Data Processing Addendum

This addendum is between Dviidea Technologies ("Dviidea", "we"), based in Lagos, Nigeria, and the church or ministry that uses Church Manager ("your church", "you"). It forms part of our Terms of Service.

Under the Nigeria Data Protection Act 2023 (NDPA) and any other data protection law that applies to your church, your church is the data controller for the personal data it keeps in Church Manager, and Dviidea is its data processor.

It applies from the moment a church admin agrees to it, either when registering the church or when Church Manager asks an admin to agree.

Whose data: your members, visitors and first timers, children and their parents or guardians, workers, leaders, and the people your church gives an account.

What data: names and contact details, date of birth, gender, address, photos, membership and group details, attendance, follow-up and care notes, answers to your join form, children's check-in details, and anything else your church chooses to record.

Sensitive data: being on a church's records shows a person's religious belief, and children's notes can include allergies or other health details. The NDPA treats both as sensitive personal data, so we treat all the data your church keeps in Church Manager as sensitive.

Why and for how long: only to provide Church Manager to your church, for as long as your church's account is open, and then as set out in section 10.

• We process your church's data only on your documented instructions. Your instructions are the way your admins set up and use Church Manager, and any written request from a church admin to info@dviidea.com.
• We never use your church's data for our own purposes, never sell it, and never share it with another church.
• If we believe an instruction breaks the NDPA or another law, we will tell you before acting on it.
• If a law requires us to process or disclose data for another reason, we will tell you first unless that law forbids it.

Everyone at Dviidea who can reach your church's data is bound to keep it confidential, and looks at it only when needed to run, support or fix Church Manager for you.

We take technical and organisational measures suited to sensitive data, including:

• Connections to Church Manager are encrypted (HTTPS)
• Passwords are stored only as secure hashes
• Each church's data is kept apart, and no church can reach another church's data
• Your admins decide who can sign in and what each person can see
• Regular backups by our database provider

We review these measures as Church Manager grows.

You allow us to use the providers below to run Church Manager. Each receives only the data it needs for the job shown, under its own published terms.

Before we add or replace a sub-processor, we will update this list and email church admins at least 14 days ahead. If your church objects, tell us at info@dviidea.com; if we cannot meet the objection, your church may close its account, and section 10 applies.

Your church's data is stored and processed outside Nigeria by the providers in section 6. For providers in the European Union, we rely on the protection of the EU's General Data Protection Regulation, which gives protection comparable to the NDPA. For the others, we rely on each provider's own data protection commitments in its terms. You can ask us at any time for the basis we rely on for a provider.

If we become aware of a breach that affects your church's data, we will tell your church admins without undue delay, and no later than 48 hours after we become aware of it, so your church can meet its own duty to report to the Nigeria Data Protection Commission within 72 hours where the law requires. We will say what happened, what data is affected, what we are doing about it, and how to reach us, and we will help your church with its report and with telling the people affected.

People can ask your church to see, correct, move or delete their details, to withdraw their consent, or to object. Church Manager lets your admins edit, export and delete records. Where that is not enough, we will help your church answer a request. If a person contacts us directly about your church's data, we will pass the request to your church and not answer it ourselves unless you ask us to.

We will also give your church the information it reasonably needs for a data protection impact assessment or a question from the Commission.

When your church closes its account, you can first ask us for a copy of your church's data. We then permanently delete it within 30 days. Copies held in our database provider's backups are removed as those backups expire. We keep nothing longer unless a law requires it, and then only for as long as that law requires.

On reasonable request, we will give your church the information it needs to show that this addendum is being followed, and answer its questions about how we process its data.

• Tell people how your church uses their details, and have a lawful basis for each use. For sensitive data, such as church membership and children's health notes, this is usually the person's consent, or a parent's or guardian's consent for a child under 18.
• Only record what your church needs, keep it accurate, and remove it when it is no longer needed.
• Give Church Manager accounts only to people who need them, and remove access when someone leaves.
• Tell us straight away if you think someone has reached your church's data without permission.

For any question about this addendum, reach us through any of the following: