DRAFT FOR REVIEW
Data processing addendum
This draft is for product planning and is not legal advice or a final agreement. It must be reviewed and completed before public registration opens.
Roles
Each church is the data controller for the personal information about its members, visitors, and team that it adds to its workspace. Kingdom Comms is the data processor and processes that information only to provide the workspace, following the church’s instructions.
Law
This addendum is written with the Nigeria Data Protection Act 2023 (NDPA) in mind. The final version must be reviewed against the NDPA and any guidance from the Nigeria Data Protection Commission.
What is processed
Names, contact details, birthdays, group and unit membership, event registrations, attendance responses, and notification preferences, as entered by the church or its members.
Subprocessors
Kingdom Comms uses service providers to run the platform, including hosting and databases, file storage, sign-in and push notifications, email delivery, payments, and error tracking. The final addendum must list each provider, its purpose, and the region where data is stored.
Security
Access to a workspace is limited to its own administrators and members. The final addendum must describe the security measures in place and how security incidents are reported to the church.
Requests from individuals
A church’s administrators can permanently delete a member’s profile on request. The final addendum must describe how Kingdom Comms helps a church answer access, correction, and deletion requests.
End of service
The final addendum must state how a church can export its data and how long data is kept after a workspace is closed.