MyShul Data Processing Addendum

Effective Date: October 26, 2026 This Data Processing Addendum (the “DPA”) is incorporated into the MyShul Administrator Terms of Service (the “Terms”) by Section 14.5 of the Terms, and forms part of the agreement between MYSHUL LLC, a Florida limited liability company with offices at 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020 (“MyShul”), and the organization identified on the Order Form (“Customer” or “Shul”). This DPA governs MyShul’s Processing of Personal Information contained in Shul Data. It does not govern any other subject matter, and it does not modify any commercial provision of the Terms. Capitalized terms used and not defined in this DPA have the meanings given to them in the Terms.

1. Structure, Incorporation, and Precedence

1.1 Incorporation. This DPA is incorporated into the Terms by reference under Section 14.5 of the Terms and is published at myshul.com/software/dpa/. The Customer’s acceptance of the Terms constitutes its acceptance of this DPA. No separate signature is required, and MyShul is under no obligation to execute a separate data processing agreement, addendum, or exhibit presented by the Customer. 1.2 Precedence. As provided in Section 1.4 of the Terms, this DPA controls over the Terms as to the Processing of Personal Information contained in Shul Data, and to that extent only. In every other respect the Terms control. The Order Form continues to control over the Terms as provided in Section 1.4, and nothing in this DPA overrides any Order Form. 1.3 No modification of commercial provisions. This DPA does not modify, supersede, expand, or limit the fees, the Platform Fee, the subscription term, renewal, cancellation, suspension, termination, warranty disclaimers, limitations of liability, exclusions of damages, liability cap, indemnification obligations, liquidated damages, intellectual property provisions, or any other commercial provision of the Terms or of any Order Form. Where a provision of this DPA could be read to do so, it is to be read as not doing so. 1.4 No additional obligations. This DPA states MyShul’s obligations with respect to the Processing of Personal Information contained in Shul Data by reference to obligations MyShul has already undertaken in the Terms. Except where this DPA expressly states otherwise, it creates no availability, uptime, support, response-time, certification, audit, retention, deletion, or security obligation beyond those set out in the Terms. 1.5 Interpretation. Section headings are for convenience only. References to a numbered Section without further identification are references to a Section of this DPA; references to a Section of the Terms are identified as such.

2. Definitions

2.1 Terms defined in the Terms. The following terms have the meanings given to them in Section 2 of the Terms and are not redefined here: Aggregated Data, Claimed Account, Customer Workspace, Order Form, Platform Fee, Processed Funds, Services, Shul Data, Subscription Fee, and User. Any amendment to those definitions in the Terms applies equally to their use in this DPA. 2.2 “Applicable Privacy Law” means each state privacy or data protection statute of the United States, and each regulation promulgated under it, that applies to the Processing of Personal Information under this DPA, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act and its implementing regulations (together, the “CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and the Florida Digital Bill of Rights, in each case as amended from time to time, and including any comparable statute of any other state of the United States that is enacted or becomes effective after the Effective Date. 2.3 “Personal Information” means information contained in Shul Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, and includes “personal data” and “personal information” as those terms are defined in Applicable Privacy Law. Personal Information does not include Aggregated Data, or information that is de-identified, aggregate, or publicly available within the meaning of Applicable Privacy Law. 2.4 “Sensitive Personal Information” means Personal Information that constitutes “sensitive personal information,” “sensitive data,” or a comparable category under Applicable Privacy Law, including information revealing religious or philosophical beliefs and information concerning a known child. 2.5 “Processing” means any operation performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, combination, restriction, erasure, or destruction. “Process,” “Processes,” and “Processed” are construed accordingly. 2.6 “Subprocessor” means a third party engaged by MyShul that Processes Personal Information in connection with the provision of the Services. 2.7 “Consumer Request” means a request from or on behalf of an individual to exercise a right afforded by Applicable Privacy Law, including a right of access, deletion, correction, portability, opt-out, or limitation of use. 2.8 Roles and equivalent terminology. For the purposes of this DPA and of Applicable Privacy Law: (a) the Customer is the “controller” and the “business” with respect to Personal Information contained in Shul Data; and (b) MyShul is the “processor” and the “service provider” with respect to that Personal Information. Where Applicable Privacy Law uses different terminology for these roles, the corresponding term applies. Nothing in this DPA makes MyShul a “third party” within the meaning of the CCPA with respect to Personal Information contained in Shul Data.

