Data Processing Agreement

The Customer is the controller of personal data it uploads to the Services ("Customer Data"). Faith-Links acts as a processor, processing Customer Data only on the Customer's documented instructions through the configuration and use of the Services.

This DPA applies to all processing of Customer Data by Faith-Links and its subprocessors in the provision of the Services.

The Customer instructs Faith-Links to process Customer Data for the purposes of providing, maintaining, and improving the Services and to perform the obligations described in the Terms of Service. The Customer warrants that it has a lawful basis to collect and process the personal data it uploads and has obtained any necessary consents from data subjects.

Faith-Links will:

• Process Customer Data only on the Customer's documented instructions, including with regard to transfers of data, unless required by law;
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit, access controls, and regular security assessments;
• Ensure that personnel authorized to process Customer Data are bound by confidentiality obligations;
• Take reasonable steps to ensure the reliability of any personnel with access to Customer Data;
• Assist the Customer, insofar as possible, in responding to data subject requests relating to Customer Data;
• Notify the Customer without undue delay (and in any case within 72 hours) after becoming aware of a personal data breach affecting Customer Data, and cooperate in addressing the breach;
• Assist the Customer in meeting its obligations regarding security of processing, breach notification, and data protection impact assessments where applicable;
• At the Customer's direction, delete or return Customer Data at the end of the Services, subject to retention required by law.

The Customer provides general authorization for Faith-Links to engage subprocessors to process Customer Data. Faith-Links maintains a list of current subprocessors and will notify the Customer of intended changes, giving the Customer the opportunity to object. Faith-Links remains liable for the acts and omissions of its subprocessors to the same extent it would be liable for its own acts under the Terms of Service.

Faith-Links imposes data protection obligations on subprocessors that are no less protective than those in this DPA.

Customer Data may include personal data about members, attendees, donors, volunteers, and children (for check-in purposes), such as names, contact details, family relationships, attendance records, donation history, communications, and notes entered by the organization.

The Customer is responsible for ensuring that any special categories of personal data (e.g., health, religious beliefs) are processed only where permitted by law and with appropriate safeguards.

Where Customer Data is transferred to a country outside the Customer's jurisdiction, Faith-Links will ensure appropriate safeguards are in place, such as standard contractual clauses or other transfer mechanisms recognized by applicable law.

Faith-Links maintains a security program that includes, at minimum:

• Encryption of data in transit using industry-standard protocols;
• Role-based access controls and least-privilege access;
• Audit logging of access to and actions on Customer Data;
• Regular security reviews and vulnerability assessments;
• Incident response and breach notification procedures;
• Employee training on data protection and security.

The Customer may, at its own cost, request information to verify Faith-Links' compliance with this DPA. On-site audits will be conducted only by agreement between the parties and not more than once per calendar year, subject to confidentiality obligations.

Faith-Links will assist the Customer in responding to data subject requests and regulatory inquiries to the extent possible, taking into account the nature of the processing and the information available to Faith-Links. Faith-Links will not respond directly to data subject requests regarding Customer Data without the Customer's authorization, except where required by law.

Upon termination of the Services, the Customer may export its Customer Data through available export features. Faith-Links will delete Customer Data after a reasonable period following termination, in accordance with our retention schedule, unless retention is required by law.

For questions about this DPA, contact dpo@faith-links.com.