you for amounts finally awarded by a court of competent jurisdiction or paid in settlement we approve. This obligation does not apply to claims arising from your content, your modifications, your combination of the Services with non-IWHF products, or your continued use of an allegedly infringing version after we have provided a non-infringing alternative.

1.17 Term and termination

These Terms begin when you first accept them and continue until your account is closed. Either party may terminate for material breach if the breach is not cured within 30 days of written notice. We may suspend the Services immediately where required by law, to protect the Services or other users, or for non-payment after notice.

On termination, your right to access the Services ends. You may export your content for 30 days after termination using the in-product export tools; thereafter we may delete your content in accordance with the Privacy Policy. Sections that by their nature should survive termination (including IP, confidentiality, indemnities, limitations of liability, dispute resolution, and accrued payment obligations) will survive.

1.18 Governing law and dispute resolution

These Terms are governed by the laws of the Republic of South Africa, without regard to its conflict-of-laws rules. The parties submit to the non-exclusive jurisdiction of the competent courts of South Africa for any dispute arising out of or in connection with these Terms, subject to any mandatory consumer or data-protection rights that apply in your jurisdiction.

Consumer carve-out. If you are a consumer resident in the European Union, the United Kingdom, Switzerland, or another jurisdiction whose law grants you mandatory court-jurisdiction rights, you may also bring proceedings in the courts of your country of residence, and the mandatory consumer-protection law of that country applies.

South African subscribers. Where required by section 5(2) and section 7 of the South African Consumer Protection Act 68 of 2008 ("CPA"), these Terms must be read with the CPA, and you may also bring proceedings in the South African courts of competent jurisdiction.

United States subscribers. Any dispute that is not finally resolved through informal negotiation within 60 days may, at either party's election, be resolved by binding individual arbitration under the Arbitration Foundation of Southern Africa rules, seated in Johannesburg, South Africa, unless mandatory local law requires another forum. The parties waive any right to participate in a class action or class arbitration to the extent permitted by law. You may opt out of this arbitration provision by sending written notice to legal@iwhf.org within 30 days of first accepting these Terms.

European Online Dispute Resolution. Consumers in the European Union may also access the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr.

1.19 Changes to these Terms

We may update these Terms. Material changes will be notified to the billing or account contact on file by email at least 30 days before they take effect, and will also be posted to this page with a revised version number and effective date. Continued use of the Services after the effective date constitutes acceptance. If you do not accept the changes you may cancel under Section 1.6 before the effective date and receive a pro-rata refund of pre-paid fees for the unused portion of the term.

1.20 Miscellaneous

Entire agreement. These Terms, together with the policies linked from this page and any Order Form, constitute the entire agreement between the parties and supersede all prior agreements on the same subject matter.

Severability. If any provision is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary.

Waiver. A failure to enforce a provision is not a waiver of that provision.

Assignment. You may not assign these Terms without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of substantially all our assets on notice to you.

Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including acts of God, war, civil unrest, sanctions, internet or power outages, or pandemic.

Notices. Legal notices to IWHF must be sent to legal@iwhf.org and to any service address stated in your Order Form, invoice, or written agreement. Notices to you will be sent to the email address on your account.

Sanctions. You represent that you, your organisation, and your beneficial owners are not subject to economic or trade sanctions imposed by the United Nations, the European Union, the United Kingdom, or the United States, and that you will not use the Services in violation of any such sanctions.

2 · Privacy Policy

Version 1.0 · Effective 27 May 2026 · Applies to all visitors and subscribers worldwide

2.1 Who is the controller, and how to reach us

IWHF is the controller (or, in jurisdictions that use the term, the "responsible party" or "business") of the personal data described below, except where we act as processor on behalf of a customer (notably for Donor Desk applicant data submitted into a customer's workspace), in which case the customer is the controller and our processing is governed by the DPA.

2.2 What we process, why, and on what basis

We process personal data only where one of the lawful bases under the EU/UK GDPR (Article 6), POPIA (section 11), the CCPA/CPRA (as a "business purpose"), the LGPD (Article 7), or the equivalent law in your jurisdiction applies. The table below summarises our processing.

We do not sell or "share" personal data within the meaning of the CCPA/CPRA, and we do not use customer content to train foundation models. Aggregated, de-identified usage statistics may be used to improve the Services.

2.3 How we collect personal data

We collect personal data (a) directly from you when you create an account, subscribe, contact us, or use the Services; (b) automatically through cookies, server logs, and product telemetry; and (c) from third-party sources such as publicly available registries, your organisation's IT administrator, and our payment processors (for tokenised payment confirmations only — we do not receive your full card data).