3. Scope and Application

3.1 Subject matter. This DPA applies to MyShul’s Processing of Personal Information contained in Shul Data, on the Customer’s behalf, in the course of providing the Services. 3.2 Application regardless of statutory coverage. This DPA applies as a matter of contract between the parties whether or not any particular Applicable Privacy Law reaches the Customer or MyShul, and whether or not the Customer meets the definition of “business,” “controller,” or any comparable term under any such law. The parties acknowledge that many Customers are nonprofit or religious organizations that may fall outside the scope of one or more Applicable Privacy Laws, including on the basis of nonprofit status, revenue thresholds, processing volume thresholds, or an exemption for religious organizations. The obligations in this DPA are undertaken contractually and do not depend on statutory coverage. Nothing in this DPA constitutes an admission or representation by either party that any particular Applicable Privacy Law does or does not apply to it, and neither party’s performance under this DPA is evidence that any such law applies. 3.3 Where a statutory obligation is conditioned on coverage. Where a provision of this DPA implements a requirement of a particular Applicable Privacy Law, that provision is performed in accordance with that law where the law applies, and as a contractual undertaking in the terms stated where it does not. 3.4 Data that MyShul Processes in its own right. This DPA does not apply to information that MyShul collects, holds, or Processes as a controller or business in its own right rather than on the Customer’s behalf. That information is described in the MyShul Privacy Policy and includes: (a) Claimed Accounts, as addressed in Section 3.5; (b) account and platform data, including sign-in credentials, information a User provides to MyShul directly, and usage, device, diagnostic, and performance data; (c) the records of acceptance of the Terms described in Section 1.3 of the Terms, which the parties acknowledge are evidence of the agreement between them and are retained by MyShul as such; (d) administrator activity and audit logs maintained by MyShul for security, troubleshooting, and audit purposes; (e) records of funds processed through the Services, which MyShul retains under Section 13.5 of the Terms; and (f) contact information for prospective customers and business contacts collected by MyShul through its own sales and outreach activities. 3.5 Claimed Accounts are outside the scope of this DPA. A Claimed Account is not Shul Data and is not Processed on the Customer’s behalf. As provided in Section 2 and Section 13.4 of the Terms, a Claimed Account is a user account that a natural person has created and verified for themselves; it exists at the platform level, is not owned by or specific to any Customer, and may be associated with more than one Customer. The individual who created it, not the Customer, is the person to whom it belongs. MyShul determines the purposes and means of Processing account and credential data associated with a Claimed Account, and is a controller and business with respect to it. Accordingly, and consistent with Section 13.4 of the Terms: (a) nothing in this DPA gives the Customer any ability to delete, disable, suspend, alter, or direct the Processing of any Claimed Account or its sign-in credentials, and no instruction, deletion request, Consumer Request forwarded by the Customer, audit, or termination under this DPA reaches a Claimed Account; (b) deletion of Shul Data under any provision of this DPA or of Section 13 of the Terms does not delete, disable, or otherwise affect any Claimed Account, and neither does reassignment of the super admin role under Section 4.7 of the Terms, any change to administrator permissions under Section 4.6 of the Terms, or the suspension or termination of the Customer’s subscription; and (c) deletion of a Claimed Account requires a request from the natural person who owns that account, submitted directly to MyShul, as described in Section 13.4 of the Terms and Section 14.2 of the MyShul Privacy Policy. Records within a Customer Workspace that are not Claimed Accounts — including unclaimed records created by import, by administrator entry, or at a kiosk — are Shul Data and are within the scope of this DPA. 3.6 Aggregated Data is outside the scope of this DPA. Aggregated Data is not Personal Information. MyShul’s rights in Aggregated Data are governed by Section 11.3 of the Terms and by Section 7 of this DPA. 3.7 United States only; GDPR and international transfers are out of scope. MyShul offers the Services to Customers located in the United States. Individual Users, and individuals whose records a Customer submits to the Services, may be located outside the United States. This DPA does not address, and the parties have not agreed terms concerning, the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, any other non-United States data protection law, the European Commission’s standard contractual clauses, the UK International Data Transfer Agreement or Addendum, transfer impact assessments, or any other mechanism for the international transfer of personal data. This DPA contains no such clauses and incorporates none by reference. If the Customer requires terms addressing any of those instruments, they must be agreed separately in a writing signed by both parties, and MyShul is under no obligation to enter into any such writing. Nothing in this DPA constitutes a representation that the Services are suitable for the Processing of personal data subject to any of those laws.

4. Details of the Processing

The subject matter, duration, nature and purpose of the Processing, the categories of Personal Information, and the categories of individuals to whom the Personal Information relates are set out in Annex 1, which forms part of this DPA.

