Data Processing Agreement

1. Parties & Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between PrayerConnect ("Processor") and the church, organization, or account holder ("Controller") who has created a PrayerConnect workspace. It applies whenever PrayerConnect processes Personal Data on behalf of the Controller in the course of providing the service.

This DPA is designed to satisfy the obligations of a data processor under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Australian Privacy Act 1988 (Cth) where those laws apply to the Controller.

2. Roles & Responsibilities

• The Controller determines the purposes and means of processing, obtains any consents required from members and prayer requesters, and is responsible for the lawfulness of the data it enters into the service.
• The Processor processes Personal Data only on documented instructions from the Controller, including as described in the Terms of Service, the Privacy Policy, and configuration options made available in the product.
• Where the Controller is a joint controller with another party (for example a parent denomination or multi-site network), the Controller confirms it has authority to instruct PrayerConnect on behalf of those joint controllers.

3. Nature of Processing

PrayerConnect processes the following categories of Personal Data on behalf of the Controller:

• Identifiers (name, email address, phone number, church membership status)
• Account & authentication data (hashed credentials, session records, IP addresses)
• Prayer requests and updates submitted by members, guests, or church staff
• Content moderation and audit records
• Special category data: prayer content can include information about health, mental health, family relationships, faith and beliefs, addiction, immigration or other sensitive matters. The Controller acknowledges responsibility for the lawful basis to collect such data.
• Billing metadata (Stripe handles payment card data directly; PrayerConnect does not)

Processing lasts for the term of the Controller's subscription plus the retention windows described in the Privacy Policy. Data subjects include church members, guests submitting prayer requests, church staff, and administrators.

4. Sub-processors

The Controller provides general written authorization for PrayerConnect to engage the sub-processors listed on the Subprocessors page. PrayerConnect will notify Controllers of intended changes to the list at least 30 days in advance via email or an in-product notice, giving the Controller the opportunity to object on reasonable data-protection grounds.

Each sub-processor is bound by a written agreement containing data-protection obligations substantially the same as those in this DPA.

5. Security Measures

PrayerConnect maintains technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (TLS 1.2+) and at rest for the primary database
• Row-level security enforcing tenant isolation between churches
• Role-based access control with mandatory two-factor authentication available for admins
• Audit logging of privileged and moderation actions
• Rate limiting, CAPTCHA on public forms, and abuse monitoring
• Least-privilege access for engineers and documented access reviews
• Regular backups with defined recovery targets

6. Personnel & Confidentiality

PrayerConnect personnel with access to Personal Data are subject to written confidentiality obligations that survive the end of their engagement. Access to production data is granted only on a need-to-know basis.

7. Assistance with Data Subject Requests

PrayerConnect provides self-service tools that allow Controllers to search, export, correct and delete member and prayer data. Where a data subject contacts PrayerConnect directly, we will refer them to the relevant Controller and, where technically feasible, assist the Controller in responding within the timelines required by applicable law.

8. Personal Data Breach Notification

PrayerConnect will notify the Controller without undue delay, and in any event within 48 hours of becoming aware of a Personal Data breach affecting the Controller's data. Notice will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and mitigation steps taken.

9. International Transfers

Personal Data may be transferred to and processed in countries outside the Controller's jurisdiction, including the United States and the European Union, in which case PrayerConnect relies on Standard Contractual Clauses (SCCs) or an equivalent transfer mechanism approved under GDPR / UK GDPR. The SCCs are incorporated by reference where required.

10. Deletion & Return of Data

On termination or expiry of the subscription, PrayerConnect will make Personal Data available for export by the Controller for a period of 30 days. After that period, PrayerConnect will delete or anonymise Personal Data within 90 days, subject to legal retention obligations (e.g. billing records).

11. Audits

PrayerConnect will make available to the Controller, on reasonable request and no more than once per year, information necessary to demonstrate compliance with this DPA, including summaries of security controls and sub-processor obligations. On-site audits are available by prior written agreement and at the Controller's expense.

12. How to Execute this DPA

This DPA is automatically incorporated into the Terms of Service. Churches requiring a counter-signed copy for their records can request one through our contact form (topic: Legal / compliance) with their church name and workspace subdomain, and we will return an executed PDF.

13. Contact

Data-protection queries: contact form (Privacy / data request)
Security disclosures and DPA requests: contact form (Legal / compliance)
The contact form is our designated point of contact; we do not operate public mailboxes. Personal-data breaches are notified to the Controller without undue delay and in any case within 72 hours of confirming the breach.