{"id":3176,"date":"2026-09-10T18:18:23","date_gmt":"2026-09-10T18:18:23","guid":{"rendered":"https:\/\/start.myshul.com\/?page_id=3176"},"modified":"2026-10-26T10:51:21","modified_gmt":"2026-10-26T14:51:21","slug":"dpa","status":"publish","type":"page","link":"https:\/\/myshul.com\/software\/dpa\/","title":{"rendered":"DPA"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3176\" class=\"elementor elementor-3176\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-15b6a15 e-flex e-con-boxed e-con e-parent\" data-id=\"15b6a15\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-94165b7 e-flex e-con-boxed e-con e-parent\" data-id=\"94165b7\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-29a9bd0 elementor-widget elementor-widget-text-editor\" data-id=\"29a9bd0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h1>MyShul Data Processing Addendum<\/h1>\n<strong>Effective Date: October 26, 2026<\/strong>\n\nThis Data Processing Addendum (the \u201c<strong>DPA<\/strong>\u201d) is incorporated into the <a href=\"https:\/\/myshul.com\/software\/admin-tos\/\">MyShul Administrator Terms of Service<\/a> (the \u201c<strong>Terms<\/strong>\u201d) by Section 14.5 of the Terms, and forms part of the agreement between <strong>MYSHUL LLC<\/strong>, a Florida limited liability company with offices at 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020 (\u201c<strong>MyShul<\/strong>\u201d), and the organization identified on the Order Form (\u201c<strong>Customer<\/strong>\u201d or \u201c<strong>Shul<\/strong>\u201d).\n\nThis DPA governs MyShul\u2019s Processing of Personal Information contained in Shul Data. It does not govern any other subject matter, and it does not modify any commercial provision of the Terms.\n\nCapitalized terms used and not defined in this DPA have the meanings given to them in the Terms.\n\n<hr \/>\n\n<h2>1. Structure, Incorporation, and Precedence<\/h2>\n<strong>1.1 Incorporation.<\/strong> This DPA is incorporated into the Terms by reference under Section 14.5 of the Terms and is published at <a href=\"https:\/\/myshul.com\/software\/dpa\/\">myshul.com\/software\/dpa\/<\/a>. The Customer\u2019s acceptance of the Terms constitutes its acceptance of this DPA. No separate signature is required, and MyShul is under no obligation to execute a separate data processing agreement, addendum, or exhibit presented by the Customer.\n\n<strong>1.2 Precedence.<\/strong> As provided in Section 1.4 of the Terms, this DPA controls over the Terms <strong>as to the Processing of Personal Information contained in Shul Data, and to that extent only<\/strong>. In every other respect the Terms control. The Order Form continues to control over the Terms as provided in Section 1.4, and nothing in this DPA overrides any Order Form.\n\n<strong>1.3 No modification of commercial provisions.<\/strong> <strong>This DPA does not modify, supersede, expand, or limit the fees, the Platform Fee, the subscription term, renewal, cancellation, suspension, termination, warranty disclaimers, limitations of liability, exclusions of damages, liability cap, indemnification obligations, liquidated damages, intellectual property provisions, or any other commercial provision of the Terms or of any Order Form.<\/strong> Where a provision of this DPA could be read to do so, it is to be read as not doing so.\n\n<strong>1.4 No additional obligations.<\/strong> This DPA states MyShul\u2019s obligations with respect to the Processing of Personal Information contained in Shul Data by reference to obligations MyShul has already undertaken in the Terms. Except where this DPA expressly states otherwise, <strong>it creates no availability, uptime, support, response-time, certification, audit, retention, deletion, or security obligation beyond those set out in the Terms.<\/strong>\n\n<strong>1.5 Interpretation.<\/strong> Section headings are for convenience only. References to a numbered Section without further identification are references to a Section of this DPA; references to a Section of the Terms are identified as such.\n\n<hr \/>\n\n<h2>2. Definitions<\/h2>\n<strong>2.1 Terms defined in the Terms.<\/strong> The following terms have the meanings given to them in Section 2 of the Terms and are not redefined here: <strong>Aggregated Data<\/strong>, <strong>Claimed Account<\/strong>, <strong>Customer Workspace<\/strong>, <strong>Order Form<\/strong>, <strong>Platform Fee<\/strong>, <strong>Processed Funds<\/strong>, <strong>Services<\/strong>, <strong>Shul Data<\/strong>, <strong>Subscription Fee<\/strong>, and <strong>User<\/strong>. Any amendment to those definitions in the Terms applies equally to their use in this DPA.