Skip to content
← GDPR and privacy for churches Download as PDF

Data Processing Agreement

This is an English translation of the Dutch "Verwerkersovereenkomst". In the event of any difference between the translation and the Dutch text, the Dutch text prevails.

This is the Data Processing Agreement (hereinafter: "Data Processing Agreement") between the parties as defined below. It forms an integral part of the Main Agreement concerning the provision of services through the KerkPoint platform.

Parties:

  1. The Church Organisation / Tenant, the legal entity or body that uses the services of KerkPoint, hereinafter referred to as the "Controller"; and
  2. KerkPoint (part of FlexWave), established at Hullerweg 81, 8071 RM Nunspeet, the Netherlands, registered with the Dutch Chamber of Commerce under number 89784367, hereinafter referred to as the "Processor".

Hereinafter jointly referred to as the "Parties" and individually as a "Party".

1. Definitions and Applicability

1.1. In this Data Processing Agreement, the terms "Personal Data", "Processing", "Controller", "Processor" and "Data Subject" have the meaning given to them in the General Data Protection Regulation (GDPR). 1.2. This Data Processing Agreement applies to all Processing of Personal Data that the Processor carries out on behalf of the Controller in the performance of the Main Agreement (the SaaS services of KerkPoint).

2. Subject Matter of the Processing

2.1. The Processor undertakes to process Personal Data on behalf of the Controller under the conditions of this Data Processing Agreement. The Processing takes place solely in the performance of the Main Agreement (including facilitating planning, schedules, communication and the management of volunteers/members within the platform). 2.2. The categories of Data Subjects and the types of Personal Data processed are specified in Annex 1 to this Data Processing Agreement. 2.3. Because the services are provided specifically to church bodies, the nature of the data may mean that religious beliefs (special categories of personal data under Article 9 GDPR) can be derived directly or indirectly from the Processing. The Processor will treat this data with the strictest possible confidentiality and security.

3. Instructions and Obligations of the Processor

3.1. The Processor processes the Personal Data only on documented instructions from the Controller, including the instructions that follow from the Main Agreement and the configuration of the platform by users, unless required to do so by Union or Member State law to which the Processor is subject. 3.2. The Processor ensures that the persons authorised to process the Personal Data (including employees and any sub-processors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Sub-processors (Engaging Third Parties)

4.1. The Controller hereby grants the Processor general written authorisation to engage third parties (sub-processors) for the performance of the Main Agreement. The current list of sub-processors is included in Annex 2. 4.2. The Processor will inform the Controller in advance of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes in writing within 14 days. 4.3. Where the Processor engages a sub-processor, it imposes on that sub-processor the same data protection obligations as those set out in this Data Processing Agreement.

5. Security of the Processing

5.1. The Processor takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These measures include:

  • The use of secure TLS/HTTPS connections;
  • Encryption (hashing) of passwords;
  • Strict logical separation of data between different tenants (multi-tenancy);
  • Periodic back-ups and procedures to ensure the availability and recoverability of data;
  • Separation of roles and permissions within the application. 5.2. The Controller is responsible for the correct use of the functionality made available by the Processor and for the secure management of the login details of its own administrators and users.

6. Personal Data Breaches (Notification Duty)

6.1. In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed (a "Data Breach"), the Processor will inform the Controller without undue delay, and in any case within 48 hours of discovery. 6.2. The Processor provides the Controller with all necessary information reasonably available to enable the Controller to meet its statutory notification obligations (for example to the supervisory authority). 6.3. Notifying a Data Breach to the supervisory authority and/or the Data Subjects is the exclusive responsibility of the Controller.

7. Rights of Data Subjects

7.1. Taking into account the nature of the Processing, the Processor assists the Controller as far as possible, by appropriate technical and organisational measures, in fulfilling the Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the GDPR (such as the right of access, rectification or erasure). 7.2. If a Data Subject addresses a request directly to the Processor, the Processor will forward that request to the Controller as soon as possible.

8. Audits

8.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Data Processing Agreement and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. 8.2. The costs of such an audit are borne entirely by the Controller. An audit may take place at most once per calendar year, provided it is announced in writing at least 30 days in advance, and may not unreasonably disrupt the Processor's normal business operations.

9. Term and Termination

9.1. This Data Processing Agreement enters into force when the Main Agreement is concluded and remains in force for the duration of the Main Agreement. 9.2. After termination of the Main Agreement, the Processor will, at the choice of the Controller, permanently delete or return all Personal Data, and delete existing copies, unless Union or Member State law requires storage of the Personal Data. Unless instructed otherwise, data is permanently and irreversibly removed from the active systems after a retention period of no more than 6 months (back-ups may rotate for up to 30 days longer).

Annex 1: Specification of the Processing

A. Categories of Data Subjects

The Processing concerns the following categories of persons whose data is entered into the platform by or on behalf of the Controller:

  • Members of the church congregation / organisation;
  • Volunteers (for example sextons, musicians, technicians, nursery staff);
  • Guests or temporary helpers;
  • Administrators and staff of the tenant.

B. Types of Personal Data

The following types of data may be processed within the platform:

  • Identification and contact details: Name, e-mail address, telephone number;
  • Role and planning data: Availability, assigned roles/tasks, team composition, schedule history;
  • Login and account data: Username, roles, permissions and (hashed) login details;
  • Communication data: Messages, notifications or comments posted within the planning system.

C. Special Categories of Personal Data (where applicable)

  • Religious belief: Membership of, or involvement with, the specific church body (the Controller) follows inherently from inclusion in the platform (in accordance with Article 9(2)(d) GDPR).

Annex 2: Authorised Sub-processors

The Controller authorises the engagement of the following sub-processors for the purpose of the SaaS services:

  1. Strato AG (Germany/EU) – Hosting of the application, databases and infrastructure.
  2. Vimexx (the Netherlands/EU) – Sending transactional e-mails and notifications.
  3. Mollie B.V. (the Netherlands/EU) – Handling subscription fees and payment transactions (where applicable at tenant level).

This Data Processing Agreement forms a legal part of the terms and conditions and the registration procedure of KerkPoint. By accepting the terms when creating a tenant/environment, the Parties declare that they agree with its content.