EKKLESIA.NG DATA PROCESSING AGREEMENT
This Data Processing Agreement ("DPA") forms part of the agreement between:
Ekklesia.ng, operated by MYPLAYSTORE DIGITAL, ("Processor")
and
[CHURCH / CUSTOMER LEGAL NAME], ("Controller").
1. Purpose
The Processor provides a church management platform through which the Controller may store and process personal data.
This DPA governs the Processor's processing of personal data on behalf of the Controller.
2. Definitions
- "Personal Data" means personal data processed under the Principal Agreement.
- "Controller" means the Church/customer determining the purposes and means of processing.
- "Processor" means Ekklesia processing personal data on behalf of the Controller.
- "Data Subject" means an identified or identifiable individual.
- "Sub-processor" means a third party appointed by the Processor to process personal data.
3. Processing Instructions
The Processor shall process Personal Data only:
- to provide the Services;
- according to documented instructions from the Controller;
- as required by applicable law;
- for security, fraud prevention and service administration where legally permitted.
The Processor shall not sell Controller Personal Data.
4. Categories of Data
Depending on the services used, Personal Data may include:
- names;
- phone numbers;
- email addresses;
- addresses;
- attendance records;
- membership information;
- visitor records;
- event-registration information;
- communication history;
- role and department information;
- follow-up records;
- payment references;
- other information entered by the Controller.
5. Categories of Data Subjects
Data Subjects may include:
- church members;
- visitors;
- converts;
- pastors;
- officers;
- workers;
- volunteers;
- event attendees;
- donors;
- applicants;
- other persons whose information is entered into the Platform.
6. Controller Responsibilities
The Controller shall:
- establish an appropriate lawful basis;
- provide required notices;
- obtain consent where required;
- ensure accuracy;
- respond to Data Subject requests;
- ensure appropriate permissions;
- configure user access appropriately;
- avoid unlawful processing.
7. Processor Responsibilities
The Processor shall:
- process Personal Data according to instructions;
- maintain appropriate security measures;
- restrict access to authorised personnel;
- maintain confidentiality;
- assist with appropriate data-subject requests;
- assist with security incidents;
- cooperate with lawful regulatory requirements;
- maintain reasonable records relating to processing.
8. Confidentiality
Persons authorised to process Personal Data shall be subject to confidentiality obligations.
9. Security Measures
The Processor shall maintain reasonable technical and organisational safeguards, which may include:
- authentication;
- role-based access control;
- encryption;
- secure hosting;
- logging;
- monitoring;
- backups;
- vulnerability management;
- incident response;
- access management;
- secure development practices.
Specific controls may be described in a security schedule.
10. Sub-processors
The Processor may use Sub-processors necessary to provide the Services.
Examples may include:
- cloud hosting providers;
- email providers;
- SMS providers;
- WhatsApp infrastructure;
- payment providers;
- security providers;
- backup providers.
The Processor shall require relevant contractual obligations from Sub-processors where appropriate.
11. International Processing
Where processing occurs outside Nigeria, the parties shall comply with applicable requirements relating to cross-border transfers.
12. Data Subject Requests
Where the Processor receives a Data Subject request relating to Controller Data, the Processor may direct the individual to the Controller.
Where reasonably required, the Processor shall provide reasonable assistance to the Controller.
13. Security Incident
The Processor shall notify the Controller of a confirmed Personal Data breach affecting Controller Data within a reasonable period after becoming aware of it, subject to applicable law and the information reasonably available at the time.
The notification may include:
- description of the incident;
- categories of affected data;
- known or reasonably suspected impact;
- mitigation measures;
- contact information for the incident response contact.
14. Data Protection Impact Assessments
Where reasonably required, the Processor shall provide reasonable information to assist the Controller with a DPIA.
15. Regulatory Cooperation
Each party shall reasonably cooperate with applicable data-protection authorities where required by law.
16. Audit
The Controller may request reasonable information concerning the Processor's compliance with this DPA.
Audits shall:
- be reasonably scoped;
- respect confidentiality;
- avoid unnecessary disruption;
- occur at reasonable intervals.
17. Data Return and Deletion
Following termination, the Controller may request return or deletion of Controller Data, subject to:
- applicable legal retention requirements;
- backup cycles;
- security requirements;
- outstanding disputes.
18. Confidentiality of DPA Information
Information exchanged under this DPA shall be treated as confidential except where disclosure is required by law.
19. Insurance
The Processor may maintain appropriate commercial and cyber-risk insurance appropriate to the nature and scale of the Services.
Nothing in this clause constitutes a representation that insurance will cover every possible loss.
20. Liability
Liability relating to processing shall be governed by the Principal Agreement, subject to mandatory applicable law.
21. Term
This DPA begins when the Controller starts using the Services and continues while the Processor processes Controller Data.
22. Governing Law
This DPA shall be governed by applicable Nigerian law unless otherwise agreed in writing.
23. Contact
Processor:
Ekklesia.ng
MYPLAYSTORE DIGITAL
Enugu
Email: info@ekklesia.ng