Data processing addendum

Version 2026-10-25, effective 25 October 2026

Related: Terms · Privacy · Sub-processors · Cookies · Security

Scope and parties

This addendum forms part of the terms between the church (the “controller”) and Candensa (“Folio”, the “processor”) and applies to personal data that Folio processes on the church’s behalf. It applies whenever the church accepts the terms; no separate signature is needed. If a church needs a signed copy, write to [email protected]. It covers the UK GDPR and Data Protection Act 2018, the EU GDPR, the Nigeria Data Protection Act 2023, the Kenya Data Protection Act 2019 and, for United States state laws, the processor (“service provider”) terms they require. “Data protection law” means whichever of these applies.

It does not cover data for which Folio is the controller (staff account, billing, security records and website visitors). The privacy policy covers those.

Details of the processing

Subject and nature	Hosting, storing, transcribing, indexing, analysing and displaying the church’s teachings, drafting notes and answers, delivering email, text and push messages, and supporting the church.
Purpose	To provide the service the church ordered, and nothing else.
Duration	The life of the account, then as in the section on return and deletion.
People	Church staff and volunteers, members, email and phone subscribers, visitors who ask a question or use the widget, people who ask to speak with a pastor, speakers and people named or heard in recordings, and people in a care alert.
Data	Names, email addresses, phone numbers, voice recordings and transcripts, questions and conversations, saved member facts, consent records with network address and browser details, care alert text and notes, roles and activity records.
Sensitive data	Teaching and questions can reveal religious belief, health, family, sexuality, abuse or other sensitive matters, and may include children’s data. The church chooses what it uploads. The processing is the same for all content, with the safeguards below.

Instructions and roles

We process the data only on the church’s documented instructions, which are the terms, this addendum, and the settings and actions the church takes in the app or API. We tell the church if we think an instruction breaks data protection law. We process for our own purposes only as the law requires and we do not sell or share the data, or combine it with other data, except as the service needs. The church confirms it has a lawful basis and has given the notices needed, including to members and to parents or guardians where a child’s data is involved. A partner acting for a church does so on that church’s instructions.

Everyone at Folio who can access the data is bound by confidentiality. Platform administrators see counts and statuses. They reach content only through a time-limited support grant the church owner gives, and each use is recorded.

Security measures

Separation of churches: every request carries a church identity and the database enforces it row by row.
Encryption in transit with TLS. Sensitive fields (care alert text and notes, saved member facts, connected-source credentials, authenticator secrets, webhook secrets) are encrypted before they are stored. Backups are encrypted. [OWNER TO CONFIRM disk-level encryption of the database and file storage]
Passwords stored hashed and checked against known breaches; API keys and recovery codes stored hashed; two-step verification, passkeys and a recent second factor for sensitive actions; session limits of 7 days idle and 30 days in total; sign-in rate limiting.
Least privilege roles and scoped API keys; every support access, key use and sensitive read is logged.
Logs carry request identifiers and are kept 14 days. Secrets are redacted from logs.
Backups with point-in-time recovery, off-site copies and restore drills. Host hardening, firewalls, automatic security updates and monitored alerts.
Vendor review before use; contracts that require confidentiality and security.

Sub-processors

The church gives general authorisation for the providers on the sub-processors page. We bind each to data protection terms no less protective than these and remain responsible for them. We give at least 30 days’ notice of a new or replaced sub-processor by email to church owners and on that page. A church can object on reasonable data protection grounds within that time. If we cannot resolve it, the church may end the service and receive a refund of prepaid fees for the remaining period.

International transfers

Our servers are in Germany and some sub-processors process data in the United States and elsewhere. For transfers of personal data from the UK, the EEA, Nigeria or Kenya to a country without an adequacy finding, the parties agree to the standard contractual clauses (Module Two, controller to processor, and Module Three where a church is itself a processor) and the UK International Data Transfer Addendum, incorporated by reference, with the details on this page and the sub-processors page as their annexes. For Nigeria and Kenya the parties rely on those clauses as appropriate safeguards or on any mechanism the regulator recognises. [COUNSEL TO CONFIRM mechanism and governing law for each region]

Helping with requests

If a person asks us to use a right over church data, we pass it on to the church promptly and do not answer it ourselves unless the church tells us to. The church can do most things itself:

delete conversations and set how long conversations, recordings, captions, audience events and care alerts are kept;
export or erase an email subscriber’s record, and remove a subscriber from lists;
export the church’s data as an archive;
members can edit, forget or clear their saved Ask memory themselves.

For anything the app does not cover, we help on request within a reasonable time and may charge for unusual effort. We also assist, at the church’s cost where the effort is unusual, with data protection impact assessments and with consulting a regulator.

Personal data breaches

We notify the church’s owner without undue delay, and where feasible within 72 hours, after we become aware of a breach of security that affects the church’s personal data. The notice describes what we know: the nature, the data and people affected, likely consequences, and what we are doing. We help the church meet its own notification duties. The church decides whether to notify regulators and people.

Return and deletion

At the end of the service the church can export its data (one archive every 24 hours, available 7 days). The church can schedule deletion at any time. We begin deleting 14 days after it is scheduled and delete the church’s files, recordings, search index, conversations, memberships and records. A church that stops paying stays read-only and its data stays until the owner asks us to delete it.

Encrypted backups roll off over time, in up to about 12 months. They are not used to restore a deleted church into live use without deleting it again. We keep what the law requires us to keep, such as billing records, and tell the church what.

Audit and information

We give the church what it reasonably needs to show we comply with this addendum, including a summary of our security measures and answers to a reasonable questionnaire once a year. If that is not enough, or a regulator requires it, we allow an audit by the church or an auditor bound by confidentiality, on 30 days’ notice, during business hours, no more than once a year unless there has been a breach, without access to other churches’ data, and at the church’s cost.

Liability, term and precedence

Liability under this addendum is subject to the limits in the terms, except where the law or the standard contractual clauses say otherwise. The addendum lasts as long as we process the data. If it conflicts with the terms on data protection, it prevails; the standard contractual clauses prevail over both. Contact: [PRIVACY LEAD OR DPO NAME], [email protected].