5. Documented Instructions

5.1 Processing on documented instructions. MyShul will Process Personal Information only on the Customer’s documented instructions, except where Processing is required by law as provided in Section 5.5. 5.2 What constitutes the Customer’s documented instructions. The Customer’s documented instructions consist of: (a) the Terms, including the license granted in Section 11.2 of the Terms and the Aggregated Data provision in Section 11.3 of the Terms; (b) this DPA, including Annex 1; (c) the Order Form; (d) the Customer’s configuration and use of the Services, including the fields it creates, the records it enters or imports, the permissions it assigns, the messages it sends, the features it enables, and the instructions its administrators give to any feature of the Services, including any feature that uses artificial intelligence; and (e) any further instruction the Customer gives in writing that MyShul accepts in writing. 5.3 Instruction to Process for development, training, improvement, and Aggregated Data. The Customer’s acceptance of the Terms constitutes its documented instruction to MyShul to Process Personal Information contained in Shul Data for the purposes described in Sections 11.2 and 11.3 of the Terms, including: (a) hosting, storing, processing, transmitting, displaying, reproducing, backing up, modifying, and creating derivative works of Shul Data to the extent necessary or useful to provide, maintain, secure, support, and improve the Services; (b) developing, training, and improving the machine learning and artificial intelligence features of the Services; and (c) creating, using, reproducing, publishing, and otherwise exploiting Aggregated Data for any lawful purpose, including analytics, benchmarking, research, marketing, publication of statistics, and product development. This instruction is given for the duration stated in Section 11.2 of the Terms, which is for as long as MyShul holds the relevant Shul Data, and MyShul’s rights in Aggregated Data survive termination as provided in Section 11.3 of the Terms. These uses are described to individuals in Section 7 of the MyShul Privacy Policy. 5.4 No implied revocation. No provision of this DPA limits, revokes, narrows, or qualifies the license granted in Section 11.2 of the Terms or the rights granted in Section 11.3 of the Terms. Where a provision of this DPA — including any provision restricting Processing to the Customer’s instructions, restricting retention or use outside a business purpose, or requiring deletion — could be read to do so, it is to be read as not doing so. The parties agree that this Section 5 and Sections 6.5 and 7 state the parties’ agreement as to those uses, and that the precedence rule in Section 1.4 of the Terms operates consistently with them and not against them. 5.5 Processing required by law. MyShul may Process Personal Information where required to do so by applicable law, including in response to a subpoena, court order, or other legal process. Where legally permitted, MyShul will inform the Customer of that requirement before Processing. 5.6 Unlawful instructions. MyShul will inform the Customer if, in MyShul’s opinion, an instruction from the Customer infringes Applicable Privacy Law. MyShul is under no obligation to monitor, review, or assess the Customer’s instructions, its configuration of the Services, the contents of any custom field or notes field, or the lawfulness of the Customer’s own Processing, and MyShul does not provide legal advice, as stated in Section 22.3 of the Terms. MyShul may decline to act on an instruction that MyShul reasonably believes would cause it to violate Applicable Privacy Law or the Terms.

6. Service Provider and Processor Restrictions

6.1 Limited purpose. MyShul Processes Personal Information only for the business purposes set out in Annex 1 and for the purposes stated in Section 5.3, and only pursuant to the written agreement between the parties. MyShul will not retain, use, or disclose Personal Information for any purpose other than the business purposes specified in this DPA and the Terms, including for a commercial purpose other than those business purposes, and will not retain, use, or disclose Personal Information outside the direct business relationship between MyShul and the Customer, except as permitted by Applicable Privacy Law. 6.2 No sale; no sharing. MyShul does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising, as “sell,” “share,” and “cross-context behavioral advertising” are defined in Applicable Privacy Law. MyShul receives no monetary or other valuable consideration in exchange for Personal Information. MyShul does not use Personal Information contained in Shul Data for targeted advertising, and does not use it to market the Services to the Customer’s members or donors, as stated in Section 11 of the MyShul Privacy Policy. A transfer of Personal Information in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of MyShul’s assets, consistent with Section 27.2 of the Terms and Section 13 of the MyShul Privacy Policy, is not a sale or sharing for the purposes of this Section, to the extent Applicable Privacy Law so provides. 6.3 No combining. MyShul will not combine Personal Information received from or on behalf of the Customer with personal information that MyShul receives from or on behalf of another person, or that MyShul collects from its own interaction with an individual, except as permitted by Applicable Privacy Law for a service provider, including to perform a business purpose permitted under Section 6.5. For the avoidance of doubt, the association of a Claimed Account with a Customer Workspace, as described in Section 9 of the MyShul Privacy Policy, occurs within the Services at the direction of the Customer and the individual and is not a combination prohibited by this Section. 6.4 Disclosure. MyShul will not disclose Personal Information to any third party other than a Subprocessor engaged in accordance with Section 10, except at the Customer’s instruction, as required by law under Section 5.5, or as permitted by Applicable Privacy Law. 6.5 Building and improving the Services. As permitted by Applicable Privacy Law for a service provider, MyShul may use Personal Information internally to build, improve, maintain, secure, and enhance the quality of the Services, including for internal research and technological development and to develop, train, and improve the machine learning and artificial intelligence features of the Services, as instructed under Section 5.3. In doing so: (a) MyShul will not build or modify a profile about any individual for MyShul’s own purposes, and will not build or modify household or consumer profiles to use in providing services to another business; (b) MyShul will not use, and will not permit any Subprocessor to use, Personal Information originating in one Customer’s Customer Workspace to provide services to, or for the benefit of, another Customer, and no feature of the Services gives one Customer access to another Customer’s Shul Data, as stated in Section 7 of the MyShul Privacy Policy; and (c) MyShul will not use Personal Information to correct or augment data acquired from another source, except as permitted by Applicable Privacy Law. Improvement of the Services themselves, which are provided to all Customers in common, is not a use for the benefit of another Customer within the meaning of subsection (b). The parties acknowledge that this is the use instructed under Section 5.3 and permitted by Section 11.2 of the Terms. 6.6 Sensitive Personal Information. MyShul Processes Sensitive Personal Information contained in Shul Data only for the purposes set out in this DPA and does not use or disclose it for any purpose other than those permitted to a service provider under Applicable Privacy Law. The Customer’s obligations with respect to notice, consent, and legal basis for Sensitive Personal Information are stated in Section 15. 6.7 Certification. MyShul certifies that it understands the restrictions set out in this Section 6 and in Section 5, and that it will comply with them. 6.8 Notification of inability to comply. MyShul will notify the Customer if MyShul determines that it can no longer meet its obligations under Applicable Privacy Law with respect to Personal Information. Notice under this Section is given as provided in Section 27.3 of the Terms. 6.9 The Customer’s right to stop and remediate. The Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information by MyShul, and to help ensure that MyShul Processes Personal Information in a manner consistent with the Customer’s obligations under Applicable Privacy Law. The parties agree that the mechanism in Section 14 is the reasonable and appropriate means by which the Customer may exercise this right, together with the Customer’s right to give instructions under Section 5, to configure and restrict Processing within the Services, and to cancel under Section 10.1 of the Terms. This Section does not grant any right of on-site inspection or any right of access to MyShul’s systems, premises, or personnel.