2.4 Recipients and sharing

We share personal data only with: (a) the sub-processors listed in Section 7, each engaged under written contracts containing the safeguards required by GDPR Article 28, POPIA section 21, and equivalent law; (b) professional advisors (lawyers, auditors, accountants) under duties of confidentiality; (c) authorities, where compelled by valid legal process, after challenging overbroad requests where appropriate; and (d) an acquirer or successor entity in connection with a merger, acquisition, or sale of substantially all our assets, subject to confidentiality.

2.5 International transfers

IWHF is a global service. Where we transfer personal data across borders, we rely on:

1. the EU Commission's Standard Contractual Clauses (Decision 2021/914) and the UK Addendum, for transfers from the EEA and UK to third countries without an adequacy decision;
2. the EU-US Data Privacy Framework and the UK Extension, where the recipient is certified;
3. adequacy decisions where they exist (for example, transfers to the UK from the EEA);
4. the contractual safeguards required by POPIA section 72 for transfers from South Africa;
5. equivalent mechanisms recognised by your jurisdiction's data-protection law.

A copy of the safeguards applicable to a specific transfer is available on request to privacy@iwhf.org.

2.6 Your rights

Subject to the conditions and limits set out in your local law, you have the rights listed below. To exercise any right, contact privacy@iwhf.org; we will respond within the period required by your local law (typically one month in the EU/UK, 45 days in California, 15 days in Brazil for confirmation).

If you are in Canada, Australia, Switzerland, Japan, or another jurisdiction with comprehensive privacy law, equivalent rights apply under PIPEDA, the Australian Privacy Act 1988, the Swiss FADP, the APPI, or your local statute respectively, and we will honour them.

2.7 Automated decision-making and AI

We use assistive AI workflows to draft, summarise, match, and analyse. None of these systems makes a decision that produces legal or similarly significant effects about you without meaningful human review. Where the Donor Desk surfaces an eligibility or conflict-of-interest signal, the customer's human reviewer retains the decision authority. You have the right to request human review of, contest, and obtain an explanation of any output you believe has materially affected you, by writing to privacy@iwhf.org.

2.8 Children

The Services are not directed at children. We do not knowingly collect personal data from children under 16 (or the equivalent age under your local law, including under 13 in the United States for COPPA). If you believe we hold such data, contact privacy@iwhf.org and we will delete it.

2.9 Marketing communications

You may unsubscribe from any marketing or editorial email through the link in the message footer or by emailing privacy@iwhf.org. Transactional and service messages (security alerts, billing notices) are sent for the duration of your account and are not optional while you have an active account.

2.10 Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. These include encryption in transit and at rest, scoped tenant isolation, least-privilege access controls, audit logging, sub-processor due diligence, and an incident-response process. Our security programme is summarised in our Trust Center (available on request to security@iwhf.org). No system is perfectly secure; we will notify you and the relevant supervisory authority of personal-data breaches within the timelines required by applicable law (within 72 hours under GDPR, without unreasonable delay under POPIA).

2.11 Retention

We retain personal data only for as long as necessary for the purposes set out in Section 2.2, plus any additional period required by law (for example, 7 years for tax records). Backups follow our standard 30-day rolling retention, after which deleted records are no longer recoverable. We anonymise rather than delete in some cases to preserve aggregate statistics.

2.12 Complaints

If you believe we have processed your personal data unlawfully, please contact privacy@iwhf.org first so we can try to resolve the matter. You also have the right to complain to a supervisory authority:

• United Kingdom: Information Commissioner's Office — ico.org.uk
• European Union: the supervisory authority in your country of residence (a list is at edpb.europa.eu)
• South Africa: Information Regulator — inforegulator.org.za
• California: California Privacy Protection Agency — cppa.ca.gov
• Brazil: Autoridade Nacional de Proteção de Dados — gov.br/anpd
• Canada: Office of the Privacy Commissioner — priv.gc.ca
• Australia: Office of the Australian Information Commissioner — oaic.gov.au

For other jurisdictions, contact your national data-protection authority.

3 · Refund Policy

Version 1.0 · Effective 27 May 2026 · Forms part of the Terms of Service

3.1 Scope

This Refund Policy applies to all paid subscriptions and one-time charges purchased through the public order page, including Founder Portal tiers (Pro monthly, Pro annual, Institutional) and self-serve Donor Desk plans. Enterprise and Donor Desk contracts executed under a separately negotiated Order Form are governed by the refund terms of that Order Form.

3.2 The 60-minute refund window

You are entitled to a full refund of any subscription or one-time payment, provided you submit a refund request within 60 minutes of the payment-authorisation timestamp recorded by the relevant processor (Paystack for ZAR, PayPal for USD).

The 60-minute window:

1. begins at the payment-authorisation timestamp returned by the processor — not at the time the order was started or the confirmation email was received;
2. applies to the initial payment and to each subsequent renewal payment, considered independently;
3. is calculated to the minute and is non-extendable.

