Version 2026-10-10.3 · Article 28 GDPR · English original
This Data Processing Agreement (DPA) is between the Fier-Worship customer (“Controller”) and Fier-Worship, Alaimo Aleandro, Grabenstrasse 6, 45888 Gelsenkirchen, Germany (“Processor”). It forms part of the contract. By accepting it electronically, the Controller records the date, time and version; the parties agree that this electronic form satisfies Art. 28(9) GDPR.
The Controller determines purposes and means. The Processor processes personal data only on documented instructions from the Controller, including this DPA, unless Union or Member-State law requires otherwise. The Processor will inform the Controller of such legal requirement unless law prohibits that information.
Processing concerns the provision, operation, security, support and maintenance of Fier-Worship’s SaaS application for organizing a worship team: calendar and events, team and role management, songs with chords, setlist planning, reader mode, stage display, chat, notifications, member activation and offline use. Processing lasts for the customer contract plus the deletion/return period under section 10.
Processing operations include collection on the Controller’s instruction, recording, organisation, storage, retrieval, transmission to authorized users and approved sub-processors, restriction, correction and deletion. The purpose is to provide the Service, prevent abuse, resolve faults and meet Processor security obligations; the Processor’s separate billing/contract processing is outside this DPA.
Data subjects may include the Controller’s leaders, team members, volunteers and contacts entered by the Controller. Data may include identity/contact data; organization/role/instrument data; event, assignment and availability data; songs, setlists and lyrics; messages and notifications; share links; device/session and security data; and push subscriptions.
Information about religious belief or activity may constitute special-category data under Art. 9 GDPR. The Controller must not use special-category data without a valid legal condition and documented instruction.
The Controller is responsible for lawfulness, transparency, data minimisation, accuracy, retention decisions, data-subject communications and instructions, including any licences required for songs and lyrics. Instructions must be given through the Service, support channel or another documented form. The Processor will promptly notify the Controller if an instruction appears to infringe GDPR or other applicable data-protection law, unless prohibited by law.
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory duty. The Processor implements appropriate measures under Art. 32 GDPR, including access control and least privilege, authenticated roles, TLS in transit, encryption of sensitive application fields at rest, hashed session tokens, secure member device-key handling (only public keys reach the server), backups, logging and procedures for availability and incident management. The Controller remains responsible for its own users, devices, credentials and local exports.
Taking account of the nature of processing, the Processor will assist the Controller through appropriate technical and organisational measures with requests under Arts. 15–22 GDPR. The Processor will assist, taking account of available information, with Arts. 32–36 GDPR obligations, including security, personal-data-breach assessment, notification, communication, data-protection impact assessments and prior consultation. The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data and provide available information needed for the Controller’s assessment.
The Processor will make information reasonably necessary to demonstrate compliance with Art. 28 GDPR available to the Controller. Audits are primarily documentation- and remote-review based. Where reasonably necessary, the Controller may arrange an on-site audit during normal business hours with at least 30 days’ notice, no more than once yearly unless a material incident or authority requires otherwise, without disrupting operations and subject to confidentiality/security measures. The Controller bears its own costs; additional Processor effort may be charged at reasonable rates disclosed in advance.
The Controller gives general written authorisation for the sub-processors listed below. The Processor will give at least 30 days’ prior notice of an intended addition or replacement by email or account notice, allowing the Controller to object for documented data-protection reasons. If no reasonable solution is possible, the Controller may terminate the affected Service before the change takes effect. The Processor imposes materially equivalent data-protection duties on every sub-processor and remains responsible for its obligations.
Current authorised sub-processors for Controller data
Cloudflare, Inc. / relevant group entities — application hosting, database and file storage, content delivery (global network; transfers outside the EEA are covered by EU Standard Contractual Clauses and supplementary measures).
Browser/vendor push delivery services — only for users who opt in to push notifications.
PayPal processes the Provider’s payment relationship as an independent controller, not as a sub-processor of Controller member data. Before a transfer outside the EEA, the Processor will ensure an applicable transfer mechanism under Chapter V GDPR and supplementary measures where required.
The Processor will not disclose Controller data to third parties except on the Controller’s instruction, under this DPA, to authorised sub-processors, or where legally required. The Processor will not use Controller data for its own advertising, profiling or unrelated purposes.
At the Controller’s choice communicated at or before account closure, the Processor will return Controller data through the available export/support process or delete it. After the return period, deletion is the default. Deletion does not apply to copies which Union or Member-State law requires to be retained; those copies are blocked from ordinary processing and deleted when the legal obligation ends. Default technical retention periods (for example expired sessions, stale share links, stage screens, notifications and push subscriptions) are described in the Privacy Notice; chat messages follow the retention setting configured by the Controller. Backup copies expire on their documented rolling cycle. The Controller must promptly communicate a documented legal hold or longer applicable legal obligation. The Processor will confirm deletion on reasonable request.
Data-protection instructions and questions: support@fier-app.de. This DPA prevails over conflicting contract terms concerning processing of Controller data. It is governed by GDPR and, to the extent permitted, German law.