\n\n<strong>2.2 \u201cApplicable Privacy Law\u201d<\/strong> means each state privacy or data protection statute of the United States, and each regulation promulgated under it, that applies to the Processing of Personal Information under this DPA, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act and its implementing regulations (together, the \u201c<strong>CCPA<\/strong>\u201d), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and the Florida Digital Bill of Rights, <strong>in each case as amended from time to time, and including any comparable statute of any other state of the United States that is enacted or becomes effective after the Effective Date.<\/strong>\n\n<strong>2.3 \u201cPersonal Information\u201d<\/strong> means information contained in Shul Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, and includes \u201cpersonal data\u201d and \u201cpersonal information\u201d as those terms are defined in Applicable Privacy Law. <strong>Personal Information does not include Aggregated Data, or information that is de-identified, aggregate, or publicly available within the meaning of Applicable Privacy Law.<\/strong>\n\n<strong>2.4 \u201cSensitive Personal Information\u201d<\/strong> means Personal Information that constitutes \u201csensitive personal information,\u201d \u201csensitive data,\u201d or a comparable category under Applicable Privacy Law, including information revealing religious or philosophical beliefs and information concerning a known child.\n\n<strong>2.5 \u201cProcessing\u201d<\/strong> means any operation performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, combination, restriction, erasure, or destruction. \u201c<strong>Process<\/strong>,\u201d \u201c<strong>Processes<\/strong>,\u201d and \u201c<strong>Processed<\/strong>\u201d are construed accordingly.\n\n<strong>2.6 \u201cSubprocessor\u201d<\/strong> means a third party engaged by MyShul that Processes Personal Information in connection with the provision of the Services.\n\n<strong>2.7 \u201cConsumer Request\u201d<\/strong> means a request from or on behalf of an individual to exercise a right afforded by Applicable Privacy Law, including a right of access, deletion, correction, portability, opt-out, or limitation of use.\n\n<strong>2.8 Roles and equivalent terminology.<\/strong> For the purposes of this DPA and of Applicable Privacy Law:\n\n(a) the <strong>Customer is the \u201ccontroller\u201d and the \u201cbusiness\u201d<\/strong> with respect to Personal Information contained in Shul Data; and\n\n(b) <strong>MyShul is the \u201cprocessor\u201d and the \u201cservice provider\u201d<\/strong> with respect to that Personal Information.\n\nWhere Applicable Privacy Law uses different terminology for these roles, the corresponding term applies. Nothing in this DPA makes MyShul a \u201cthird party\u201d within the meaning of the CCPA with respect to Personal Information contained in Shul Data.\n\n<hr \/>\n\n<h2>3. Scope and Application<\/h2>\n<strong>3.1 Subject matter.<\/strong> This DPA applies to MyShul\u2019s Processing of Personal Information contained in Shul Data, on the Customer\u2019s behalf, in the course of providing the Services.\n\n<strong>3.2 Application regardless of statutory coverage.<\/strong> <strong>This DPA applies as a matter of contract between the parties whether or not any particular Applicable Privacy Law reaches the Customer or MyShul, and whether or not the Customer meets the definition of \u201cbusiness,\u201d \u201ccontroller,\u201d or any comparable term under any such law.<\/strong> The parties acknowledge that many Customers are nonprofit or religious organizations that may fall outside the scope of one or more Applicable Privacy Laws, including on the basis of nonprofit status, revenue thresholds, processing volume thresholds, or an exemption for religious organizations. <strong>The obligations in this DPA are undertaken contractually and do not depend on statutory coverage.<\/strong> Nothing in this DPA constitutes an admission or representation by either party that any particular Applicable Privacy Law does or does not apply to it, and neither party\u2019s performance under this DPA is evidence that any such law applies.\n\n<strong>3.3 Where a statutory obligation is conditioned on coverage.<\/strong> Where a provision of this DPA implements a requirement of a particular Applicable Privacy Law, that provision is performed in accordance with that law where the law applies, and as a contractual undertaking in the terms stated where it does not.\n\n<strong>3.4 Data that MyShul Processes in its own right.