Adendum Pemrosesan Data

Effective date: {{EFFECTIVE_DATE}}

In short

Your mosque decides what personal data it keeps in My Mosque and why. We store and process that data only to run the Service for you, only on your instructions, and we keep it secure. We use a short list of trusted subprocessors, tell you about changes, help you answer people's requests, tell you about a breach within 72 hours, and delete or return your data when you leave.

1. Parties

• Controller: the mosque, group of mosques or organisation that uses My Mosque (the "Mosque").
• Processor: {{OPERATOR_NAME}}, {{OPERATOR_ADDRESS}}, {{OPERATOR_COUNTRY}} ("we").

This DPA is part of the Terms of Service. It applies automatically when a Mosque creates its space on My Mosque. It meets Article 28 of the GDPR and UK GDPR, and similar rules in other countries. If this DPA conflicts with the Terms, this DPA wins on data protection.

2. Subject matter and duration

• Subject matter: providing the My Mosque service: storing, syncing, displaying, reporting on, backing up and securing the Mosque's data.
• Duration: as long as the Mosque uses the Service, plus the time needed to delete or return data (section 11).

3. Nature and purpose of processing

Storage, organisation, retrieval, sync between devices, display to authorised people, calculation of balances and reports, creation of receipts and PDF or Excel files, notifications, backup, security monitoring, support at the Mosque's request, and deletion.

4. Categories of data subjects

• Members and former members, and people applying to join
• Family members the Mosque records (which may include children, with guardian consent)
• Officers and committee members (admins)
• Staff (Imam, Muezzin, Khadim, teachers and others)
• Donors, including anonymous donors where recorded
• Vendors and contacts
• Staff of a group of mosques the Mosque belongs to

5. Categories of personal data

• Identity and contact: name, email, phone, address, date of birth, photo, profile code, member number
• Registration papers: copies of ID card, passport, driving licence, proof of address; signatures; Gift Aid declarations; SEPA direct debit mandates (bank account details)
• Financial: donations, zakat, fitrah, dues, "I paid" reports, receipts, expenses, salaries and payslips, petty cash, bank accounts and reconciliation records
• Governance: meeting attendance, minutes, nominations, election and motion results (individual ballots are secret)
• Community: announcements, events, questions and answers, documents
• Technical: account IDs, audit log of actions (who, when, what)

Special category: membership of a mosque may reveal religious belief. The Mosque confirms it has a lawful basis for this (for example GDPR Art. 9(2)(d) for not-for-profit religious bodies with their members, or explicit consent).

6. Our obligations

We will:

1. Process the Mosque's data only on its documented instructions. The Mosque's instructions are these terms and the Mosque's settings and actions in the app. If we think an instruction breaks data protection law, we will tell the Mosque.
2. Not use the data for our own purposes. No advertising, no profiling, no selling.
3. Make sure everyone who processes the data for us is bound by confidentiality.
4. Apply the security measures in section 8.
5. Use subprocessors only as in section 7.
6. Help the Mosque answer data subject requests (section 10).
7. Help the Mosque with security, breach notices, impact assessments and consultations with authorities, as far as the information we hold allows.
8. Delete or return data at the end (section 11).
9. Give the Mosque the information it needs to show compliance, and allow audits (section 12).
10. Tell the Mosque about any legal request for its data, unless the law forbids it. We will challenge requests that are not lawful.

7. Subprocessors

The Mosque gives general permission for us to use these subprocessors:

Stripe and Google Sign-In process data for us as controller (billing and sign-in), not for the Mosque.

• We bind each subprocessor to data protection terms at least as protective as this DPA.
• We will give at least 30 days' notice of a new subprocessor (in the app, by email to the Mosque's main contact, or on {{WEBSITE}}). The Mosque may object on reasonable data protection grounds. If we cannot solve it, the Mosque may cancel and get a refund of prepaid fees for the unused period.
• We remain responsible for our subprocessors.

8. Security measures

• Encryption in transit: all traffic uses TLS.
• Encryption at rest: the cloud database and file storage are encrypted.
• Row-level security: every table is protected per mosque and per role on the server (Postgres row-level security). The app cannot override it.
• Least privilege: server functions run with only the rights they need; internal helpers cannot be called through the API; nothing can be called without signing in.
• Append-only ledger: posted financial entries cannot be edited or deleted; corrections are reversal entries with an approval by a second officer.
• Append-only audit log: who did what and when; written only by the server.
• Restricted ID papers: seen only by the member and officers who approve members; each officer view is logged.
• Private file storage: short-lived links, 20 MB limit, allowed types only.
• Passcode lock: required for people who run a mosque; kept only on the device; five wrong tries signs out and wipes the device's copy.
• Encrypted on-device database: SQLCipher on Android with the key in the Android Keystore (CHECK iOS, web and Windows); sign-in tokens in encrypted storage; no device backup or transfer; sign-out wipes local data.
• Separation of duties: maker/checker approvals for expenses, payroll, corrections and month close.
• Secure development: secrets kept out of code; secret scanning, dependency checks and security scans before releases.
• Backups: managed by Supabase (CHECK backup frequency and retention).

We may improve these measures over time, but we will not reduce the overall level of protection.

9. Personal data breaches

If we become aware of a personal data breach affecting the Mosque's data, we will tell the Mosque without undue delay and in any case within 72 hours. We will say what happened, what data and people are affected, the likely effects, and what we are doing about it. We will update the Mosque as we learn more and help it notify authorities and people where required.

10. Help with data subject requests

If a person contacts us directly about the Mosque's data, we will pass the request to the Mosque (unless they ask us not to share their contact) and will not answer it ourselves unless the Mosque asks us to. The app gives the Mosque tools to see, correct, export and delete data. Where those tools are not enough, we will help on request.

11. Deletion and return of data

• The Mosque can export its records (reports, PDF and Excel) at any time.
• When the Mosque closes its space, it may ask us to return its data in a common format. We then delete it within 90 days (CHECK), and from backups on their normal cycle, unless the law requires us to keep it.
• Data inside the Mosque's books that the Mosque must keep by law (for example financial records) is the Mosque's responsibility to export before closing.

12. Audits

We will provide the information reasonably needed to show we meet this DPA, such as security summaries and our subprocessors' certifications (for example Supabase's SOC 2 report, where available). If that is not enough, the Mosque (or an independent auditor it chooses, bound by confidentiality) may audit us once a year, with 30 days' notice, during business hours, at its own cost. Authorities may audit us as the law allows.

13. International transfers

Service data is stored in the EU. Where a subprocessor processes data outside the EU, EEA or UK, we use an adequacy decision or the European Commission's Standard Contractual Clauses (Module 3, processor to processor, and the UK Addendum where relevant), with extra safeguards where needed. Where the Mosque is outside the EU and its law requires a transfer contract, these terms and the Standard Contractual Clauses (Module 4 or as needed) serve as that contract (CHECK for Türkiye, Saudi Arabia and other countries with specific transfer forms).

14. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow limits.

15. Contact

Privacy and Data Protection Officer: {{PRIVACY_EMAIL}} {{OPERATOR_NAME}}, {{OPERATOR_ADDRESS}}, {{OPERATOR_COUNTRY}}