ReachThem data processing terms for organisations (Draft)

1. What these terms are

1.1 These terms are between SILOAM DESIGN LIMITED ("ReachThem", "we") and the organisation that uses ReachThem (the "organisation", "you"). They form part of ReachThem's terms of service for every organisation. An Owner of a church that uses membership or the church home also accepts them in the app on the organisation's behalf, and we record that acceptance.

1.2 They meet Article 28(3) of the UK GDPR for the personal data we process for you. If they conflict with the terms of service about personal data, these terms win.

2. Who decides what

2.1 You are the controller of the personal data your organisation decides to collect and use in ReachThem, and we are your processor for it. That includes: membership requests, approvals and visitors; the member directory; contacts and their conversations; notices and the church home; the podcast feed; teams, rotas, events and chats; youth groups, their leaders and the young people in them; parents' and carers' consent records; DBS records your Safeguarding Officers keep; officers' readings, concerns, holds and exports.

2.2 We are a controller ourselves for what we decide for every organisation on the service, and these terms do not cover it: accounts and sign-in; the date-of-birth question, the age state and the protections for people under 18 that follow a person across every organisation; refusing and closing under-13 accounts; approving organisations for youth work; suspending or closing accounts; handling reports and complaints made to us; preserving and reporting child sexual exploitation and abuse content to the National Crime Agency (Online Safety Act 2023 s.66); security, logs and our own legal records. Our privacy policy explains that processing.

2.3 Kept records in chats with young people. We keep the earlier wording of edited or deleted messages in chats with a young person, and messages sent to young people outside chats, for your Safeguarding Officers. Whether that makes us joint controllers with you is being confirmed with legal advice (to be confirmed); until then we treat it as processing for you, with our own obligations under the Online Safety Act.

3. What we do with your organisation's data

3.1 We process it only on your documented instructions. Your instructions are these terms, the terms of service, and what your people do with ReachThem's features and settings (for example approving a member, publishing a notice, or turning on the directory). If we believe an instruction breaks data protection law we will tell you.

3.2 We may process it without your instruction only where the law requires us to (for example a court order, or our duty to report child sexual exploitation and abuse content). We will tell you first unless the law forbids it or telling you would put someone at risk.

4. Our obligations as your processor

4.1 Confidentiality. Everyone we allow to process your data is bound by confidentiality.

4.2 Security. We take the measures in Schedule 2, appropriate to the risk, which includes special category data (church membership can reveal religious belief) and children's data.

4.3 Sub-processors. You give us general authorisation to use the sub-processors in Schedule 3. We will tell your Owners at least 30 days before adding or replacing one; if you object on reasonable data protection grounds and we cannot resolve it, you may stop using the affected features or close your organisation. We impose the same data protection obligations on each sub-processor and remain responsible for them.

4.4 People's rights. We help you answer requests from people to see, correct, delete, restrict or move their data, or to object, mainly through ReachThem's features. If a request about your data reaches us, we pass it to your Owners within 5 working days and do not answer it ourselves unless it is also about data we control.

4.5 Breaches. We tell your Owners without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we are doing, and we help you meet your own duties to tell the Information Commission (ICO) and the people affected.

4.6 Assessments and the regulator. We give you the information you reasonably need for a data protection impact assessment or a consultation with the ICO about your use of ReachThem.

4.7 At the end. When your organisation is closed, you can export your data first. We then delete or anonymise your data within 90 days, except records we must keep as a controller (clause 2.2), records under a Safeguarding Officer's hold or one of our own holds, and copies in backups, which expire on their normal cycle and are never restored for use.

4.8 Information and audits. We make available the information needed to show we meet these terms, and allow reasonable audits: first by written questions and documents, then, if still needed, an inspection by you or an auditor you choose, on 30 days' notice, at most once a year unless the ICO requires more, at your cost.

5. Your obligations as controller

5.1 You have a lawful basis for what your organisation collects, and a condition for special category and criminal offence data (for a church, usually UK GDPR Art 9(2)(d) and, for DBS records, DPA 2018 Schedule 1 paragraph 31 or 18, with an appropriate policy document where paragraph 18 is used).

5.2 You tell your members, visitors, parents and carers how your organisation uses their data, and you approve as members only people you have a proper reason to add.

5.3 Before using youth groups you have what ReachThem's approval needs: a named person responsible for safeguarding (your designated safeguarding person), your charity or church registration, a written safeguarding policy that covers online contact with young people, and at least two Safeguarding Officers; your officers record only DBS checks they have seen, never their own.

5.4 You keep your people's access right: you remove people who should no longer have it, and you publish on your church page and contacts only your organisation's own email addresses and phone numbers.

6. Transfers outside the UK

6.1 Some sub-processors process data outside the UK. Each transfer uses UK adequacy regulations or appropriate safeguards (the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK extension to the EU–US Data Privacy Framework), as Schedule 3 shows.

7. Changes, liability and law

7.1 We may update these terms. If a change needs your fresh agreement we tell your Owners at least 30 days before, and an Owner accepts the new version in the app; until then the features that need it pause. Other changes apply when published, and your Owners are told in the app.

7.2 The liability terms in the terms of service apply. Nothing limits liability that the law does not allow to be limited.

7.3 These terms are governed by the law of England and Wales, and its courts decide disputes.

7.4 Contact about these terms: (to be confirmed).

Schedule 1. Details of the processing

Subject matter: providing ReachThem to the organisation.

Duration: while the organisation uses ReachThem, then clause 4.7.

Nature and purpose: storing, organising, showing, sending and deleting personal data so the organisation can run membership, teams, rotas, events, chats, notices, contacts, youth groups, safeguarding records and its podcast.

Kinds of personal data: names, email addresses, phone numbers, photos; membership and how people joined; roles and teams; rota and event information; messages and contact conversations; notices; for young people, their first name and group membership (their date of birth is ReachThem's own data); parents' and carers' names, relationship, contact details and consent records; DBS check status and records; Safeguarding Officers' concerns, holds and exports.

Special category and criminal offence data: religious belief (implied by church membership, requests and visits); possibly health, family life or sexuality in pastoral conversations; DBS status (criminal offence data).

People: members, volunteers, staff and leaders; people who ask to join or visit; young people aged 13 to 17; parents and carers; Safeguarding Officers; people who appear in pictures or podcast episodes.

Schedule 2. Security measures

Encrypted connections (TLS) for every app, web and API request; (to be confirmed).

Tokens and codes stored as hashes; sign-in by verified email, Google or Apple.

Access inside an organisation follows powers checked on the server; contact conversations, safeguarding records and youth chats are read only by the people the design allows, and officers' readings are audited and shown to other officers and Owners.

No platform-admin access to safeguarding data inside an organisation; platform staff actions are audited.

Automated tests stop sensitive records being read or written outside their own code (the isolation tests).

Backups kept off the code repository; production database access limited to (to be confirmed) with two-factor authentication on every production account.

A written breach response plan.

Schedule 3. Sub-processors

Railway: hosting the app servers and the database. (to be confirmed)

Resend: sending email. (to be confirmed)

Expo: sending push notifications and app updates. (to be confirmed)

Google (Firebase Cloud Messaging; Google sign-in): push notifications to Android phones; sign-in. (to be confirmed)

Apple (Apple Push Notification service; Sign in with Apple): push notifications to iPhones; sign-in. (to be confirmed)

OpenRouter: the optional AI page designer for event pages. (to be confirmed)