7. Aggregated and De-identified Data

7.1 MyShul’s rights. MyShul may create Aggregated Data from Shul Data and from use of the Services, and owns all Aggregated Data, as provided in Section 11.3 of the Terms. Aggregated Data does not identify the Customer, any User, or any natural person. Aggregated Data is not Personal Information and is treated as de-identified information, aggregate consumer information, or the equivalent under Applicable Privacy Law. 7.2 De-identification commitments. With respect to Aggregated Data, MyShul will: (a) take reasonable measures to ensure that the information cannot be associated with, or reasonably linked to, an individual, household, Customer, or User; (b) maintain and use the information in de-identified or aggregated form and not attempt to reidentify it, except where reidentification is undertaken solely for the purpose of determining whether MyShul’s de-identification processes satisfy the requirements of Applicable Privacy Law; and (c) contractually obligate any recipient of Aggregated Data to comply with the commitments in subsections (a) and (b), and not to attempt to reidentify the information. 7.3 Survival. MyShul’s rights in Aggregated Data survive termination or expiration of the Terms and of this DPA, as provided in Section 11.3 of the Terms. No provision of this DPA concerning retention, return, or deletion — including Section 13 — applies to Aggregated Data, requires its deletion, or otherwise limits MyShul’s rights in it. The deletion of Shul Data does not require the deletion or modification of any Aggregated Data previously created from it.

8. Confidentiality of Personnel

8.1 Access limited. MyShul limits access to Personal Information to those of its personnel who require access in order to provide, maintain, secure, or support the Services, and restricts access to production systems on a role-based basis, as stated in Section 14.2 of the Terms. 8.2 Confidentiality obligations. MyShul requires that each individual authorized to Process Personal Information be subject to a written obligation of confidentiality or an equivalent professional duty of confidentiality. That obligation survives the end of that individual’s engagement with MyShul. 8.3 Training. MyShul informs personnel with access to Personal Information of the confidentiality and use restrictions applicable to it.

9. Security

9.1 Security measures. MyShul maintains the administrative and technical measures described in Section 14.2 of the Terms. Those measures are not restated here, and this DPA does not add to them. Additional detail concerning MyShul’s security practices is set out in Section 15 of the MyShul Privacy Policy. 9.2 No additional representation. As stated in Section 14.2 of the Terms, MyShul makes no representation that the Services are or will be free from vulnerability, intrusion, or compromise. Nothing in this DPA constitutes such a representation, and the disclaimers in Sections 22.1 and 22.2 of the Terms are unaffected by this DPA. This DPA does not create any warranty, guarantee, or service level with respect to security, availability, or the integrity of data. 9.3 The Customer’s security responsibilities. The Customer’s responsibilities for the security of its Customer Workspace, its configuration of roles and permissions, its credentials and devices, and the prompt removal of access for individuals who no longer require it are stated in Section 14.3 of the Terms and are not modified by this DPA. The Customer acknowledges that the permissions it assigns determine which of its administrators can access which Personal Information within its Customer Workspace.