Refund requests received after the 60-minute window will be declined except where required by applicable law (see Section 3.5) or granted at our discretion as a goodwill gesture.

3.3 How to request a refund

Email billing@iwhf.org from the address on the account, with:

1. Subject line: Refund request — [Organisation name]
2. Payment reference (Paystack reference or PayPal transaction ID)
3. Date and time of payment
4. Reason for the request (optional, but appreciated for product feedback)

The timestamp used to determine whether the request is within the window is the time the email is received at our inbound mail server, as recorded in the message headers. If our inbound mail server is unavailable, the next-available delivery time will be used, and you will not be prejudiced by any IWHF-side delivery delay.

3.4 How refunds are processed

Approved refunds are returned to the original payment method. We do not issue refunds to a different card, account, or wallet. Settlement typically takes 5–10 business days for Paystack (ZAR) and 3–5 business days for PayPal (USD). Banking timelines outside our control may add to those windows.

On refund approval, (a) the associated subscription is cancelled immediately, (b) provisioned access is revoked at the next session boundary, and (c) usage data generated during the refunded period is retained only as required for tax, accounting, and abuse-prevention purposes. We do not pro-rate or partially refund a subscription term after the 60-minute window has elapsed.

3.5 Your statutory rights are unaffected

Nothing in this Policy limits any non-waivable right you have under applicable consumer-protection law, including:

• United Kingdom — Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013: consumers generally have 14 days to cancel a distance contract. This right may be waived where the digital service is supplied immediately at your express request and you acknowledge that you lose the right to cancel — we ask for that express consent at checkout.
• European Union — Consumer Rights Directive (2011/83/EU) as implemented in your member state: as above.
• South Africa — Consumer Protection Act 68 of 2008: the section 44 cooling-off right for direct marketing and the section 56 implied warranty, where applicable.
• California — Civil Code §1789 et seq. and the Automatic Renewal Law: autorenewal disclosures, easy-cancellation, and free-trial conversion notices.
• Australia — Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010): non-excludable consumer guarantees.
• Brazil — Código de Defesa do Consumidor (Law 8.078/1990), Article 49: 7-day right of withdrawal for purchases made outside an establishment, where applicable.

If a statutory right grants you a longer or broader refund entitlement than the 60-minute window, the statutory right prevails.

3.6 Chargebacks and reversals

Before initiating a chargeback or reversal with your bank or card issuer, please contact billing@iwhf.org. Chargebacks raised without prior contact may result in suspension of the associated account pending resolution and recovery of any chargeback fee levied by the processor.

3.7 Fraud, abuse, and bad-faith requests

We process refund requests in good faith. We may decline a request, suspend an account, or refer a matter to law enforcement where we identify (a) repeated subscribe-and-refund activity against the 60-minute window, (b) credential sharing or breach of the Acceptable Use Policy, or (c) chargeback fraud or coordinated abuse across multiple accounts.

4 · Cookie Policy

Version 1.0 · Effective 27 May 2026

4.1 What cookies and similar technologies we use

"Cookies" are small text files stored on your device when you visit a website. We also use local storage, session storage, and pixel tags. We treat all of these as cookies for the purposes of this Policy and our consent banner.

4.2 Your choices

The cookie banner on first visit lets you accept all, reject all non-essential, or choose by category. You can change your choice at any time from the "Cookie preferences" link in the site footer. Your browser also provides cookie controls; note that disabling strictly necessary cookies will prevent the Services from working correctly.

4.3 Do Not Track and Global Privacy Control

We honour the Global Privacy Control (GPC) signal sent by your browser as a valid opt-out from sale/share under the CCPA/CPRA and from non-essential cookies under the EU/UK ePrivacy regime. We do not respond separately to the legacy Do Not Track header.

5 · Acceptable Use Policy

Version 1.0 · Effective 27 May 2026 · Incorporated into the Terms of Service

5.1 You will not

1. attempt to access another tenant's data, accounts, or workspace;
2. use the Services to harass, defame, discriminate against, or unlawfully target any person;
3. submit content that infringes third-party intellectual property, privacy, or publicity rights or that violates applicable law;
4. reverse-engineer, decompile, or attempt to derive the source code of the Services, except to the extent that this restriction is prohibited by applicable law;
5. scrape, crawl, or extract the funder graph or editorial outputs at a scale or with a method that we have not authorised in writing;
6. use the Services or any data obtained from them to train competing models or build a competing intelligence product;
7. misrepresent your organisational identity, role, or beneficial ownership to gain Donor Desk reviewer access or to manipulate the application pool;
8. bypass eligibility pre-flight gates by misstating Org Profile attributes;
9. attempt to remove, alter, or weaken the editorial-independence clause in any sponsored-research SOW;
10. introduce malware, perform denial-of-service activity, probe for vulnerabilities (except under our published responsible-disclosure programme), or otherwise interfere with the integrity or performance of the Services;
11. circumvent rate limits, tier restrictions, or usage caps;
12. resell, sublicense, or provide the Services to a third party except as expressly permitted by your subscription or Order Form.

