Data Processing Agreement

This Data Processing Agreement applies between HolyDonation and each organization that receives donations through the platform. It forms part of our Terms of Service and applies from the moment your organization begins using the platform.

It describes how we handle the personal data of your donors, your newsletter subscribers, and your team on your behalf, and what each of us is responsible for.

1. Roles of the Parties

Donations are charged directly to your own connected payment account. You decide what donor information is used for, so you are the controller of that data.

We process that data on your behalf and on your instructions, so we are the processor. Your instructions are given through the settings and features you use in the dashboard, and through any written instruction you send us.

For processing we carry out on our own behalf - operating and securing the platform, diagnosing faults, measuring use of our website, verifying organizations, and billing - we act as controller, and our Privacy Policy applies.

2. Subject Matter, Duration, and Purpose

The processing we carry out for you is as follows:

• Subject matter: Processing of the personal data of your donors, newsletter subscribers, and team members, to the extent needed to provide the platform to you.
• Duration: For as long as your organization uses the platform, and afterwards only for the retention periods stated in our Privacy Policy.
• Purpose: Receiving and recording donations, issuing receipts and agreements, providing your dashboard and reports, and sending the communications you initiate.

3. Categories of Personal Data and Data Subjects

Data Subjects

• Donors, including one-time and recurring donors
• Newsletter subscribers of the organization
• Members of the organization's team who use the dashboard

Categories of Personal Data

• Name and email address
• Donation amount, currency, date, and the purpose selected
• Country, and the language chosen for communication
• Messages written by the donor, where the donor chooses to leave one
• Identity data required for a signed donation agreement, including a national personal identity code or a company registration number and registered address

We do not ask you or your donors for special categories of personal data, and the platform is not designed to store them. Please do not enter health, political, or similar information into free-text fields. Note that the fact of a donation to a religious organization may itself reveal a religious belief; we treat donation records accordingly and use them only to provide the platform to you.

4. Our Obligations as Processor

• We process personal data only on your documented instructions, including as regards transfers outside the European Economic Area, unless the law requires otherwise - in which case we inform you before processing, unless the law forbids it.
• Everyone we allow to access personal data is bound by an obligation of confidentiality.
• We take appropriate technical and organizational security measures, described in section 8.
• We assist you in responding to requests from donors, subscribers, and team members exercising their data protection rights.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data, and assist you in meeting your own notification obligations.
• When you stop using the platform, we delete or return your personal data, except where we are required to keep it by law.
• We make available the information needed to demonstrate compliance with this agreement, and allow for audits by you or an auditor you appoint, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise.

5. Your Obligations as Controller

• You ensure there is a lawful basis for the personal data you collect through the platform.
• You provide your own privacy notice to your donors and subscribers, describing how you use their information.
• You are the sender of any newsletter you send through the platform. You obtain consent where it is required, keep evidence of it, and honour unsubscribe requests.
• You keep the information in your account accurate, and you do not instruct us to process personal data in a way that breaches data protection law.

6. Sub-processors

We use the following sub-processors to provide the platform. By using the platform you give general authorization for their use.

If we add or replace a sub-processor, we update this page before the change takes effect and, where the change materially affects the processing of your data, we notify the account owner by email. If you object on reasonable data protection grounds, you may stop using the platform.

7. International Transfers

Where a sub-processor processes personal data outside the European Economic Area, the transfer is made under Standard Contractual Clauses approved by the European Commission or another mechanism permitted by law.

8. Security Measures

We maintain at least the following measures:

• Encryption of data in transit
• Access to production data restricted to named personnel
• Separation of each organization's data, enforced on every request
• Recorded history of changes made to accounts and organizations
• Regular backups

9. Contact

For any question about this agreement, or to make a request under it, contact us at:

service@holydonation.com