10. Subprocessors

10.1 General written authorization. The Customer gives MyShul general written authorization to engage Subprocessors to Process Personal Information in connection with the provision of the Services. 10.2 Current list. The current list of Subprocessors is maintained at myshul.com/software/subprocessors/, as provided in Section 19.1 of the Terms. That list is incorporated into this DPA by reference and may be updated by MyShul as provided in Section 10.3. 10.3 Changes. MyShul may add or replace Subprocessors and will update the list accordingly. Where a change is material, MyShul will provide notice as provided in Section 19.1 of the Terms, given to the email address associated with the Customer’s account in accordance with Section 27.3 of the Terms. This DPA does not create a right to object to, or to require the removal of, any Subprocessor, and does not create a right of termination on account of a Subprocessor change. The Customer’s remedy if it does not wish to continue is to cancel under Section 10.1 of the Terms, subject to Section 6.2 of the Terms. 10.4 Flow-down. MyShul enters into a written agreement with each Subprocessor that imposes on the Subprocessor obligations with respect to Personal Information that are substantially equivalent to, and no less protective than, those imposed on MyShul by this DPA, to the extent applicable to the services the Subprocessor performs. 10.5 Responsibility. MyShul remains responsible to the Customer for the performance of each Subprocessor’s obligations with respect to Personal Information, to the same extent MyShul would be responsible if it performed those obligations itself. This Section is subject in all respects to Section 16 and to Section 23 of the Terms. 10.6 Third-party services that are not Subprocessors. Where the Customer or a User elects to connect the Services to a third-party service, or where a third party acts as the Customer’s own service provider, that third party is not a Subprocessor of MyShul, and Section 19.3 of the Terms applies. Stripe acts as a payment processor with respect to transactions on the Customer’s connected account, for which the Customer is the merchant of record under Section 8.1 of the Terms, and Stripe’s Processing is governed by Stripe’s own terms.

11. Consumer Requests

11.1 The Customer controls the response. Requests from members, donors, and other individuals concerning records in a Customer Workspace are directed to the Customer, which controls that data. As stated in Sections 3 and 14.2 of the MyShul Privacy Policy, MyShul does not delete, correct, or alter a Customer’s Shul Data at the request of a member or donor. The Customer is responsible for responding to Consumer Requests concerning Personal Information contained in its Shul Data, including for verifying the identity of the requester, determining whether the request is valid, applying any exception, and responding within the time required by Applicable Privacy Law. 11.2 Requests received by MyShul. Where MyShul receives a Consumer Request that concerns Personal Information contained in a Customer’s Shul Data, MyShul will not respond to it substantively except as instructed by the Customer or as required by Applicable Privacy Law. MyShul will, where it is able to identify the relevant Customer, inform the individual that the request should be directed to that Customer, and may forward the request to the Customer at the email address associated with the Customer’s account. 11.3 Assistance. MyShul will provide reasonable assistance to the Customer in responding to Consumer Requests, through the functionality made available in the Services. That functionality includes the Customer’s ability to access, search, correct, update, and delete records within its Customer Workspace, and the self-service export described in Section 12.1 of the Terms. MyShul’s assistance obligation is limited to that functionality and to the prepared export described in Section 12.4 of the Terms where self-service export is unavailable. As stated in Section 12.3 of the Terms, MyShul has no obligation to prepare, extract, compile, or deliver data on the Customer’s behalf beyond making that functionality available, and no obligation to build custom outputs, to transform or reformat data, or to migrate data to any other system. MyShul does not offer a self-service export to individual Users, as stated in Section 16 of the MyShul Privacy Policy. 11.4 Requests concerning data MyShul controls. A Consumer Request concerning a Claimed Account, or concerning any other information described in Section 3.4, is handled by MyShul in its own right as described in Sections 14.2 and 16 of the MyShul Privacy Policy. The Customer has no right under this DPA to make, direct, withdraw, or respond to such a request on an individual’s behalf. 11.5 Assessments. Where Applicable Privacy Law requires the Customer to conduct a data protection assessment, MyShul will, on written request, make available to the Customer the information described in Section 14.1 to the extent it is reasonably necessary for that assessment and is within MyShul’s possession. MyShul is under no obligation to conduct, prepare, or contribute to any assessment on the Customer’s behalf.

12. Security Incidents

12.1 Notification. Notification of security incidents is governed by Section 14.4 of the Terms. If MyShul becomes aware of a security incident resulting in the unauthorized acquisition of Shul Data, MyShul will notify the Customer without undue delay and will provide the information reasonably available to it. 12.2 No different standard. This DPA does not establish a notification standard, trigger, timeline, content requirement, or method different from that in Section 14.4 of the Terms, and does not impose any fixed period within which notice must be given. 12.3 The Customer’s responsibility. The Customer is responsible for determining whether notification to its members, donors, any regulator, or any other person is required, and for making any such notification, as provided in Section 14.4 of the Terms. MyShul will reasonably cooperate with the Customer in that process. Nothing in this DPA obligates MyShul to notify any individual on the Customer’s behalf, to fund or reimburse the cost of any notification, or to provide credit monitoring or any similar remedy. 12.4 Notice address. Notice under this Section is given to the email address associated with the Customer’s account as provided in Section 27.3 of the Terms. The Customer is responsible for keeping that address current.