<\/strong> This DPA does not apply to information that MyShul collects, holds, or Processes as a controller or business in its own right rather than on the Customer\u2019s behalf. That information is described in the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a> and includes:\n\n(a) <strong>Claimed Accounts<\/strong>, as addressed in Section 3.5;\n\n(b) account and platform data, including sign-in credentials, information a User provides to MyShul directly, and usage, device, diagnostic, and performance data;\n\n(c) the records of acceptance of the Terms described in Section 1.3 of the Terms, which the parties acknowledge are evidence of the agreement between them and are retained by MyShul as such;\n\n(d) administrator activity and audit logs maintained by MyShul for security, troubleshooting, and audit purposes;\n\n(e) records of funds processed through the Services, which MyShul retains under Section 13.5 of the Terms; and\n\n(f) contact information for prospective customers and business contacts collected by MyShul through its own sales and outreach activities.\n\n<strong>3.5 Claimed Accounts are outside the scope of this DPA.<\/strong> <strong>A Claimed Account is not Shul Data and is not Processed on the Customer\u2019s behalf.<\/strong> As provided in Section 2 and Section 13.4 of the Terms, a Claimed Account is a user account that a natural person has created and verified for themselves; it exists at the platform level, is not owned by or specific to any Customer, and may be associated with more than one Customer. The individual who created it, not the Customer, is the person to whom it belongs. MyShul determines the purposes and means of Processing account and credential data associated with a Claimed Account, and is a controller and business with respect to it.\n\nAccordingly, and consistent with Section 13.4 of the Terms:\n\n(a) <strong>nothing in this DPA gives the Customer any ability to delete, disable, suspend, alter, or direct the Processing of any Claimed Account or its sign-in credentials<\/strong>, and no instruction, deletion request, Consumer Request forwarded by the Customer, audit, or termination under this DPA reaches a Claimed Account;\n\n(b) <strong>deletion of Shul Data under any provision of this DPA or of Section 13 of the Terms does not delete, disable, or otherwise affect any Claimed Account<\/strong>, and neither does reassignment of the super admin role under Section 4.7 of the Terms, any change to administrator permissions under Section 4.6 of the Terms, or the suspension or termination of the Customer\u2019s subscription; and\n\n(c) <strong>deletion of a Claimed Account requires a request from the natural person who owns that account, submitted directly to MyShul<\/strong>, as described in Section 13.4 of the Terms and Section 14.2 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.\n\nRecords within a Customer Workspace that are not Claimed Accounts \u2014 including unclaimed records created by import, by administrator entry, or at a kiosk \u2014 are Shul Data and are within the scope of this DPA.\n\n<strong>3.6 Aggregated Data is outside the scope of this DPA.<\/strong> Aggregated Data is not Personal Information. MyShul\u2019s rights in Aggregated Data are governed by Section 11.3 of the Terms and by Section 7 of this DPA.\n\n<strong>3.7 United States only; GDPR and international transfers are out of scope.<\/strong> MyShul offers the Services to Customers located in the United States. Individual Users, and individuals whose records a Customer submits to the Services, may be located outside the United States. <strong>This DPA does not address, and the parties have not agreed terms concerning, the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, any other non-United States data protection law, the European Commission\u2019s standard contractual clauses, the UK International Data Transfer Agreement or Addendum, transfer impact assessments, or any other mechanism for the international transfer of personal data.<\/strong> This DPA contains no such clauses and incorporates none by reference. <strong>If the Customer requires terms addressing any of those instruments, they must be agreed separately in a writing signed by both parties<\/strong>, and MyShul is under no obligation to enter into any such writing. Nothing in this DPA constitutes a representation that the Services are suitable for the Processing of personal data subject to any of those laws.\n\n<hr \/>\n\n<h2>4. Details of the Processing<\/h2>\nThe subject matter, duration, nature and purpose of the Processing, the categories of Personal Information, and the categories of individuals to whom the Personal Information relates are set out in <strong>Annex 1<\/strong>, which forms part of this DPA.\n\n<hr \/>\n\n<h2>5. Documented Instructions<\/h2>\n<strong>5.1 Processing on documented instructions.<\/strong> MyShul will Process Personal Information only on the Customer\u2019s documented instructions, except where Processing is required by law as provided in Section 5.5.\n\n<strong>5.2 What constitutes the Customer\u2019s documented instructions.