1. Parties and scope
This Data Processing Agreement forms part of the My12 Terms of Service. It applies where My12 processes personal data on behalf of a church or organisation customer.
The customer is the controller and My12 is the processor for customer-controlled church data, except where My12 acts as controller for billing, support, security, and business administration.
2. Processing instructions
My12 will process customer personal data only to provide and secure the service, follow documented customer instructions, comply with law, or as otherwise permitted by the Terms and this DPA.
3. Subject matter and duration
- Subject matter: church care, attendance, group, leader, campus, prayer, feedback, communication, reporting, and related administration.
- Duration: while the customer uses My12 and for any deletion, backup, legal, security, or audit period after termination.
4. Categories of data subjects
- Church members, attenders, visitors, leaders, volunteers, staff, campus leaders, group leaders, administrators, support contacts, and other people recorded by the customer.
5. Categories of personal data
- Names, email addresses, phone numbers, birthdays, gender, group/campus assignments, attendance, care notes, prayer requests, praise reports, pastoral concerns, tags, leader feedback, communication acknowledgements, and system metadata.
- Depending on customer use, data may reveal religious beliefs, health, family circumstances, safeguarding concerns, or other sensitive matters.
6. My12 processor obligations
- Use appropriate technical and organisational security measures.
- Limit personnel access to those who need it for service, support, security, or legal reasons.
- Ensure personnel with access are under confidentiality obligations.
- Assist the customer with data subject requests, security incidents, DPIAs, and regulator enquiries where reasonably possible.
- Notify the customer without undue delay after becoming aware of a personal data breach affecting customer data.
7. Sub-processors
The customer authorises My12 to use sub-processors needed to provide the service. My12 remains responsible for sub-processor performance to the extent required by data protection law.
The current list is available at /subprocessors.
8. International transfers
Where processing involves international transfers, My12 will rely on appropriate transfer safeguards where required by applicable data protection law.
9. Deletion and return
On termination or deletion request, My12 will delete or anonymise customer personal data unless retention is required for legal, billing, security, backup, or dispute reasons. Organisation owners can export organisation data in a machine-readable JSON format from the admin portal.
10. Audit and information
My12 will provide reasonable information needed to demonstrate compliance with this DPA. Audits must be reasonable, proportionate, scheduled in advance, and must not compromise the security or confidentiality of other customers.
11. Customer obligations
- The customer must have a lawful basis for processing personal data in My12.
- The customer must provide privacy information to its people where required.
- The customer must configure access carefully and remove users who no longer need access.
- The customer must not enter unnecessary sensitive data or use My12 as the only system for emergencies or safeguarding escalation.