13. Retention, Return, and Deletion

13.1 Governed by the Terms. Retention, return, and deletion of Shul Data are governed by Sections 12 and 13 of the Terms. This Section cross-references those provisions and does not alter them. This DPA creates no retention period and no deletion obligation beyond those stated in the Terms. 13.2 Return of Shul Data. Self-service export is available to accounts in good standing during the term under Section 12.1 of the Terms. Where self-service export is unavailable to the Customer — including during suspension of administrative access, following cancellation, and following termination — MyShul will, on written request, prepare and deliver a copy of the Customer’s Shul Data at no charge, as provided in Section 12.4 of the Terms, on the terms and within the availability periods stated in that Section. That export is not conditioned on payment of any outstanding balance. The limitations in Sections 12.3, 12.4(e), and 12.4(f) of the Terms apply. 13.3 Deletion where an account is unpaid. Where an account remains unpaid, MyShul may delete Shul Data on the schedule and following the notices set out in Section 13.2 of the Terms. 13.4 Deletion following cancellation or termination. Following cancellation or termination, MyShul retains the Shul Data in the Customer Workspace for ninety (90) days after the Customer’s access to the Services ends, provides notice not less than fourteen (14) days before deletion, and may delete the Shul Data thereafter, all as provided in Section 13.7 of the Terms. As provided in Section 13.3 of the Terms, deletion under Section 13.2 and Section 13.7 of the Terms is a right and not an obligation, and MyShul’s retention of Shul Data beyond any period described in those Sections does not waive its right to delete thereafter. 13.5 Deletion on the Customer’s written request. The Customer may request in writing that MyShul delete the Shul Data in its Customer Workspace before the ninety (90) day period has run, and MyShul will act on that request, as provided in Section 13.7(f) of the Terms. MyShul may require verification of the requester’s identity and authority, and may decline or defer where Section 4.7(b) of the Terms applies or where MyShul reasonably believes the request is not authorized. Timing is at MyShul’s discretion. Such a request is irreversible in effect and forecloses the prepared export under Section 12.4 of the Terms; the Customer should obtain its export before making one. 13.6 Carve-outs. Deletion under this Section and under Section 13 of the Terms reaches Shul Data within the Customer Workspace only. It does not reach, and this DPA does not require the deletion of: (a) any Claimed Account, which is governed by Section 13.4 of the Terms and by Section 3.5 of this DPA; (b) records of funds processed through the Services, including transaction history, which MyShul retains regardless of any deletion of Shul Data for accounting, audit, tax, fraud-prevention, dispute-resolution, and legal-compliance purposes under Section 13.5 of the Terms, and transaction records held by Stripe, which are retained by Stripe under its own terms and are not within MyShul’s control or ability to delete; (c) data persisting in backups, archives, and system logs, which is governed by Section 13.6 of the Terms and which is deleted in accordance with MyShul’s ordinary retention cycles; (d) Aggregated Data, as provided in Section 7.3; and (e) information described in Section 3.4, including the acceptance records described in Section 1.3 of the Terms, which MyShul retains as evidence of the agreement between the parties. 13.7 Retention required by law. MyShul may retain Personal Information where required by applicable law, and will limit its Processing of information so retained to the purpose that requires its retention. 13.8 Deletion of individual records. The Customer may delete individual records within its Customer Workspace using the functionality of the Services at any time during the term. This DPA does not obligate MyShul to delete any individual record on the Customer’s behalf.

14. Documentation and Audit

14.1 Information available. On the Customer’s written request, MyShul will make available information reasonably necessary to demonstrate MyShul’s compliance with this DPA, in the form of (a) reasonable documentation concerning MyShul’s Processing of Personal Information and its security measures, and (b) written responses to a reasonable written questionnaire prepared by the Customer. 14.2 Limits. Requests under Section 14.1: (a) may be made not more than once in any twelve (12) month period, except where required more frequently by Applicable Privacy Law or following a security incident notified under Section 12; (b) are at the Customer’s expense, including MyShul’s reasonable costs of responding; (c) must be reasonable in scope and must allow MyShul a reasonable period to respond; (d) are subject to Section 17 of the Terms, and all information provided is MyShul’s confidential information; and (e) do not extend to information that MyShul is prohibited from disclosing by law or by an obligation of confidentiality owed to a third party, to information concerning another Customer, or to MyShul’s source code, internal security testing results, or non-public elements of the Services beyond what is reasonably necessary to respond. 14.3 No inspection, certification, or audit report. This DPA does not grant any right of on-site inspection, physical or remote access to MyShul’s systems, premises, personnel, or networks, or any right to conduct penetration testing, vulnerability scanning, or any other technical assessment of the Services. MyShul does not hold, and does not undertake to obtain, maintain, or provide, a SOC 2 report, ISO 27001 certification, or any other third-party audit report, attestation, or certification, and nothing in this DPA obligates it to engage an independent assessor. 14.4 Alternative satisfaction. Where Applicable Privacy Law contemplates that a processor make available to a controller information sufficient to demonstrate compliance, or permit reasonable assessments, the parties agree that the mechanism in this Section 14 is the means by which MyShul satisfies that requirement, and that it is reasonable having regard to the nature and scale of the Services.