<\/strong> The Customer\u2019s documented instructions consist of:\n\n(a) the Terms, including the license granted in Section 11.2 of the Terms and the Aggregated Data provision in Section 11.3 of the Terms;\n\n(b) this DPA, including Annex 1;\n\n(c) the Order Form;\n\n(d) the Customer\u2019s configuration and use of the Services, including the fields it creates, the records it enters or imports, the permissions it assigns, the messages it sends, the features it enables, and the instructions its administrators give to any feature of the Services, including any feature that uses artificial intelligence; and\n\n(e) any further instruction the Customer gives in writing that MyShul accepts in writing.\n\n<strong>5.3 Instruction to Process for development, training, improvement, and Aggregated Data.<\/strong> <strong>The Customer\u2019s acceptance of the Terms constitutes its documented instruction to MyShul to Process Personal Information contained in Shul Data for the purposes described in Sections 11.2 and 11.3 of the Terms<\/strong>, including:\n\n(a) hosting, storing, processing, transmitting, displaying, reproducing, backing up, modifying, and creating derivative works of Shul Data to the extent necessary or useful to <strong>provide, maintain, secure, support, and improve the Services<\/strong>;\n\n(b) <strong>developing, training, and improving the machine learning and artificial intelligence features of the Services<\/strong>; and\n\n(c) <strong>creating, using, reproducing, publishing, and otherwise exploiting Aggregated Data<\/strong> for any lawful purpose, including analytics, benchmarking, research, marketing, publication of statistics, and product development.\n\n<strong>This instruction is given for the duration stated in Section 11.2 of the Terms, which is for as long as MyShul holds the relevant Shul Data, and MyShul\u2019s rights in Aggregated Data survive termination as provided in Section 11.3 of the Terms.<\/strong> These uses are described to individuals in Section 7 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.\n\n<strong>5.4 No implied revocation.<\/strong> <strong>No provision of this DPA limits, revokes, narrows, or qualifies the license granted in Section 11.2 of the Terms or the rights granted in Section 11.3 of the Terms.<\/strong> Where a provision of this DPA \u2014 including any provision restricting Processing to the Customer\u2019s instructions, restricting retention or use outside a business purpose, or requiring deletion \u2014 could be read to do so, it is to be read as not doing so. The parties agree that this Section 5 and Sections 6.5 and 7 state the parties\u2019 agreement as to those uses, and that the precedence rule in Section 1.4 of the Terms operates consistently with them and not against them.\n\n<strong>5.5 Processing required by law.<\/strong> MyShul may Process Personal Information where required to do so by applicable law, including in response to a subpoena, court order, or other legal process. Where legally permitted, MyShul will inform the Customer of that requirement before Processing.\n\n<strong>5.6 Unlawful instructions.<\/strong> MyShul will inform the Customer if, in MyShul\u2019s opinion, an instruction from the Customer infringes Applicable Privacy Law. <strong>MyShul is under no obligation to monitor, review, or assess the Customer\u2019s instructions, its configuration of the Services, the contents of any custom field or notes field, or the lawfulness of the Customer\u2019s own Processing<\/strong>, and MyShul does not provide legal advice, as stated in Section 22.3 of the Terms. MyShul may decline to act on an instruction that MyShul reasonably believes would cause it to violate Applicable Privacy Law or the Terms.\n\n<hr \/>\n\n<h2>6. Service Provider and Processor Restrictions<\/h2>\n<strong>6.1 Limited purpose.<\/strong> MyShul Processes Personal Information only for the business purposes set out in Annex 1 and for the purposes stated in Section 5.3, and only pursuant to the written agreement between the parties. <strong>MyShul will not retain, use, or disclose Personal Information for any purpose other than the business purposes specified in this DPA and the Terms, including for a commercial purpose other than those business purposes, and will not retain, use, or disclose Personal Information outside the direct business relationship between MyShul and the Customer<\/strong>, except as permitted by Applicable Privacy Law.\n\n<strong>6.2 No sale; no sharing.<\/strong> <strong>MyShul does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising<\/strong>, as \u201csell,\u201d \u201cshare,\u201d and \u201ccross-context behavioral advertising\u201d are defined in Applicable Privacy Law. MyShul receives no monetary or other valuable consideration in exchange for Personal Information. MyShul does not use Personal Information contained in Shul Data for targeted advertising, and does not use it to market the Services to the Customer\u2019s members or donors, as stated in Section 11 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>. A transfer of Personal Information in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of MyShul\u2019s assets, consistent with Section 27.2 of the Terms and Section 13 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>, is not a sale or sharing for the purposes of this Section, to the extent Applicable Privacy Law so provides.