Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Master Subscription Agreement between Orravo Web Technologies ("Orravo", "Processor") and the subscribing institution ("Customer", "Controller"). It governs Orravo's processing of personal data on the Customer's behalf when the Customer uses the EcclesiaOne platform.

This DPA is written to the Nigeria Data Protection Act 2023 (the "NDPA") and, where the Customer or its members are in the EU or the UK, to the GDPR. Terms such as "personal data", "processing", "controller", "processor", "data subject", and "sensitive personal data" or "special categories of data" have the meanings given in the applicable law.

1.Roles

The Customer is the Controller of the personal data it processes through the Platform about its members, parishioners, students, guardians, donors, staff, and similar persons ("Customer Personal Data"). Orravo is the Processor of that data. For the limited data Orravo processes to operate the Platform as described in the Privacy Policy, Orravo is a Controller in its own right, and that processing is outside this DPA.

2.Scope and instructions

Orravo processes Customer Personal Data only:

• to provide, maintain, secure, and support the Platform under the Master Subscription Agreement;
• in accordance with the Customer's documented instructions, including the configuration choices the Customer makes in the Platform; and
• as required by law, in which case Orravo will inform the Customer unless the law forbids it.

If Orravo believes an instruction breaches the NDPA, the GDPR, or other data-protection law, it will tell the Customer.

3.Subject matter, duration, nature, and purpose

The subject matter is the administration of the Customer's ecclesiastical or educational activities. The duration is the term of the Master Subscription Agreement plus any retention period in this DPA. The nature and purpose are hosting, storage, organization, retrieval, display, transmission, backup, and deletion of Customer Personal Data, and the optional features the Customer enables. The categories of data subject and personal data are set out in Annex 1.

4.Confidentiality

Orravo ensures that personnel authorized to process Customer Personal Data are bound by confidentiality and are trained appropriately. Access by Orravo personnel is limited to those who need it to provide or support the Platform, and such access is logged. This includes access by administrators and, in limited support cases, acting on behalf of a user (impersonation), which is recorded.

5.Security

Orravo implements appropriate technical and organizational measures to protect Customer Personal Data, taking account of the state of the art, the costs, and the risks. These measures are described in the Security Statement and include access control based on role, hashing of passwords, optional two-factor authentication, encryption of pastoral and spiritual notes, tamper-evident sacramental registers, and audit logging. The Customer is responsible for the security choices within its own control, such as managing its users' roles and enabling two-factor authentication.

6.Sub-processors

The Customer authorizes Orravo to engage sub-processors to help provide the Platform. The current sub-processors are listed in the Sub-processor List, which includes payment, messaging, email, hosting and storage, and AI providers. Orravo imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. Orravo will give the Customer notice of any intended addition or replacement of a sub-processor at least 30 days before the change takes effect, by updating the Sub-processor List and sending an email to the Customer's tenant administrators, and the Customer may object on reasonable data-protection grounds within that period.

7.International transfers

Some sub-processors process data outside the Customer's country, including the optional OCR feature, which processes register images in the United States, and certain messaging, email, and hosting providers. Where Orravo transfers Customer Personal Data across borders, it relies on an adequacy decision where one exists or on appropriate safeguards such as standard contractual clauses, and it complies with NDPA Part VIII and, where applicable, the GDPR transfer rules. Details are available on request.

8.Assisting the Customer

Taking account of the nature of the processing, Orravo will assist the Customer, by appropriate technical and organizational measures and as far as is reasonably possible, to:

• respond to data-subject requests (access, correction, erasure, restriction, objection, and portability), including through the Platform's self-service export and minor-content removal tools; and
• meet the Customer's own obligations on security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority.

If Orravo receives a data-subject request relating to Customer Personal Data, it will refer the data subject to the Customer and will not respond directly except on the Customer's instruction or as required by law.

9.Personal data breaches

Orravo will notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any event within 72 hours of becoming aware of it, and will provide the information the Customer reasonably needs to meet its own notification obligations to the NDPC and, where applicable, to EU or UK authorities and to affected data subjects.

10.Return and deletion

On termination of the Master Subscription Agreement, Orravo will, at the Customer's choice, return or delete Customer Personal Data, except to the extent storage is required by law or for the preservation of canonical records.

Return is provided as a downloadable archive of machine-readable files, which the Customer can generate from within the Platform or request from Orravo.

After termination, Orravo holds the Customer's data for at least 30 days so that the tenant can be restored if the termination was a mistake or while a dispute is settled, and deletes it after that period. The deletion is carried out by Orravo on request rather than by an automatic job, so it may take longer than 30 days; Orravo will confirm completion in writing if the Customer asks. Orravo does not operate a backup schedule of its own; backups of the primary database are those performed by its database provider under that provider's terms, so Customer Personal Data may remain in a backup copy after it has been deleted from the live Platform. Orravo will not restore a backup in order to reinstate deleted Customer Personal Data.

11.Audits

Orravo will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice, during business hours, subject to confidentiality, and no more than once in any 12-month period, unless required by a supervisory authority or following a personal data breach.

12.Liability

Liability under this DPA is subject to the limitations in the Master Subscription Agreement, except where the law does not permit those limits to apply to data-protection liabilities owed to data subjects.

13.Priority and changes

If there is a conflict between this DPA and the rest of the Master Subscription Agreement on the processing of personal data, this DPA prevails. Orravo may update this DPA to reflect changes in law or practice and will give reasonable notice of material changes.

---

Annex 1: Details of processing

Categories of data subjects: members and parishioners; donors; students and their guardians; clergy, religious, staff, and volunteers; marketplace vendors and buyers; and other individuals whose data the Customer records.

Categories of personal data: identity and contact data; household and location data; account, authentication, and technical data; financial and giving data; content created by users; and audit and log data.

Special categories / sensitive data: religious affiliation and sacramental records; pastoral, spiritual, confession, tribunal, and vocations records; health and safeguarding data; and children's data. These are processed on the basis that the Customer is a religious body processing the data of its members, with consent where required, as set out in the Privacy Policy.

Frequency and duration: continuous for the term of the Subscription.

Processing operations: hosting, storage, organization, retrieval, display, transmission, backup, optional OCR digitization, messaging delivery, and deletion.

Annex 2: Sub-processors

See the Sub-processor List, which forms part of this DPA.

Annex 3: Technical and organizational measures

See the Security Statement, which forms part of this DPA.