Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Altarflow Terms of Service (the "Terms") between AU Sigma LLC ("Altarflow", "we" or "us") and the Church that uses the Service (the "Church"). It applies automatically when a Church accepts the Terms. Words defined in the Terms have the same meaning here.

1. Roles and scope

1.1 Roles. For personal information in Church Data, the Church is the controller (or "business") and Altarflow is the processor (or "service provider" or "contractor"). This includes information about givers, members, vendors and the Church's team.

1.2 What we process. Annex 1 describes the people, kinds of information, purposes and duration of our processing.

1.3 Which laws. "Data Protection Laws" means all privacy and data protection laws that apply to our processing of Church Data, including U.S. state privacy laws, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Swiss Federal Act on Data Protection, where they apply.

2. Instructions

2.1 We follow the Church's instructions. We process Church Data only to provide the Service, to follow the Church's instructions given through the Service or in writing, and as Data Protection Laws require. The Terms and this DPA are the Church's complete instructions at the start.

2.2 Unlawful instructions. We will tell the Church if we believe an instruction breaks Data Protection Laws.

3. Confidentiality and security

3.1 Our team. Everyone at Altarflow who can access Church Data is bound by confidentiality obligations.

3.2 Security measures. We maintain the security measures in Annex 2. We may improve them over time, but we will not reduce the overall protection of Church Data.

3.3 Security incidents. If we become aware of unauthorized access to, or loss or disclosure of, Church Data, we will notify the Church's admins without undue delay, and where feasible within 72 hours after we confirm it. We will share what we know, what we have done to contain it, and what the Church may need to do. We will help the Church meet its own notification duties. Notifying the Church is not an admission of fault.

4. Givers' requests

If a giver or other person asks us to access, correct or delete their information in Church Data, we will pass the request to the Church, unless the law prevents us. The Church decides how to respond. We will help the Church respond using the features of the Service, and with reasonable additional help on request.

5. The Church's responsibilities

5.1 Notices and legal basis. The Church is responsible for giving people the notices, and having the legal basis or consent, that Data Protection Laws require for the Church Data it puts into the Service and for the messages it sends through it.

5.2 Religious information. A gift to a church, or a record in a church's member list, can reveal a person's religious beliefs. The Church confirms it has a valid legal basis to process this information, for example as a religious organization keeping records about its members and regular contacts, or with the person's explicit consent. We process it only to provide the Service.

5.3 Information not to upload. The Church will not put into the Service: Social Security numbers or other government ID numbers (other than the Church's own EIN), full payment card or bank account numbers outside the payment forms the Service provides, health information, or passwords for other services.

5.4 Children. If the Church keeps records about children, the Church is responsible for any parental consent the law requires.

6. Subprocessors

6.1 Authorization. The Church authorizes us to use the subprocessors listed in the Privacy Policy under "How we share information" (the "Subprocessor List"), and to add or replace subprocessors as described here.

6.2 Our duties. Each subprocessor must agree in writing to protect Church Data at least as well as this DPA requires, for the services it provides. We remain responsible for our subprocessors.

6.3 Changes. Before a new subprocessor processes Church Data, we will update the Subprocessor List and notify the Church's admins by email at least 15 days in advance, except in an emergency. If the Church objects on reasonable data protection grounds, we will work with it in good faith. If we cannot resolve the objection, the Church may close its account and receive a refund of any prepaid fees for the unused part of its billing period.

7. AI models

We do not use Church Data to train AI models. Our AI providers may not use Church Data to train, fine-tune or improve their models.

8. Audits and information

On request, and no more than once a year unless a regulator requires more, we will answer reasonable written questions about our compliance with this DPA and provide information that shows it. Any on-site audit must be agreed in advance, reasonable in scope, and covered by a confidentiality agreement.

9. Return and deletion

9.1 Export. While its account is active, the Church can export its data as described in the Terms.

9.2 Deletion. We delete Church Data within 120 days after the Church asks us to close its account, or after its account has had no activity for 120 days, as described in the Terms. Backups expire on their normal schedule. We may keep records the law requires us to keep, protected under this DPA, until we no longer need to.

