Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Missionary Lane Terms of Service (the "Terms") between the church that uses the hosted service ("Church", the controller) and [COMPANY LEGAL NAME] ("Missionary Lane", the processor). It applies when the Church is subject to the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, or a US state law that requires a contract with a processor or service provider, or when the Church asks for it. Words not defined here have the meanings given in the Terms or in the applicable data protection law ("Data Protection Law").

1. Roles and scope #

1. 1.1 The Church is the controller, and Missionary Lane the processor (or service provider), of the personal data in Customer Content and givers' records that Missionary Lane processes to provide the Service ("Church Personal Data"). Annex 1 describes the processing.
2. 1.2 Missionary Lane is a controller of the personal data it processes for its own purposes, such as staff account, billing, security and feedback data, as described in its Privacy Policy. This DPA does not apply to that data.
3. 1.3 The missionary directory (Terms section 6.5) is outside this DPA. When the Church publishes a letter for a kiosk linked through the directory, it discloses that letter to Missionary Lane, which shares it with the other churches linked to the same missionary as an independent controller, as described in the Privacy Policy section 3.11. The Church can stop this at any time by leaving the directory for that kiosk or for all of them.
4. 1.4 Where the Church is itself a processor for another controller, such as a mission board or a denomination, the Church confirms that its instructions are authorized by that controller, and Missionary Lane is a sub-processor.

2. Instructions #

1. 2.1 Missionary Lane processes Church Personal Data only on the Church's documented instructions, unless the law requires otherwise, in which case it will tell the Church first unless the law prohibits that. The Terms, this DPA, and the Church's use and configuration of the Service, including the settings chosen by its owners, admins, editors and Finance members, are the Church's instructions.
2. 2.2 The Church's instructions include sending Church Personal Data to the Third-Party Services the Church chooses and connects (Terms section 11), such as its own AI or voice provider or its giving platform. Those services are the Church's own providers, not Missionary Lane's sub-processors, and the Church is responsible for its agreements with them.
3. 2.3 Missionary Lane will tell the Church if, in its opinion, an instruction infringes Data Protection Law.
4. 2.4 Missionary Lane will not sell or share Church Personal Data, retain, use or disclose it for any purpose other than providing the Service, combine it with personal data from other sources except as the Service requires, or use it to train AI models.

3. Confidentiality #

Missionary Lane ensures that everyone it authorizes to process Church Personal Data is bound by confidentiality, and limits access to people who need it to provide, support or secure the Service.

4. Security #

Missionary Lane implements the technical and organizational measures in Annex 2, which take into account that Church Personal Data may concern people whose safety depends on their identity and location staying private, children, and religious beliefs. It may update the measures as long as the overall level of protection is not reduced.

5. Sub-processors #

1. 5.1 The Church authorizes the sub-processors listed in Annex 3.
2. 5.2 Missionary Lane will give the Church at least [30] days' notice, by email to its owners and by updating Annex 3 at [SUB-PROCESSOR LIST URL], before a new sub-processor processes Church Personal Data. The Church may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if it is not resolved, the Church may terminate the affected part of the Service and receive a refund of prepaid fees for the period after termination.
3. 5.3 Missionary Lane imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for its sub-processors.

6. Data subjects' rights #

The Service lets the Church view, correct, export (in the admin and through the API), hide and delete Church Personal Data. Taking into account the nature of the processing, Missionary Lane will help the Church respond to requests from data subjects, and will forward to the Church, within [5] business days, any request it receives that concerns Church Personal Data, without responding to it itself unless the Church authorizes it.

7. Assistance #

Missionary Lane will give the Church reasonable help, taking into account the nature of the processing and the information available to it, with data protection impact assessments, prior consultations with supervisory authorities, and the Church's security obligations. [COSTS FOR EXTENSIVE ASSISTANCE.]

8. Personal data breaches #

1. 8.1 Missionary Lane will notify the Church without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Church Personal Data. If the breach may expose the identity or location of a restricted missionary, Missionary Lane will also try to reach the Church's owners immediately by phone or any other available means.
2. 8.2 The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact point. Missionary Lane will supplement it as it learns more.
3. 8.3 Missionary Lane will take reasonable steps to contain and remedy the breach. Notifying the Church is not an admission of fault.

9. Deletion and return #

When the Terms end, Missionary Lane will make Church Personal Data available for export and then delete it as set out in Terms section 20, unless the law requires it to keep some of it. Data in backups is deleted as backups expire and is not restored to live systems except to recover the Service.

10. Audits #

Missionary Lane will make available to the Church the information reasonably needed to show compliance with this DPA, including its security documentation and, where available, its providers' certifications and audit reports. Where that is not sufficient, or a supervisory authority requires it, the Church may audit Missionary Lane's compliance no more than once a year, on at least [30] days' notice, during business hours, at the Church's cost, through an independent auditor bound by confidentiality, and in a way that does not compromise other customers' data.

