Data Processing Agreement (DPA)

Version 1.0 · Effective date: September 23, 2026 · Compliant with Art. 28 GDPR

This is an English translation provided for convenience. The Polish version (Umowa powierzenia przetwarzania danych osobowych (DPA)) is the legally binding one; in case of any discrepancy, the Polish version prevails.

This Data Processing Agreement (the "DPA" or the "Agreement") forms part of the WorshipPro Terms of Service and governs the entrusting of personal data processing by the Church (the Controller) to the Operator (the Processor) in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

Conclusion: The DPA is concluded electronically when a Church is created in WorshipPro — by ticking the box accepting the Terms and the DPA. The Operator keeps confirmation of the acceptance (date, document version, email address of the accepting person, IP address). On request sent to contact@worshippro.net, the Operator will send a copy for signature in written or electronic form.

Parties to the Agreement

Processor (the Operator):

• Name: ELEVATION SYSTEMS — Emanuel Trzcionkowski
• Address: ul. Raciborska 104B, 44-210 Rybnik, Polska
• NIP (tax ID): 6423114582, REGON (business registry number): 521321287
• Email: contact@worshippro.net
• Phone: +48 786 833 736 (formal matters only; technical support by email)
• Website: worshippro.net

Controller (the Church): the Church created in WorshipPro, identified by the name and details (e.g. address, NIP (tax ID), REGON (business registry number)) provided when it was created, represented by the person accepting the DPA.

§ 1. Subject matter and duration

• The Controller entrusts the Operator with the processing of personal data to the extent and for the purpose necessary to provide the WorshipPro service (the "Service") described in the Terms.
• Nature of the processing: storing, organizing, displaying, making available to persons authorized by the Controller, exporting and deleting data within the features of the Service, as well as sending emails requested within the Service (e.g. invitations, ministry reminders).
• The Agreement remains in force for as long as the Church uses the Service, subject to § 12.

§ 2. Categories of data subjects and data

2.1 Categories of data subjects

• members, supporters and guests of the Church,
• children and their guardians (e.g. Sunday school, attendance check-in),
• team members and ministry volunteers,
• donors and persons to whom the Church's financial documents relate,
• users of accounts with access to the Church,
• other persons whose data the Controller enters into the Service.

2.2 Categories of data

2.3 Special categories of data

Data on Church membership reveals religious beliefs, and allergies and medical notes are health data (Art. 9 GDPR). The Controller ensures a basis for processing them (e.g. Art. 9(2)(d) GDPR or explicit consent) and enters them only to the extent necessary. The Operator applies the measures described in § 8 to them and does not process them for any other purpose.

§ 3. Purposes of processing

The Operator processes the entrusted data solely for the purpose of:

• providing the Service in accordance with the Terms and the configuration set by the Controller,
• ensuring the security and continuity of the Service,
• technical support provided at the Controller's request,
• assisting the Controller in fulfilling the rights of data subjects.

The Operator does not use the entrusted data for its own purposes — in particular for marketing, profiling, analytics or training artificial intelligence models — and does not sell it.

§ 4. Obligations of the Operator (Art. 28(3) GDPR)

The Operator:

• processes the data only on documented instructions from the Controller — the Terms, the DPA and the actions and settings performed by the Controller in the Service constitute such instructions; if the Operator considers that an instruction infringes the law, it informs the Controller without delay,
• ensures that persons authorized to process the data have committed themselves to confidentiality,
• applies the security measures set out in § 8,
• engages subprocessors on the terms set out in § 6,
• assists the Controller in fulfilling data subjects' rights (§ 10) and the obligations under Art. 32–36 GDPR,
• after the end of the Agreement, deletes or returns the data in accordance with § 12,
• makes available the information necessary to demonstrate compliance with Art. 28 GDPR and allows for audits (§ 11).

§ 5. Obligations of the Controller

The Controller:

• has a legal basis for processing the data it entrusts (Art. 6 and 9 GDPR),
• fulfills its information obligations towards data subjects (Art. 13–14 GDPR) and collects the required consents — in particular from guardians in the case of children's data,
• enters into the Service only the data necessary for its purposes,
• grants access and roles in the Service only to authorized persons and keeps them up to date,
• informs the Operator without delay of data subjects' requests whose fulfillment requires the Operator's involvement.

§ 6. Subprocessors

6.1 General authorization

The Controller gives general authorization for the Operator to engage the subprocessors listed on the Subprocessors page and for changes to that list on the terms set out in section 6.3.

