Data Processing Agreement

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller ("Church"): The church, ministry, or organisation that subscribes to and uses ChurchHub to manage its data.
• Data Processor ("ChurchHub"): ChurchHub, the company that operates the platform and processes personal data on behalf of the Controller.

This Data Processing Agreement forms part of the ChurchHub Terms of Service and applies automatically to all churches using the platform. By creating an account or continuing to use ChurchHub, the Church agrees to the terms of this DPA without the need for a separate signature.

2. Roles Under GDPR

Under the UK GDPR and EU GDPR:

• The Church is the Data Controller. The church decides what personal data to collect, why it is collected, and how it is used. This includes member records, attendance, visitor details, pastoral notes, and event participation.
• ChurchHub is the Data Processor. ChurchHub processes personal data only on the documented instructions of the Church, solely to provide the platform service.

ChurchHub will not process church data for any commercial purpose, profiling, advertising, or any purpose beyond what is necessary to deliver the service.

3. Categories of Personal Data Processed

ChurchHub may process the following categories of personal data on behalf of the Church:

• Full names
• Email addresses
• Phone numbers
• Home addresses
• Attendance and participation records
• Visitor and follow-up information
• Event registration and involvement history
• Department and team membership
• Notes added by church administrators

The Church is responsible for ensuring it has a lawful basis to collect and process each category of data it enters into ChurchHub.

4. Purpose and Instructions

ChurchHub processes personal data solely to:

• Store, display, and manage the church's records within the platform
• Enable follow-up workflows, attendance tracking, and communication features
• Provide technical support, platform maintenance, and security monitoring
• Send transactional communications (e.g. password resets, team invitations) on behalf of the Church

ChurchHub will process data only in accordance with the Church's instructions unless required to do otherwise by applicable law.

5. Security Measures

ChurchHub implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction, including:

Technical Measures

• All data transmitted between users and ChurchHub is encrypted using HTTPS/TLS
• Passwords are hashed using industry-standard algorithms (bcrypt) and never stored in plain text
• Application data is hosted on secure cloud infrastructure provided by Amazon Web Services (AWS)
• Regular automated backups are performed to prevent data loss
• Database access is restricted to authorised services only and is not publicly accessible

Organisational Measures

• Role-based access controls ensure church staff only see data relevant to their role
• Access to production systems is limited to authorised ChurchHub personnel
• Security practices are reviewed regularly as the platform develops

6. Data Storage and Location

ChurchHub stores application data on secure cloud infrastructure hosted by Amazon Web Services (AWS). ChurchHub uses AWS infrastructure located within the United Kingdom or European Economic Area where available. AWS is certified under ISO 27001 and SOC 2 and participates in applicable data transfer frameworks.

Transactional emails (such as password resets and team invitations) are delivered using Zoho Mail. ChurchHub ensures that sub-processors provide adequate data protection guarantees consistent with GDPR requirements.

International Transfers

Where personal data is transferred outside the UK or European Economic Area, ChurchHub ensures that an appropriate safeguard is in place in accordance with UK GDPR Article 46, such as Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority, or another lawful transfer mechanism. By accepting this DPA, the Church authorises ChurchHub to make such transfers subject to these safeguards.

7. Sub-Processors

ChurchHub uses a limited number of trusted third-party sub-processors to deliver the service:

• Amazon Web Services (AWS): Infrastructure hosting and data storage
• Zoho Corporation: Transactional email delivery
• Cloudflare: Content delivery network, DDoS protection, and SSL

ChurchHub will not engage new sub-processors that handle church personal data without first assessing their data protection practices. ChurchHub will notify the Church of any intended changes to its sub-processors by updating this DPA or by email notification. The Church may object to any new sub-processor within 14 days of notification by contacting us at hello@churchhubapp.com. Where the Church objects and no resolution can be reached, the Church may terminate their account without penalty. Each sub-processor is bound by data protection obligations equivalent to those in this DPA.

8. Data Retention and Return

ChurchHub retains church data for as long as the Church's account remains active. Upon account cancellation or termination, the Church may choose to:

• Export their data: the Church can download their data in a usable format before or at the point of cancellation
• Request deletion: church data will be permanently deleted from active systems within 30 days of account termination

Residual data held in automated backups will be purged within 90 days of account termination. After this period, no personal data processed under this DPA will be retained by ChurchHub unless required by law.

The Church is responsible for exporting any data they need before cancelling their account. ChurchHub will confirm deletion in writing upon request.

9. Data Subject Rights

Under GDPR, individuals (data subjects) have rights over their personal data. As a Data Controller, the Church is responsible for responding to data subject requests. ChurchHub will assist the Church in fulfilling these obligations by:

• Access: ChurchHub provides tools for the Church to view all records held for any individual
• Rectification: The Church can edit or correct any member or visitor record within the platform
• Erasure: The Church can permanently delete any individual's record from the platform at any time
• Portability: The Church can export their data in a usable format

If a data subject contacts ChurchHub directly with a rights request, ChurchHub will forward the request to the relevant Church without undue delay.

10. Data Breach Notification

In the event of a personal data breach that affects church data, ChurchHub will:

• Notify the affected Church without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• Provide information about the nature of the breach, the categories and approximate number of individuals affected, and the measures taken or proposed to address the breach

The Church, as Data Controller, is responsible for notifying the relevant supervisory authority (such as the ICO in the UK) where required by law.

11. Audit Rights

In accordance with GDPR Article 28(3)(h), ChurchHub will make available to the Church all information reasonably necessary to demonstrate compliance with this DPA and with applicable data protection legislation.

The Church (or an appointed auditor) may request an audit of ChurchHub's data processing activities relevant to church data. Audits must be:

• Requested in writing with reasonable notice (at least 30 days where practicable)
• Conducted at the Church's expense, during normal business hours, and without disrupting ChurchHub's operations
• Limited in scope to processing activities directly related to the Church's data

ChurchHub may satisfy audit requests by providing relevant certifications, third-party audit reports, or written responses to reasonable questions in lieu of an on-site audit, where appropriate.

12. Assistance with Compliance

ChurchHub will provide reasonable assistance to the Church to help it meet its GDPR obligations, including:

• Data Protection Impact Assessments (DPIAs): ChurchHub will provide relevant information about its processing activities to assist the Church in conducting a DPIA where required under GDPR Article 35
• Data subject requests: ChurchHub will assist the Church in responding to requests from individuals exercising their rights under GDPR (see Section 9)
• Security incidents: ChurchHub will notify the Church promptly of any security incidents or suspected breaches affecting church data (see Section 10)

13. Confidentiality

ChurchHub personnel who have access to church data are bound by confidentiality obligations. Personal data processed on behalf of the Church will not be disclosed to any third party except as required to deliver the service, as listed in Section 7, or as required by law.

14. Termination

This DPA remains in force for as long as ChurchHub processes personal data on behalf of the Church. It terminates automatically upon account closure, subject to the data deletion provisions in Section 8.

15. Governing Law

This DPA is governed by applicable data protection legislation, including the UK GDPR (retained under the UK Data Protection Act 2018) and, where applicable, the EU General Data Protection Regulation (2016/679).

16. Contact

For any questions regarding this Data Processing Agreement, data subject requests, or data protection matters, please contact us:

• Company: ChurchHub
• Email: hello@churchhubapp.com
• Website: churchhubapp.com/contact
• Location: United Kingdom