5.2 Responsible disclosure

Security researchers who identify a vulnerability are invited to report it to security@iwhf.org. We commit not to pursue civil or criminal action against good-faith research conducted in accordance with our published responsible-disclosure programme.

5.3 Consequences

Material breach of this Policy may result in suspension or termination under Section 1.17, removal of the offending content, referral to law enforcement where required, and pursuit of any other remedies available to us.

6 · Data Processing Addendum (Summary)

Version 1.0 · Effective 27 May 2026 · Full text available to customers on request to privacy@iwhf.org

Where IWHF processes personal data on behalf of a customer (the "Customer Personal Data"), the following Data Processing Addendum ("DPA") applies and forms part of the Terms of Service. This is a summary; the full contractual text — including the EU SCCs (Decision 2021/914), the UK International Data Transfer Addendum, and the POPIA Operator clauses — is incorporated by reference and is available to customers and prospective customers on request.

6.1 Roles

The customer is the controller (or, under POPIA, the responsible party); IWHF is the processor (or operator). For Donor Desk applicant data submitted to a customer workspace, the customer is the controller as between the customer and IWHF, even though the applicant has a separate relationship with IWHF for their own IWHF account.

6.2 Scope, duration, nature, and purpose

IWHF processes Customer Personal Data to provide the Services to the customer, for the duration of the customer's subscription and any post-termination period required to return or delete the data. Categories and types are set out in the DPA's processing schedule and reflect the Services in use (Founder Portal, Donor Desk, APIs, briefings).

6.3 Sub-processors

The current sub-processor list is in Section 7. We provide at least 30 days' notice of any new or replacement sub-processor by email to the billing contact on file and via the changelog at subprocessor-changes@iwhf.org. Customers may object on reasonable grounds, in which case the parties will work in good faith to find an alternative; if none is possible, the customer may terminate the affected Service for the period after the sub-processor change takes effect and receive a pro-rata refund.

6.4 International transfers

For transfers from the EEA, the UK, or Switzerland to a country without an adequacy decision, IWHF relies on the EU SCCs (with the UK Addendum and Swiss adaptations as applicable) and, where the recipient is certified, the EU-US Data Privacy Framework. For transfers from South Africa, IWHF relies on the safeguards required by POPIA section 72.

6.5 Security

IWHF implements the technical and organisational measures described in the DPA's security annex, which align with the controls audited under our compliance programme (see the Trust Center). These include encryption in transit and at rest, scoped tenant isolation, role-based access controls, audit logging, vulnerability management, and incident response. Personal-data breaches are notified without undue delay (and in any event within 48 hours) to the affected customer.

6.6 Data-subject requests

IWHF will assist the customer in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection) where the customer cannot fulfil the request through the Services' self-service controls.

6.7 Return and deletion

On termination, the customer may export Customer Personal Data for 30 days using the in-product export tools. Thereafter, IWHF will delete or anonymise the data in accordance with the Privacy Policy and applicable law, except to the extent retention is required by law.

6.8 Audit

IWHF will make available to the customer the information necessary to demonstrate compliance with this DPA, including the most recent SOC 2 / ISO 27001 / equivalent reports under NDA. On-site audits may be arranged on reasonable prior notice, no more than once per 12-month period (without prejudice to a regulator's right of audit), and subject to the customer bearing reasonable costs.

7 · Sub-processors

Current list of sub-processors authorised under the DPA. Updated 27 May 2026. Subscribe to subprocessor-changes@iwhf.org for 30-day notice on additions or replacements.

8 · Editorial independence & disclosures

IWHF is funded by subscription revenue, sponsored-research engagements, and (when applicable) institutional investment. Sponsored-research outputs disclose the funder relationship in the editorial output and carry the editorial-independence clause as a non-negotiable schedule. The Editor-in-Chief signs every editorial publication. The current sponsored-research engagement register is available on request to subscribers at editor@iwhf.org.

Editorial decisions — including topic selection, source verification, and final-copy approval — are made by editorial staff free from commercial influence. Where a piece touches on a sponsor, a paying subscriber, or a sub-processor, the relationship is disclosed prominently in the published output.

9 · Legal contact

For the matter listed, please use the address shown:

• Legal notices, contracts, service of process: legal@iwhf.org
• Privacy and data-subject requests (DSARs): privacy@iwhf.org
• Security disclosures and incidents: security@iwhf.org
• Press, editorial, and corrections: editor@iwhf.org
• Partnerships and sponsored research: partnerships@iwhf.org
• Billing and refund requests: billing@iwhf.org
• Sub-processor change notifications: subprocessor-changes@iwhf.org