15. Customer Obligations and Representations

15.1 Notice, consent, and legal basis. The Customer represents and warrants, as provided in Section 15.5 of the Terms, that it has provided its members, donors, and other individuals whose information it submits to the Services with any privacy notice or disclosure required by law applicable to its organization, and that it has any consent or other legal basis required for MyShul to receive and Process that information as described in the Terms, in this DPA, and in the MyShul Privacy Policy. This includes any consent required by Applicable Privacy Law for the Processing of Sensitive Personal Information, and any consent required for the Processing of information concerning a known child. 15.2 Rights in the data submitted. The Customer represents that it has all rights necessary to submit Shul Data to the Services and to grant the licenses in Section 11 of the Terms, as provided in Section 11.4 of the Terms. 15.3 Records concerning minors. The Customer’s obligations with respect to records concerning individuals under thirteen (13) years of age, including its representation that it holds the parental or guardian consent necessary to submit such records, are stated in Section 4.2 of the Terms. 15.4 Communications. The Customer’s representations concerning its right to provide each phone number and email address, its consents for the messages it sends, and its compliance with the Telephone Consumer Protection Act, the CAN-SPAM Act, and other applicable communications laws are stated in Section 15.5 of the Terms. The Customer is the sender and content owner of messages it sends through the Services, and MyShul acts solely as a conduit, as provided in Section 15.2 of the Terms. 15.5 Migration and onboarding outreach. The Customer’s authorization of migration and onboarding outreach, and its representation that it has the right to provide the contacts used for it, are stated in Section 15.6 of the Terms. 15.6 Custom fields and content. The Customer determines what information it records in the Services, including in custom fields and notes fields. MyShul does not control, review, or limit what a Customer records in them, as stated in Sections 4.5 and 5 of the MyShul Privacy Policy. The Customer is responsible for ensuring that the categories of Personal Information it submits are lawful, are consistent with the notices it has given, and are appropriate to the Services. 15.7 Instructions. The Customer is responsible for ensuring that its instructions comply with Applicable Privacy Law. The Customer’s indemnification obligations under Section 24.1 of the Terms, including subsections (a), (b), (c), and (h), apply to claims arising from the matters described in this Section 15. 15.8 Individuals outside the United States. Where the Customer submits to the Services information concerning individuals located outside the United States, the Customer is responsible for compliance with any non-United States data protection law applicable to it in respect of that information, including any notice, consent, legal basis, or data subject rights obligation. Section 3.7 applies, and MyShul’s representations and obligations under this DPA are unchanged.

16. Liability

16.1 Subject to the Terms. Each party’s liability arising out of or relating to this DPA is subject to the exclusions of damages, the limitations of liability, and the aggregate liability cap set out in Section 23 of the Terms, and all claims arising out of or relating to this DPA are aggregated with all other claims under the Terms for the purpose of that cap. 16.2 No increase in liability. This DPA does not increase, alter, expand, or create any exception to MyShul’s aggregate liability under the Terms. The exceptions in Section 23.4 of the Terms are unaffected and are neither expanded nor narrowed by this DPA. This DPA creates no indemnification obligation, and Section 24 of the Terms is unaffected. 16.3 No third-party beneficiaries. This DPA is for the sole benefit of MyShul and the Customer. No User, member, donor, or other individual is a third-party beneficiary of this DPA or has any right to enforce any provision of it, consistent with Section 27.8 of the Terms.

17. Term, Amendment, and General

17.1 Term. This DPA takes effect on the Effective Date stated above, or on the date the Customer accepts the Terms if later, and remains in effect for as long as MyShul Processes Personal Information contained in the Customer’s Shul Data. Section 14.5 of the Terms survives termination as provided in Section 27.7 of the Terms, and the provisions of this DPA that by their nature should survive — including Sections 5.4, 6, 7, 8, 13, 16, and this Section 17 — survive the termination or expiration of the Terms. 17.2 Amendment. MyShul may modify this DPA as provided in Section 25 of the Terms, including the thirty (30) day notice requirement for material changes in Section 25.1 and the version archive in Section 25.3. 17.3 Notices. Notices under this DPA are given as provided in Section 27.3 of the Terms. Notices to MyShul must be sent to info@myshul.com and, for any formal legal notice, also by mail to MYSHUL LLC, 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020. 17.4 Governing law and venue. This DPA is governed by the laws of the State of Florida, without regard to its conflict-of-laws principles, and the exclusive jurisdiction and venue provisions of Section 26 of the Terms apply, including the jury trial waiver in Section 26.3. Sections 6.8 and 26.4 of the Terms apply to any dispute arising under this DPA. 17.5 Severability. If any provision of this DPA is held invalid, illegal, or unenforceable, Section 27.5 of the Terms applies. The invalidity or unenforceability of any provision of this DPA does not affect the validity or enforceability of Section 11.2 or Section 11.3 of the Terms. 17.6 Assignment. Section 27.2 of the Terms applies to this DPA. 17.7 Entire agreement. This DPA, together with the Terms, the Order Form, and the other documents identified in Section 1.4 of the Terms, constitutes the entire agreement between the parties concerning the Processing of Personal Information contained in Shul Data and supersedes any prior or contemporaneous understanding on that subject. No purchase order, vendor form, security questionnaire response, or other document issued by the Customer modifies this DPA, and any conflicting or additional terms in such a document are void, as provided in Section 27.4 of the Terms.