10. U.S. state privacy laws

We will not sell or share personal information in Church Data, or use it for targeted advertising. We will not retain, use or disclose it for any purpose other than providing the Service to the Church, or outside our direct business relationship with the Church, except as the law allows. We will not combine it with personal information we receive from others or collect ourselves, except as needed to provide the Service and as the law allows. We will tell the Church if we can no longer meet these obligations. The Church may take reasonable steps to stop and fix any unauthorized use. We certify that we understand and will comply with these restrictions.

11. Transfers out of Europe

11.1 Where Church Data includes personal information protected by the GDPR, UK GDPR or Swiss law, and its transfer to Altarflow in the United States is a restricted transfer, the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 (the "SCCs") apply and are incorporated into this DPA as follows:

• Module Two (controller to processor) applies when the Church is a controller, and Module Three (processor to processor) applies when the Church is a processor.
• Clause 7 (docking clause) does not apply.
• Clause 9: Option 2 (general written authorization) applies, with the notice period in Section 6.3.
• Clause 11: the optional language does not apply.
• Clause 17: the SCCs are governed by the law of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.
• Annex I is completed by Annex 1 of this DPA, and Annex II by Annex 2.
• The Church is the data exporter and Altarflow is the data importer.

11.2 For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies, with Table 4 allowing either party to end it as the Addendum permits. For transfers from Switzerland, references to the GDPR in the SCCs are read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner is the competent authority, and people in Switzerland may bring claims in Switzerland.

11.3 If a different lawful transfer mechanism becomes available or required, we may use it instead, as long as it protects Church Data at least as well.

12. General

If this DPA conflicts with the Terms, this DPA controls for the processing of personal information. If it conflicts with the SCCs, the SCCs control. The limits of liability in the Terms apply to this DPA, except where Data Protection Laws or the SCCs do not allow it. This DPA lasts as long as we process Church Data.

Annex 1. Processing details

Data exporter: the Church, contact through its admin account. Data importer: AU Sigma LLC (Altarflow), support@altarflow.com.

People whose information is processed: the Church's givers and donors, members (Legacy plan), vendors and payees, people who submit the Church's forms or Donor Form, and the Church's team members.

Kinds of information: names, email addresses, phone numbers and mailing addresses; gift amounts, dates, funds, campaigns and recurring schedules; payment method type, brand and last four digits (full card and bank numbers are handled by our payment processor); bank and card transactions and balances of the Church's connected accounts; expenses, receipts and notes; form answers; member details such as birthdays, life stage and ministry interests (Legacy plan); questions asked in Ask Altarflow; and sign-in and device information for team members.

Sensitive information: gifts and membership can reveal religious beliefs. Safeguards: access limited to the Church's team by role, encryption in transit, and the measures in Annex 2.

How often: continuously while the Church uses the Service.

Nature and purpose: hosting, processing gifts and payouts, sending receipts, statements and verification codes, importing and matching bank transactions, reading receipts, AI suggestions and answers, reports, and support, all to provide the Service to the Church.

Duration: for as long as the Church uses the Service, then until deletion under Section 9.

Subprocessors: as listed in the Subprocessor List, for the services described there.

Annex 2. Security measures

• Access control: each Church's data is kept separate, team members see only the pages their role allows, and new devices must be verified with a code before signing in.
• Session protection: automatic sign-out after 30 minutes of inactivity in the web app.
• Encryption: data is encrypted in transit. Our database and storage providers encrypt data at rest.
• Payment data: full card and bank numbers are collected and stored by our payment processor, which is certified to PCI DSS Level 1. Altarflow stores only the card brand, last four digits and expiration date.
• Files: receipt files are served through links that expire after 15 minutes.
• Abuse prevention: rate limits on sign-in, verification codes and sensitive actions, and bot checks at sign-up.
• Monitoring: errors are monitored, and logs remove sensitive fields such as credentials.
• Hosting: data is stored and processed in data centers in the eastern United States.
• People: access to production systems is limited to Altarflow staff who need it.

---

Adapted from templates by General Legal, PC (CC0 1.0).