Data processing agreement

1. What this covers

Biblori provides the parishes and the chancery of the Diocese with software for parish offices: the parish's copy of its sacramental registers, certificates, formation, marriage preparation, Mass intentions, the parish website and the tools of the chancery (the Service). In providing it, Biblori processes personal data on the instructions of the Diocese and its parishes. This agreement sets out how.

2. Roles

• Each parish is the custodian of its registers and decides what is kept in them. The bound books remain the parish's official record; what is kept in Biblori is the parish's copy.
• The Diocese and its parishes decide why and how the personal data is processed. Biblori processes it only to provide the Service, on their documented instructions, which are this agreement, the Terms of Service and what their staff do in the Service.
• Biblori does not use the data for any other purpose: no advertising, no profiling, no selling or sharing, and no training of models.

3. The data

People concerned

Parishioners and the people named in register entries (including children, parents, godparents, sponsors, witnesses, ministers); families in formation and couples preparing for marriage; parish and chancery staff who use the Service.

Kinds of data

Names, dates and places of birth and of sacraments, family relationships, contact details, notes kept by the parish, photographs of register pages (when the scanner is used), documents families upload, and account and audit data for staff.

Special categories

Sacramental records reveal religious affiliation; many concern children. Both are handled as needing greater care throughout.

Duration

For as long as the agreement runs, then as section 9 says.

4. Confidentiality and access

• Only people the parish or the Diocese has given access to can see its data. The database enforces this on every query (row-level security), not only the application.
• Biblori staff access customer data only to answer a support request or investigate an incident. Every administrative action is written to an audit log the Diocese can read.
• Everyone at Biblori with access is bound to confidentiality.

5. Security

Biblori maintains the measures described on biblori.com/security, including:

• encryption in transit and at rest;
• two-step sign-in, which the Diocese can require of all its parishes' staff, enforced by the database as well as the application;
• register entries that cannot be silently changed: notations and amendments are append-only, and an entry is never hard-deleted;
• daily backups by the infrastructure provider;
• full photographs of register pages visible only to staff who can write records, and deleted when nobody files from them.
• Biblori may improve these measures but will not reduce them during the agreement.

6. Subprocessors

Biblori uses the subprocessors listed in its privacy notice (biblori.com/privacy), for the purposes stated there. Biblori will tell the Diocese's administrators by email at least 30 days before adding or replacing one; the Diocese may object on reasonable grounds, and if the objection can't be resolved it may end the agreement without penalty. Biblori binds each subprocessor to data protection terms no less protective than these, and remains responsible for them.

7. Breaches

If Biblori becomes aware of a breach of security affecting the Diocese's or its parishes' personal data, it will:

• notify the Diocese's administrators without undue delay, and in any case within 72 hours of becoming aware of it;
• say what happened, what data and people are likely affected, what it has done and what it recommends;
• keep the Diocese informed until it is resolved, and help it meet any duty to notify authorities or the people affected.

8. Requests from individuals

A person asking about their own entry should go to their parish, which holds the canonical record. Biblori will pass on any request it receives directly and help the parish answer it, including by export.

9. The end of the agreement

• Each parish can export everything it keeps in Biblori, at any time and for at least 90 days after the agreement ends, as one file (the register as CSV and as a printable book, people, formation, marriage files, certificates and documents).
• Registers and certificates are never withheld over an unpaid invoice, during the agreement or after it.
• After those 90 days, Biblori deletes the data on the Diocese's written instruction, except where a parish asks to continue on its own, and except backups, which expire on their normal cycle. Because registers carry canonical retention duties, Biblori never deletes a register on its own initiative.

10. Audits

On reasonable notice, and no more than once a year unless there has been a breach, Biblori will answer the Diocese's written security questionnaire and provide its infrastructure providers' independent audit reports.

11. Order of precedence

If this agreement and the Terms of Service disagree about personal data, this agreement prevails.