Annex 1 — Details of the Processing

A. Subject matter. MyShul’s provision of the Services to the Customer under the Terms, and the Processing of Personal Information contained in Shul Data in the course of that provision. B. Duration. For the term of the Customer’s subscription and thereafter for so long as MyShul holds the relevant Shul Data, as determined by Sections 12 and 13 of the Terms. MyShul’s rights in Aggregated Data survive as provided in Section 11.3 of the Terms. C. Nature of the Processing. Hosting, storage, transmission, display, reproduction, back-up, organization, retrieval, consultation, modification, creation of derivative works, and deletion, by automated and non-automated means, as necessary or useful to provide, maintain, secure, support, and improve the Services. D. Purposes of the Processing.
  1. Providing the Services described in Section 3.1 of the Terms, including member and constituent management, invoicing and billing, payment processing through Stripe, donation processing, scheduling, event management, member engagement and communications tools, self-service kiosk functionality, and the related web and mobile applications.
  2. Creating, verifying, and authenticating accounts and administering access.
  3. Processing payments and generating invoices, receipts, statements, and payout reports.
  4. Sending transactional messages, including verification codes, payment requests, billing notices, and account notices.
  5. Transmitting communications that the Customer sends to its members and donors, for which the Customer is the sender.
  6. Providing customer support and troubleshooting.
  7. Operating features that use artificial intelligence, as described in Section 7 of the MyShul Privacy Policy, at the direction of the Customer’s administrators.
  8. Maintaining security, detecting and preventing fraud and abuse, and maintaining security and audit logs.
  9. Developing, training, and improving the Services, including the machine learning and artificial intelligence features of the Services, as instructed under Section 5.3 of this DPA and permitted by Section 11.2 of the Terms.
  10. Creating and using Aggregated Data, as instructed under Section 5.3 of this DPA and permitted by Section 11.3 of the Terms.
  11. Complying with legal obligations and enforcing the Terms.
E. Categories of individuals. Members of the Customer; donors and other contributors; prospective members and other constituents whose records the Customer enters or imports; guests and other individuals who transact at a kiosk or as a guest without signing in; event registrants; household and family members recorded on a Customer’s records, including individuals under thirteen (13) years of age whose records the Customer submits under Section 4.2 of the Terms; the Customer’s administrators, officers, clergy, staff, and volunteers; and other Users affiliated with the Customer. F. Categories of Personal Information. As determined by the Customer’s use of the Services, and drawn from Sections 4 and 5 of the MyShul Privacy Policy:
  1. Identifiers and contact information — name, email address, phone number, mailing address, and Hebrew name.
  2. Membership and household records — membership status, household and family relationships, and constituent categorization.
  3. Dates and life events — dates of birth, anniversaries, and yahrzeits.
  4. Synagogue records — seat assignments, aliyah honors and other synagogue honors, event registrations, and attendance.
  5. Financial and transactional records — donation, pledge, dues, tuition, and event payment history; invoices, receipts, and payment records; and limited payment method information consisting of card brand, last four digits, and expiration month and year. Full payment card numbers, CVC and CVV codes, PINs, and magnetic stripe data are not received or stored by MyShul and are held by Stripe, as stated in Section 8.1 of the Terms and Section 8.1 of the MyShul Privacy Policy.
  6. Communications — messages sent to or from individuals through the Services and records of those communications, together with consent and opt-out status.
  7. Notes and free-text content — notes written by the Customer’s administrators.
  8. Custom fields — any additional category of information the Customer chooses to create and record. MyShul does not control, review, or limit what a Customer records in a custom field or notes field, and cannot predict what categories a particular Customer may record. See Sections 4.5 and 5 of the MyShul Privacy Policy and Section 15.6 of this DPA.
  9. Technical information — IP address, device and browser type, operating system, and usage, interaction, diagnostic, and performance data associated with use of the Customer Workspace.
G. Sensitive Personal Information. Shul Data can reveal religious affiliation. A record showing that an individual belongs to, attends, donates to, or holds honors at a synagogue can reveal religious or ethnic affiliation, whether or not the individual considers themselves religious; records such as aliyah honors, Hebrew names, and yahrzeits are more specific still. Yahrzeit records identify the death of a relative, and household records identify family relationships. Shul Data may also include records concerning individuals under thirteen (13) years of age. Because the Customer controls what it records in custom fields, MyShul cannot predict or limit what further categories of Sensitive Personal Information a particular Customer may submit. The Services are not designed to hold, and MyShul does not ask for, Social Security numbers, government identification numbers, driver’s license numbers, health or medical records, or biometric information. Where a Customer’s Stripe connected account representative provides identity and verification information to Stripe, which may include a government identification number, that information is collected by Stripe directly and is not received by MyShul, as stated in Section 8.10(c) of the Terms and Section 5 of the MyShul Privacy Policy. H. Frequency of Processing. Continuous, for the duration stated in paragraph B. I. Subprocessors. As listed at myshul.com/software/subprocessors/, and as provided in Section 10.
MYSHUL LLC | 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020 | info@myshul.com