Data Processing Agreement.

1. Parties and roles

There are two roles in this agreement, and they carry different duties under data-protection law (GDPR, CCPA, and PIPEDA).

Each parish using Symphonia is the data controller (GDPR Article 4(7)): it determines the purposes and means of processing the personal data belonging to its parishioners and staff.

Ancient Designs LLC, the operator of the Symphonia software, is the data processor (GDPR Article 4(8)). In this agreement it is referred to as "we", "us", or "the processor", and it processes parish personal data strictly on the parish's documented instructions, as captured by the Symphonia subscription agreement and this document.

2. Scope of processing

We process parishioner personal data for the sole purpose of operating Symphonia on the parish's behalf. This includes storing member records, household structure, sacramental records, giving history, communications, holy bread and commemoration submissions, inbox messages, audit logs, and access logs. We do not mine the data for advertising, share it for another party's marketing, or train AI or machine-learning models on it. Optional AI helpers, where a parish turns them on, run on the processor's own server.

Categories of personal data processed:

• Identity (name, saint name, baptismal name).
• Contact (email, phone, mailing address).
• Household structure and family relationships.
• Sacramental records (a special category under GDPR Article 9, as religious data).
• Giving and pledge records (financial data).
• Pastoral notes (clergy-only; encrypted at rest per section 7).
• Communications metadata and delivery state.
• Authentication factors (password hashes, second-factor records, push tokens).
• Usage records for signed-in users (pages opened, IP address, browser), kept for 180 days.
• Social media posts the parish publishes, and the connections to its own social media accounts (access keys are encrypted).

Categories of data subject: parishioners, clergy, parish staff, parish council members, and visitors who submit a form on the parish website.

3. Sub-processors

We engage sub-processors to deliver the service. The complete list, including what each one receives and which are used only when a parish turns a feature on, is published on our sub-processors page, which forms part of this agreement. We update that page at least thirty days before adding or replacing a sub-processor that handles parish personal data, so a parish can object. The sub-processors used for every parish are:

Used only when a parish connects its social media accounts: Meta Platforms, Inc. (USA), for Facebook, Instagram and Threads, and Bluesky Social, PBC (USA), for Bluesky. Each receives only the posts the parish chooses to publish and an access key for the parish’s own account. These and every other optional service are listed on the sub-processors page.

4. Our obligations

As processor, we commit to:

• Process personal data only on the parish's documented instructions (this agreement).
• Ensure everyone with access is bound by confidentiality.
• Implement appropriate technical and organisational measures (section 7).
• Help the parish meet its own obligations under GDPR Articles 32 to 36 (security, breach, impact assessment, prior consultation).
• Support data subject rights (access, rectification, erasure, portability); most are already self-service in the member app.
• Delete or return all personal data at the end of the service contract, at the parish's choice.
• Make available the information needed to demonstrate compliance, and allow for reasonable audits.

5. Parish obligations

The parish, as controller, commits to:

• Have a lawful basis for the personal data it puts into Symphonia.
• Inform its parishioners about the processing (this agreement is referenced from the parish's privacy notice, and from our own Privacy Policy).
• Capture appropriate consents where required (built into Symphonia's registration and preference flows).
• Restrict staff access to those who need it, and assign roles appropriately (rector, staff, treasurer, and so on).

6. Data subject rights

Parishioners exercise their rights through Symphonia's self-service surfaces:

• Access and portability: download a copy of their record, in a portable format.
• Rectification: correct contact and family details directly.
• Erasure: request deletion of the record.
• Restriction and objection: set communication preferences, per channel.

We do not respond directly to a rights request received outside these surfaces; we forward it to the parish (controller) without undue delay. The deletion flow respects two carve-outs, both explained to the parishioner at the moment of deletion: sacramental records (canonical history) and giving records (tax retention).

7. Security measures

Technical and organisational measures we maintain:

• Transport encryption: HTTPS only (TLS 1.2 or 1.3), with HSTS enforced.
• Logical isolation in a shared PostgreSQL database: every parish-scoped row carries its parish, every request is scoped to one parish, and row-level security enforces that scope on core personal-data tables.
• Application-layer AES-256-GCM encryption of sensitive fields (contact details, sacramental notes, pastoral notes), with per-parish keys and per-priest keys for pastoral notes, derived from a root key protected by AWS KMS. The processor holds these keys.
• Backups encrypted with AES-256 before they leave the server; object storage encrypted at rest by the provider.
• Password hashing with bcrypt, and an emailed one-time code as a second factor at staff sign-in.
• Role-based access control with capability-level gating. Deleted records go to a restorable trash, and parishes and people cannot be hard-deleted.
• A hash-chained, append-only audit log of administrative actions, including every staff support session.
• Least-privilege support: during a staff sign-in-as session the studio refuses changes and hides confession and sealed pastoral content. Operator access through our own tools is limited to staff roles.
• Weekly automated dependency and code scanning, and automated alerts on mass data exports and repeated failed sign-ins.
• Nightly encrypted backups with an automated weekly restore test, and a written disaster-recovery plan.

8. Breach notification

In the event of a personal-data breach, we will notify the parish without undue delay and in any event no later than 72 hours after becoming aware. The notification will describe the categories of data and approximate number of records affected, the likely consequences, and the measures taken or proposed.

Automated alerts fire when audit-log heuristics indicate a mass data export or a sustained attack on the sign-in surface. A parish can request a Data Protection Impact Assessment template through our contact page.

9. International transfers

Personal data is stored and processed in the United States. The application and database server is in Los Angeles, California, provided by Ethernet Servers Ltd (United Kingdom), and backups and uploaded files are kept in Cloudflare R2. Each sub-processor’s location is listed on the sub-processors page.

Where a parish is subject to a law that restricts transfers of personal data to the United States, such as the GDPR or the UK GDPR, the parish should write to us before transferring data, and we will agree an appropriate transfer mechanism, such as the EU Standard Contractual Clauses.

10. Term and termination

This agreement is effective for the duration of the parish's Symphonia subscription and ends with it. On termination, we will, at the parish's choice, return or securely delete all personal data within thirty days, except where retention is required by law.

11. Signing this agreement

For most parishes this agreement is incorporated by reference into the Symphonia subscription agreement, and no separate signature is required. If your parish's supervisory authority requires a counter-signed copy, write to legal@ancientdesigns.org with the parish name and address, and we will return a counter-signed copy within five business days.

Questions about this agreement are answered within one business day. Write to us. Version 2.0, last reviewed 5 October 2026. The processor is Ancient Designs LLC, the operator of Symphonia.