Data processing addendum.

This Addendum forms part of the agreement between Emito Consulting Service LLC (“Holy”, “Processor”) and the customer church or organisation (“Customer”, “Controller”) for use of the Holy platform. Where the Customer is subject to the EU or UK GDPR, the Customer is the Controller of personal data it enters into the platform and Holy is the Processor. Where the California Consumer Privacy Act applies, Holy acts as a Service Provider and does not sell or share personal information.

If this Addendum conflicts with the Terms of Service on the subject of personal-data processing, this Addendum governs.

• ·Nature and purpose: providing church-management software — member and household records, pastoral care notes, groups, events and check-in, giving and donation records, communications, websites and member portals, and the reporting built on them.
• ·Duration: for the term of the agreement, plus the retention windows in “Return and deletion” below.
• ·Categories of data subject: church members and attendees and their households (including children where the Customer records them), donors, volunteers, staff and administrative users, and visitors to the Customer’s public site or portal.
• ·Types of personal data: name and contact details, household and relationship data, dates of birth, attendance and engagement records, group and serving membership, giving and pledge records, pastoral notes the Customer chooses to record, uploaded photographs and documents, authentication data for the Customer’s users, and technical data such as IP address and device information.
• ·Special-category data: the platform is capable of storing information revealing religious belief, and pastoral notes may contain health or other sensitive details. The Customer decides what to record and is responsible for having a lawful basis to do so.

• ·We process personal data only on the Customer’s documented instructions, which include the instructions given by using the platform’s features. We tell the Customer if an instruction appears to infringe applicable data-protection law.
• ·Personnel authorised to process personal data are bound by confidentiality obligations, and access is limited to what their role requires.
• ·We implement the technical and organisational measures described on our Security page and summarised below (GDPR Article 32).
• ·We do not sell personal information, share it for cross-context behavioural advertising, or use it for our own purposes — including training machine-learning models on Customer data.

Current measures are described in full on the Security & trust page. In summary: encryption in transit (TLS 1.2+) and at rest (AES-256); application-layer encryption of pastoral notes; per-church tenant isolation enforced on every request; role-based access control with multi-factor authentication and optional enforced SSO; an append-only audit log; secrets held in a managed secret store with role-based access; daily backups with an encrypted, versioned off-platform copy of uploaded files; and continuous error and latency monitoring with alerting.

We may update these measures over time provided the level of protection is not reduced.

The Customer gives general authorisation for Holy to engage the subprocessors listed at holyplatform.com/legal/subprocessors. Each subprocessor is bound by written terms imposing data-protection obligations no less protective than this Addendum, and we remain fully liable for their performance.

We will give at least 30 days’ notice before a new subprocessor begins processing Customer personal data. The Customer may object on reasonable data-protection grounds within that period; if we cannot offer a reasonable alternative, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

The platform includes optional AI features. Where the Customer uses them, the request is processed by the AI subprocessor named in the subprocessor list. The following terms apply to all of them.

• ·Off by default at the Customer’s choice: the Customer can disable every AI feature for its organisation from a single switch in Settings, with no loss of any other function. While it is off, no Customer personal data is sent to any AI provider.
• ·No training: Customer personal data is not used to train, fine-tune or improve any AI model, by us or by our AI subprocessor.
• ·Data minimisation: each AI feature sends only what that feature needs, and the platform states per feature exactly what that is. Our dashboard assistant is sent aggregate figures only — never names, contact details or individual gift records. Our list-building assistant is sent the Customer’s own tag and category names, never person records. Our person-summary assistant is sent one person’s first name, involvement figures, giving totals (only for a user permitted to see giving) and shared notes — never a surname, contact details, birth date, medical or household records, or pastoral notes.
• ·Minors: our AI features do not process the personal data of anyone recorded as under 18, or whose age isn’t on file — judged by the date of birth on file or, when none is recorded, by a child record, a school grade from pre-K to 12th, or a household role of child or dependent; someone with no date of birth, no school grade and no household role has no age on file. The person-summary assistant refuses such a person before any of their data is read or sent, and our connector for AI clients (MCP) leaves their records out. This covers our own AI features and connector, not integrations the Customer builds on the REST API. The rule works from the Customer’s records: a person under 18 recorded with no date of birth or school grade, not marked as a child, and listed in a household as head, spouse or other is not recognised, and free text about another person (for example a note or a sermon) is not screened for mentions of a child. The contact email and phone the Customer types onto an event go to the connector as entered: they are linked to no person record, so there is no age to check.
• ·No autonomous action: no AI feature alters or deletes Customer records on its own, and every feature except one returns a draft or a suggestion that a person reviews. The exception is sermon transcription: when a user asks for a sermon recording to be transcribed, the transcript is saved to that sermon, where it can be edited or removed.
• ·Disclosure and marking: AI-written content that we store (sermon transcripts) carries a machine-readable marker in the API and is labelled where a church website publishes it, consistent with Article 50 of the EU AI Act.
• ·Logging: we record that an AI request was made — who made it, which feature and how much it consumed — in the Customer’s audit log. We do not record the content of the request or the generated output.
• ·No profiling of individuals: we do not use AI to score, rank or predict the behaviour of individual members, and no AI feature makes a decision that produces a legal or similarly significant effect on a person.

• ·Data-subject requests: the platform provides self-service tooling for access, export, correction and erasure of an individual’s records. Where the Customer cannot fulfil a request with that tooling, we assist at no charge.
• ·We notify the Customer without undue delay if we receive a request directly from one of its data subjects, and do not respond to it ourselves except to direct the individual to the Customer.
• ·Personal-data breaches: we notify the affected Customer without undue delay and in any event within 72 hours of becoming aware, with the information available at the time and updates as the investigation proceeds.
• ·We provide reasonable assistance with data-protection impact assessments and prior consultations (GDPR Articles 35–36).

The Customer can export its data at any time during the term, and should do so before closing its account. After closure we keep Customer data for 90 days so that it can be restored at the Customer’s request, after which we delete Customer personal data from production systems. Deleted records remain recoverable from the Recently Deleted area for 30 days; encrypted backups age out on their normal cycle (up to 90 days for uploaded files).

We retain records for longer only where law requires it — most commonly giving and donation records, which are kept for seven years to satisfy tax and charitable-receipt obligations (after an account closes, in anonymized form). Audit records are retained for 7 years.

Personal data is processed in the United States. For transfers of EU, EEA, UK or Swiss personal data, the European Commission’s Standard Contractual Clauses (Module Two: controller to processor) are incorporated into this Addendum by reference, together with the UK International Data Transfer Addendum where the UK GDPR applies. We do not currently offer EU-resident hosting; if that is a requirement, tell us before purchase.

On reasonable written request, and no more than once a year unless required by a supervisory authority or following a breach, we make available the information necessary to demonstrate compliance with this Addendum — including our security documentation, architecture detail and third-party attestations held by our infrastructure providers, under NDA. If the Customer requires an on-site or third-party audit beyond that, the parties will agree scope, timing and reasonable cost in advance.

This Addendum applies automatically to every Customer as part of the agreement — no signature is required for it to take effect. If your organisation needs a countersigned copy, or needs it issued on your own paper, email privacy@holyplatform.com with your legal entity name and address and we will return a signed copy.

Version 1.1 · Emito Consulting Service LLC, Monroe, North Carolina. This page is the published form of the Addendum and is provided for transparency; it does not constitute legal advice to the Customer.