6.2 List

The current list (name, purpose, location, transfer basis) is published at the permanent address worshippro.net/legal/subprocessors and forms part of the Agreement. A change to the list does not require an amendment.

6.3 Changes

• The Operator notifies the Church's owners and administrators by email of any intended addition or replacement of a subprocessor at least 30 days in advance.
• Within 14 days of the notification, the Controller may raise a reasoned objection related to data protection.
• If the parties do not reach an agreement within 30 days, the Controller may stop using the Service and request the return or deletion of the data (§ 12).

6.4 Liability for subprocessors

The Operator imposes on subprocessors data protection obligations no less stringent than those in this Agreement and is liable for their actions as for its own.

§ 7. Transfers outside the EEA

• The Service's server (application, database, files) is located in Poland.
• Transfers outside the EEA take place only with regard to subprocessors marked on the list as operating outside the EEA (e.g. the email delivery provider) and are based on the European Commission's Standard Contractual Clauses (Decision 2021/914) or on the EU-US Data Privacy Framework.
• The Operator will provide a copy of the safeguards on request.

§ 8. Security measures (Art. 32 GDPR)

8.1 Technical measures

• encryption of all communication (HTTPS/TLS),
• passwords stored as a scrypt hash, two-factor authentication (TOTP) available to everyone and required for platform administrators,
• separation of Churches' data in the database at row level (PostgreSQL Row-Level Security),
• roles and permissions within a Church restricting access to data, including finances and special categories of data,
• limiting the number of sign-in attempts and requests (rate limiting),
• an activity log (audit log) of changes to data and permissions,
• a daily backup of the database and files, encrypted before upload and stored off the server in the EU, with regular restore tests.

8.2 Organizational measures

• only the Operator has access to the server and the database,
• the principle of least privilege and a confidentiality obligation for persons with access to the data,
• a procedure for handling personal data breaches.

The measures may be developed further without amending the Agreement, provided they do not lower the level of protection.

§ 9. Personal data breaches

• The Operator notifies the Controller of a discovered personal data breach without undue delay, and no later than 48 hours after discovering it.
• The notification includes, where possible: a description of the breach (categories and approximate number of data subjects and records), contact details, the likely consequences and the measures taken or planned to address it.
• The Operator documents breaches and provides the Controller with the information needed to report the breach to the President of the Personal Data Protection Office (UODO) (the 72-hour deadline rests with the Controller).

§ 10. Assistance with data subjects' rights (Art. 15–22 GDPR)

• The Service gives the Controller tools for fulfilling data subjects' rights: viewing and correcting data in the membership records, exporting a person's data (JSON), anonymizing a person, and a register of GDPR requests.
• If a data subject contacts the Operator directly, the Operator forwards the request to the Controller and does not respond to it on its own (apart from acknowledging receipt and referring the person to the Controller).
• Where necessary, the Operator provides the Controller with technical assistance in time to allow the deadlines under the GDPR to be met.

§ 11. Audit

• The Operator makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR: the list of subprocessors, a description of the security measures and answers to the Controller's questionnaire.
• The Controller may carry out an audit no more than once a year, after notifying the Operator in writing at least 30 days in advance, in a manner that does not disrupt the operation of the Service. The auditor undertakes to maintain confidentiality. The costs of the audit are borne by the Controller.

§ 12. Termination of the Agreement

• After the Church stops using the Service, the Operator — at the Controller's choice communicated to contact@worshippro.net — returns the data (export) or permanently deletes it.
• If the Controller does not communicate its choice within 90 days of the end of the Agreement, the Operator may delete the Church's data.
• The Operator may keep the data longer only where required by law; such data is only stored.
• On request, the Operator confirms the deletion of the data.

§ 13. Liability

The parties are liable for breaches of their obligations under the GDPR and this Agreement in accordance with Art. 82 GDPR. The parties inform each other of claims by data subjects and of proceedings by the supervisory authority concerning the entrusted data.

§ 14. Final provisions

• The Agreement enters into force upon its acceptance when the Church is created (Art. 28(9) GDPR permits electronic form).
• In matters of personal data protection, the DPA takes precedence over the Terms.
• The Operator announces changes to the DPA in accordance with the Terms; a new version may require renewed acceptance by the Church Administrator.
• The Agreement is governed by Polish law; matters not governed by it are subject to the GDPR, the Polish Personal Data Protection Act of 10 May 2018 and the Polish Civil Code. The competent court is the court having jurisdiction over the Operator's registered place of business.

Contact regarding the DPA: contact@worshippro.net · Terms of Service · Privacy Policy · Subprocessors