Data Processing Agreement

1. Definitions

• "Data Controller" means your church or religious organization that determines the purposes and means of processing personal data.
• "Data Processor" means Zion App, which processes personal data on behalf of the Data Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Children's Data" means personal data of individuals under the age of 13 (or applicable age in your jurisdiction).
• "Processing" means any operation performed on personal data, including collection, storage, use, and deletion.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Sub-processor" means any third party engaged by Zion App to process personal data.

2. Roles and Responsibilities

2.1 Data Controller (Your Church) Responsibilities

As the Data Controller, your church agrees to:

• Ensure all personal data is collected lawfully with appropriate consent
• Obtain verifiable parental consent before collecting children's data (COPPA requirement)
• Provide clear privacy notices to all data subjects
• Respond to data subject access, correction, and deletion requests
• Ensure data accuracy and keep information up to date
• Implement appropriate organizational security measures
• Train staff on data protection and children's safety
• Notify Zion App of any data breaches within 24 hours of discovery
• Comply with all applicable privacy laws (COPPA, GDPR, CCPA, etc.)
• Maintain records of processing activities and consents

2.2 Data Processor (Zion App) Responsibilities

As the Data Processor, Zion App agrees to:

• Process personal data only on documented instructions from the Data Controller
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Data Controller in responding to data subject requests
• Delete or return all personal data upon termination of services
• Make available information necessary for compliance audits
• Notify the Data Controller of any data breach within 48 hours
• Not use personal data for any purpose other than providing the Service
• Not sell, share, or disclose personal data to third parties except as required

3. Children's Data (Special Provisions)

3.1 Church Obligations for Children's Data

Before using Kids Ministry features, your church MUST:

• Obtain Verifiable Parental Consent: Collect signed consent forms (physical or electronic) from parents/guardians before registering any child
• Provide Clear Notice: Inform parents exactly what data will be collected, how it will be used, and who will have access
• Document Consent: Maintain records of parental consent for each child
• Honor Parental Rights: Respond promptly to requests from parents to review, modify, or delete their child's data
• Limit Collection: Only collect information necessary for Kids Ministry operations
• Secure Access: Limit access to children's data to authorized staff only

3.2 Parental Consent Requirements

Valid parental consent must include:

• Parent/guardian's full legal name
• Relationship to the child
• Acknowledgment of data collection practices
• Explicit consent to collect and process child's information
• Date of consent
• Signature (physical or electronic)

3.3 Zion App's Role with Children's Data

Zion App will:

• Store children's data with enhanced security measures
• Provide tools for churches to manage parental consent
• Enable data export and deletion upon request
• Never use children's data for marketing or advertising
• Never share children's data with third parties (except as required for service delivery)
• Apply strict access controls to children's data

4. Security Measures

Zion App implements the following security measures:

Technical Measures

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Secure password hashing (bcrypt with salt)
• Multi-tenant data isolation (each church's data is completely separate)
• Regular security updates and patching
• Database backups with encryption
• Secure authentication with session management

Organizational Measures

• Role-based access controls
• Staff confidentiality agreements
• Security awareness training
• Incident response procedures

5. Sub-processors

Zion App uses the following sub-processors to provide our services:

We will notify you of any changes to sub-processors with at least 30 days notice.

6. Data Subject Rights

Data subjects (members, parents, guardians) have the following rights. The Data Controller (your church) is responsible for responding to these requests:

• Right of Access: Request a copy of their personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of their data ("right to be forgotten")
• Right to Restrict Processing: Request limitation on how data is processed
• Right to Data Portability: Receive their data in a portable format
• Right to Object: Object to processing of their data
• Right to Withdraw Consent: Withdraw previously given consent

Zion App will assist your church in responding to data subject requests. Contact us at support@zionapp.org for assistance.

7. Data Breach Notification

In the event of a data breach:

Zion App will:

• Notify the affected Data Controller(s) within 48 hours of discovering a breach
• Provide details about the nature of the breach, data affected, and remediation steps
• Cooperate with the Data Controller's investigation and notification efforts
• Take immediate steps to contain and remediate the breach

Your Church will:

• Notify affected data subjects as required by law
• Report to relevant supervisory authorities if required
• Document the breach and response actions
• Notify Zion App of any breaches discovered on your end within 24 hours

8. Data Retention and Deletion

Personal data is retained for as long as the church account is active or as needed to provide services.

• Check-in/check-out records: Retained for 2 years for safety and compliance
• Incident reports: Retained for 7 years
• Account data: Retained until account deletion is requested
• Backups: Deleted within 30 days of data deletion

Upon termination of services, all personal data will be deleted within 90 days unless legally required to retain it.

9. Liability and Indemnification

Each party shall be liable for damages arising from its own breach of this DPA or applicable data protection laws.

• The Data Controller (church) is liable for ensuring lawful data collection and consent
• The Data Processor (Zion App) is liable for implementing appropriate security measures
• Neither party is liable for the other party's breach of data protection obligations

10. Data Processing Activities

The following table describes the data processing activities conducted by Zion App:

11. Standard Contractual Clauses

For international data transfers from the EEA or UK to the United States, Zion App relies on the European Commission's Standard Contractual Clauses (SCCs) as the legal mechanism to ensure adequate data protection. These clauses are incorporated into this DPA by reference.

A copy of the applicable SCCs is available upon request by contacting privacy@zionapp.org.

12. Audit Rights

The Data Controller has the right to audit Zion App's compliance with this DPA:

• Zion App will make available all information necessary to demonstrate compliance
• Audits may be conducted once per year with 30 days advance written notice
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with operations
• The Data Controller may appoint a qualified third-party auditor, subject to confidentiality obligations
• Zion App will cooperate with and provide reasonable assistance during audits

13. Sub-Processor Notification

Regarding changes to sub-processors:

• Zion App will notify the Data Controller at least 30 days before engaging a new sub-processor
• Notification will be sent via email to the primary admin account
• The Data Controller may object to a new sub-processor within 14 days of notification
• If no objection is received, consent is deemed given
• If the Data Controller objects and Zion App cannot reasonably accommodate the objection, either party may terminate with 30 days notice

14. Incident Response SLA

In the event of a data security incident:

15. Data Return and Deletion on Termination

Upon termination of the service agreement:

• Zion App will provide a complete data export in machine-readable format (JSON/CSV) within 30 days
• All personal data will be permanently deleted within 90 days of termination
• Backup copies will be purged within 30 days after primary data deletion
• Audit logs may be retained for up to 7 years as required for legal compliance
• Zion App will provide written certification of data deletion upon request

16. Governing Law

This DPA is governed by the laws of the State of California, United States, without regard to conflict of laws principles. For churches subject to GDPR, the provisions of GDPR shall also apply.

17. Contact Information

For questions about this DPA or data processing practices:

18. Acceptance

By using Zion App's services, the Data Controller agrees to the terms of this Data Processing Agreement. This DPA is incorporated into and forms part of the Terms of Service.