Data Processing Addendum

Effective · May 1, 2026

1. Definitions

In this Data Processing Agreement (“DPA”), the following terms have the meanings set forth below:

• Controller — The church or organization using Church Gains that determines the purposes and means of processing personal data.
• Processor — ChurchGains LLC (a DBA of Gaines Pro Holdings LLC - Series Church Gains), which processes personal data on behalf of the Controller.
• Personal Data— Any information relating to an identified or identifiable individual (a “Data Subject”), including names, contact information, attendance records, group memberships, giving records, and custom fields.
• Processing — Any operation performed on personal data, including collection, recording, storage, use, analysis, transmission, deletion, or any combination thereof.
• Sub-Processor — A third party engaged by the Processor to process personal data on behalf of the Controller.
• Data Subject — The individual to whom personal data relates.

2. Scope and Purpose

The Processor processes personal data solely to provide Church Gains services to the Controller, including:

• Real-time analytics and reporting on church membership and participation
• Form digitization and member data collection
• AI-powered queries and insights
• Member communication and group management

The categories of personal data processed include:

• Names and contact information (email addresses, phone numbers, physical addresses)
• Attendance records and participation history
• Group memberships and affiliations
• Giving records and financial contributions
• Custom fields created by the Controller

The Processor shall not process personal data for any purpose other than to provide the Church Gains service or as otherwise directed in writing by the Controller.

3. Processor Obligations

The Processor agrees to:

• Documented Instructions — Process personal data only on documented instructions from the Controller, including regarding transfers of personal data.
• Confidentiality — Ensure that any person authorized to process personal data has committed to confidentiality or is under an appropriate legal obligation of confidentiality.
• Security Measures — Implement appropriate technical and organizational measures to protect personal data, including encryption at rest and in transit, role-based access controls, audit logging, and tenant isolation.
• Data Subject Requests — Assist the Controller in fulfilling Data Subject rights requests (access, rectification, erasure, portability) within 10 business days where technically feasible.
• Breach Notification — Notify the Controller of any breach of personal data without undue delay and in no case later than 48 hours of becoming aware of the breach.
• International Transfers — Only transfer personal data to Sub-Processors that are approved by the Controller and agree to equivalent data protection obligations.

4. Sub-Processors

The Processor engages the following Sub-Processors to process personal data on behalf of the Controller:

• Anthropic — For AI-powered analysis and query processing
• Supabase — For database storage and management
• Vercel — For application hosting and deployment
• Stripe — For payment processing and billing
• Resend — For transactional email delivery

By executing a service agreement with the Processor, the Controller consents to the engagement of these Sub-Processors. The Processor shall provide the Controller with at least 30 days' notice prior to adding or replacing any Sub-Processor, during which the Controller may object to the engagement of the new Sub-Processor on reasonable grounds. If the Controller objects, the Controller may terminate the affected portion of the service agreement without penalty.

5. Data Transfers

All processing of personal data under this DPA occurs within the United States. The Controller acknowledges that Church Gains is a United States-based service and that personal data will be stored and processed in the United States.

If personal data is transferred to Sub-Processors located outside the United States, the Processor shall ensure that appropriate safeguards are in place, including Standard Contractual Clauses or other mechanisms approved under applicable data protection law.

6. Security Measures

The Processor implements the following security measures to protect personal data:

• Encryption at Rest — Personal data is encrypted using AES-256 or equivalent encryption standards when stored.
• Encryption in Transit — All data transmitted is protected using TLS 1.2 or higher.
• Tenant Isolation — Each church's data is logically isolated and separated from other churches' data.
• Audit Logging — All access to personal data is logged for security and compliance purposes.
• Token Storage — API tokens and credentials are stored server-side only and never transmitted to or stored on client devices.
• Access Controls — Role-based access controls limit who can view, modify, or delete personal data.
• Security Reviews — The Processor conducts regular security reviews and updates to address emerging threats.

7. Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures in fulfilling the Data Subject's rights, including:

• Right to access personal data
• Right to rectify inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability

The Processor shall respond to such requests within 10 business days where technically feasible. The Controller is responsible for verifying the identity of the Data Subject before the Processor provides access to personal data.

8. Breach Notification

In the event of a personal data breach, the Processor shall notify the Controller without undue delay and in no case later than 48 hours of becoming aware of the breach. The notification shall include:

• The nature and scope of the breach
• The categories of Data Subjects affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate harm

The Processor shall cooperate fully with the Controller to investigate the breach and comply with all applicable legal obligations regarding breach notification.

9. Audit Rights

The Controller may, at its own expense, request documentation of the Processor's security practices or conduct an audit of the Processor's compliance with this DPA. The Processor shall provide documentation of its security practices upon reasonable request. The Processor plans to pursue SOC 2 Type II certification as the business matures. Any audit conducted by the Controller shall be:

• Conducted no more than once per calendar year
• Preceded by at least 30 days' written notice
• Conducted during business hours
• Conducted in a manner that minimizes disruption to the Processor's operations

The Controller shall maintain the confidentiality of any audit findings and shall not disclose audit results to third parties except as required by law.

10. Data Return and Deletion

Upon termination or expiration of the service agreement, the Processor shall, at the Controller's election:

• Return all personal data to the Controller in a structured, commonly used, machine-readable format, or
• Delete all personal data

All personal data shall be deleted or returned within 30 days of termination unless applicable law requires retention of the personal data. The Processor shall provide written certification of deletion upon request.

11. Duration and Termination

This DPA commences on the date the service agreement is executed and continues co-terminously with the service agreement. This DPA shall survive termination of the service agreement until all personal data has been deleted or returned to the Controller in accordance with Section 10.

12. Liability

The Processor shall be liable for damages caused by its processing of personal data in violation of this DPA or in violation of processor obligations under the General Data Protection Regulation (GDPR) or other applicable data protection law. The liability limitations in the service agreement shall not apply to the Processor's obligations under this DPA.

13. Governing Law

This Data Processing Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of law principles.

14. Contact Information

For questions about this Data Processing Agreement, please contact:

• Legal Inquiries: legal@churchgains.com
• Privacy Inquiries: privacy@churchgains.com