Accord de traitement des données

1. Parties, roles and scope

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the MasjidBase operating entity (“MasjidBase”, “Processor”) and the organization subscribing to the platform (“Customer”, “Controller”).

For the records the Customer stores in the platform — members, donors, students, guardians, staff, donations, invoices, communications — the Customer is the data controller and MasjidBase is the data processor, acting only on the Customer’s documented instructions. For account, billing, website and marketing data MasjidBase is itself the controller; that processing is described in the Privacy Policy.

This DPA applies for as long as MasjidBase processes personal data on the Customer’s behalf, and survives termination until the data has been returned or deleted under section 9.

2. Instructions

MasjidBase processes personal data only to provide, secure and support the platform under the Terms of Service; as further instructed by the Customer through the platform’s own features, which are the ordinary means of giving instructions; and as required by applicable law, in which case MasjidBase informs the Customer unless legally prohibited from doing so.

MasjidBase will inform the Customer if, in its opinion, an instruction infringes the GDPR or another applicable data-protection provision.

3. Subject matter, duration, nature and purpose

Subject matter: administration of a mosque, Islamic school, charity or waqf — membership, donations and accounting, school enrolment and attendance, communications, and an optional AI assistant.

Duration: the subscription term, plus the retention periods in section 9. Nature: storage, hosting, retrieval, display, transmission by email and SMS, backup, deletion, and — where the Customer enables it — AI-assisted summarisation and drafting. Purpose: providing the platform to the Customer.

Frequency: continuous, for the duration of the subscription.

4. Categories of data subject and personal data

Data subjects: the Customer’s staff and volunteers; members of its congregation or community; donors; students, including children; parents and guardians; suppliers; people who contact the Customer.

Personal data: name and contact details; postal address; date of birth; family relationships; membership status; donation and payment history; invoices and receipts; school records including class, attendance, grades, Quran-memorisation progress and certificates; casework notes the Customer chooses to record; authentication and usage logs; email content where the Customer connects a mailbox.

Special categories: because the platform serves mosques and Islamic schools, records such as membership, donations and religious-education progress can reveal religious beliefs. The Customer processes these as a not-for-profit body with a religious aim under Article 9(2)(d) GDPR, or on another Article 9(2) condition it identifies; MasjidBase processes them only under this DPA and applies the measures in Annex II to them without distinction.

Children’s data: student records concern children, and guardians may submit a child’s details through the Customer’s public registration form. The Customer is responsible for the lawful basis and for guardian consent where required; the platform records that consent with a timestamp and the privacy-policy version presented. MasjidBase does not permit accounts for children, and never uses children’s data for marketing, profiling or advertising.

5. Confidentiality and personnel

MasjidBase ensures that any person authorised to process the Customer’s personal data is bound by confidentiality, is granted access on a least-privilege basis and only where needed to operate or support the service, and has been informed of the sensitivity of the data.

6. Security

MasjidBase implements the technical and organisational measures in Annex II, taking into account the state of the art, the cost of implementation, and the risk to the individuals concerned. Measures may change, but not in a way that materially reduces the overall level of security.

7. Sub-processors

The Customer gives general authorisation for the sub-processors listed at /subprocessors, which forms Annex III of this DPA.

MasjidBase imposes data-protection obligations on each sub-processor that are no less protective than this DPA and remains liable for their performance; keeps the published list current; gives at least 30 days’ notice before adding or replacing a sub-processor; and allows the Customer to object on reasonable data-protection grounds within that period. If an objection cannot be resolved, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees.

8. Assisting the Customer

Data-subject requests: the platform provides self-service tooling for access, portability, erasure, rectification, restriction and objection, so the Customer can answer requests itself. Where a request cannot be answered with those tools, MasjidBase assists on request. MasjidBase does not respond directly to a data subject about Customer data, except to direct them to the Customer.

Personal data breach: MasjidBase notifies the Customer without undue delay and within 72 hours of becoming aware of a breach affecting the Customer’s data, with the information available at the time — nature of the breach, categories and approximate number of records and data subjects, likely consequences, and measures taken or proposed — supplementing it as the investigation progresses.

Impact assessments: MasjidBase provides the information the Customer reasonably needs for a data protection impact assessment or prior consultation, including the assessment it has carried out for the School module.

9. Return and deletion

On termination, and at any time on request, the Customer may export all of its data from the platform in JSON and CSV. MasjidBase then deletes the Customer’s personal data 90 days after the account is closed — automatically, unless the Customer asks for immediate erasure — and from backups within a further 35 days as they roll off.

MasjidBase retains, and the Customer acknowledges it must retain: billing and payment records required by statutory accounting obligations; hashed email-suppression entries, which exist to keep honouring bounce and complaint opt-outs; and a record of the erasure itself, which contains no personal data beyond the acting administrator’s account identifier.

10. Audit

MasjidBase makes available the information necessary to demonstrate compliance with this DPA and allows for audits. In the first instance this is satisfied by the documentation MasjidBase publishes — the measures in Annex II, the sub-processor list, and the certifications its infrastructure providers hold. Where that is insufficient for a specific, documented concern, the Customer may request further information or an audit, on reasonable notice, not more than once a year except after a breach, at the Customer’s cost and subject to confidentiality.

11. International transfers

MasjidBase processes personal data in the United States. For personal data of individuals in the EEA, the United Kingdom or Switzerland, transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses, together with supplementary measures including encryption in transit and at rest, application-layer encryption of stored credentials, and data minimisation in the AI path. The Customer may request a copy of the relevant safeguards.

Where the Clauses apply: Annex I is populated by sections 3 and 4 of this DPA, Annex II by Annex II below, and Annex III by the published sub-processor list.

Annex II — Technical and organisational measures

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256). Tenant mailbox credentials encrypted with AES-256-GCM under a platform key held only in the functions runtime; API keys stored as hashes; rate-limit subjects hashed before storage.

Tenant isolation enforced by server-side Security Rules on every read and write, with privileged server actions re-checking live membership rather than trusting a token claim. Role-based access within each organization; TOTP two-factor authentication available and enforceable per organization; platform administration gated on a separate claim.

Pseudonymisation of personal identifiers in financial records retained after an erasure, and of audit-trail snapshots, which record changed field names rather than values. Per-organization audit trail of privileged and record-changing actions; email addresses masked in operational logs; log retention set explicitly.

Point-in-time recovery and daily backups with a documented restore drill. Scheduled enforcement of published retention periods, including automatic erasure of closed organizations and expiry of export archives. Type-checked codebase with automated tests, including Security Rules tests, and code review before release. Written incident-response runbook with a named owner and a 72-hour notification clock.

12. Order of precedence

In case of conflict, this DPA prevails over the Terms of Service on matters of data protection. Where the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.