11. International transfers #

1. 11.1 The Church authorizes Missionary Lane and its sub-processors to process Church Personal Data in the United States and the other locations in Annex 3.
2. 11.2 For transfers of personal data from the EEA to Missionary Lane in a country without an adequacy decision, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference. Clause 7 (docking) applies; in Clause 9, option 2 (general authorization) applies with the notice period in section 5.2; the option in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of [EU MEMBER STATE, e.g. Ireland]; Annexes I and II are Annexes 1 and 2 of this DPA, and Annex III is Annex 3.
3. 11.3 For transfers from the UK, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies; for transfers from Switzerland, the Clauses apply with the amendments required by the Swiss FADP.
4. 11.4 If Missionary Lane certifies under the EU-U.S. Data Privacy Framework, it may rely on that certification instead for transfers it covers. [CONFIRM WHETHER MISSIONARY LANE WILL CERTIFY.]

12. US state laws #

Where a US state privacy law applies, Missionary Lane is a "processor" or "service provider", and will: process Church Personal Data only for the business purposes in Annex 1; not sell or share it; not retain, use or disclose it outside the direct business relationship; comply with the law's applicable obligations and provide the same level of protection it requires; tell the Church if it can no longer meet those obligations; and allow the Church to take reasonable steps to stop and remedy unauthorized use.

13. Liability and order of precedence #

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent Data Protection Law allows. If this DPA conflicts with the Terms, this DPA controls for the processing of Church Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Clauses control.

Annex 1: Description of the processing #

Annex 2: Technical and organizational measures #

1. 1. Tenant isolation. Every record carries its church's ID. Database row-level security restricts each request to the churches the user belongs to; child records are forced to their missionary's church by composite keys and triggers; a record's church can never change; server functions verify membership and filter every query by church.
2. 2. Access control. All staff actions require a two-step (password and authenticator) session. Roles separate content (editor), settings and keys (admin) and billing (owner). Giving data requires the separate Finance capability. Givers can read only their own records. Operator access to customer accounts is restricted to platform administrators with two-step sign-in and is audited.
3. 3. Restricted missionaries. Database functions that serve the public gallery, the API and the MCP server replace a Limited missionary's identity with an alias and region, omit their name, exact place, photos, letters, family, dates, contact and support details and briefing, round their coordinates, and use an opaque web address; giving results are masked; AI writes their public text under restricted rules; existing AI text and recordings are withdrawn on restriction.
4. 4. Data minimization by default. Phone numbers, mailing addresses, support amounts and dates, staff notes, family members and birthdays are private until staff switch them on. Public birthdays show month and day only. Photos are re-saved before upload to remove embedded location data.
5. 5. Secrets. Third-party credentials are stored encrypted in Supabase Vault, are write-only from the client and are read only by server functions. API keys are stored only as HMAC-SHA256 hashes with a secret pepper, are scoped and are revocable.
6. 6. Encryption. Data in transit uses TLS. Data at rest is encrypted by the hosting providers. [CONFIRM PROVIDER AT-REST ENCRYPTION STATEMENTS.]
7. 7. Private storage. Every storage bucket is private: missionary photos, letters and recordings, payment documents, feedback screenshots and software downloads. Visitors' browsers load a gallery file only while the public gallery shows it, and staff open their church's files, through links that expire after one hour; downloads use links that expire after one hour. A restricted missionary's files are never served to visitors, except narration recorded from text written under the restricted rules.
8. 8. Network and input safeguards. Church-supplied endpoints must use https and are checked against private network addresses; giving connectors make read-only requests, refuse redirects and redact credentials from errors; webhooks and inbound email require valid signatures; write APIs accept only whitelisted fields.
9. 9. Abuse protection. Rate limits on API keys (per-minute windows), feedback and visit counting; security headers on web pages; the admin cannot be framed.
10. 10. Logging and accountability. Audit logs record operator actions, Finance changes, API key creation and revocation, and writes made with API keys, without storing keys.
11. 11. Resilience. Daily backups and point-in-time recovery on the database plan. [CONFIRM PLAN AND RETENTION.]
12. 12. Testing. Automated tests cover tenant isolation, role gating, API key handling and restricted-missionary masking. [INDEPENDENT REVIEW PLANNED (PLATFORM PLAN PHASE 6).]
13. 13. People. Access for Missionary Lane personnel is limited to those who need it, bound by confidentiality. [SECURITY TRAINING AND ONBOARDING/OFFBOARDING PROCEDURE.]
14. 14. Incident response. A documented process for investigating, containing and notifying breaches as in section 8. [DOCUMENT AND TEST.]

Annex 3: Sub-processors #

Services the Church connects with its own credentials (its own AI and voice providers, giving platforms and map providers) are the Church's providers, not sub-processors (section 2.2).