\n\n<strong>6.3 No combining.<\/strong> <strong>MyShul will not combine Personal Information received from or on behalf of the Customer with personal information that MyShul receives from or on behalf of another person, or that MyShul collects from its own interaction with an individual<\/strong>, except as permitted by Applicable Privacy Law for a service provider, including to perform a business purpose permitted under Section 6.5. For the avoidance of doubt, the association of a Claimed Account with a Customer Workspace, as described in Section 9 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>, occurs within the Services at the direction of the Customer and the individual and is not a combination prohibited by this Section.\n\n<strong>6.4 Disclosure.<\/strong> MyShul will not disclose Personal Information to any third party other than a Subprocessor engaged in accordance with Section 10, except at the Customer\u2019s instruction, as required by law under Section 5.5, or as permitted by Applicable Privacy Law.\n\n<strong>6.5 Building and improving the Services.<\/strong> As permitted by Applicable Privacy Law for a service provider, <strong>MyShul may use Personal Information internally to build, improve, maintain, secure, and enhance the quality of the Services<\/strong>, including for internal research and technological development and to develop, train, and improve the machine learning and artificial intelligence features of the Services, as instructed under Section 5.3. In doing so:\n\n(a) <strong>MyShul will not build or modify a profile about any individual for MyShul\u2019s own purposes<\/strong>, and will not build or modify household or consumer profiles to use in providing services to another business;\n\n(b) <strong>MyShul will not use, and will not permit any Subprocessor to use, Personal Information originating in one Customer\u2019s Customer Workspace to provide services to, or for the benefit of, another Customer<\/strong>, and no feature of the Services gives one Customer access to another Customer\u2019s Shul Data, as stated in Section 7 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>; and\n\n(c) MyShul will not use Personal Information to correct or augment data acquired from another source, except as permitted by Applicable Privacy Law.\n\n<strong>Improvement of the Services themselves, which are provided to all Customers in common, is not a use for the benefit of another Customer within the meaning of subsection (b).<\/strong> The parties acknowledge that this is the use instructed under Section 5.3 and permitted by Section 11.2 of the Terms.\n\n<strong>6.6 Sensitive Personal Information.<\/strong> MyShul Processes Sensitive Personal Information contained in Shul Data only for the purposes set out in this DPA and does not use or disclose it for any purpose other than those permitted to a service provider under Applicable Privacy Law. The Customer\u2019s obligations with respect to notice, consent, and legal basis for Sensitive Personal Information are stated in Section 15.\n\n<strong>6.7 Certification.<\/strong> <strong>MyShul certifies that it understands the restrictions set out in this Section 6 and in Section 5, and that it will comply with them.<\/strong>\n\n<strong>6.8 Notification of inability to comply.<\/strong> <strong>MyShul will notify the Customer if MyShul determines that it can no longer meet its obligations under Applicable Privacy Law with respect to Personal Information.<\/strong> Notice under this Section is given as provided in Section 27.3 of the Terms.\n\n<strong>6.9 The Customer\u2019s right to stop and remediate.<\/strong> The Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information by MyShul, and to help ensure that MyShul Processes Personal Information in a manner consistent with the Customer\u2019s obligations under Applicable Privacy Law. <strong>The parties agree that the mechanism in Section 14 is the reasonable and appropriate means by which the Customer may exercise this right<\/strong>, together with the Customer\u2019s right to give instructions under Section 5, to configure and restrict Processing within the Services, and to cancel under Section 10.1 of the Terms. This Section does not grant any right of on-site inspection or any right of access to MyShul\u2019s systems, premises, or personnel.\n\n<hr \/>\n\n<h2>7. Aggregated and De-identified Data<\/h2>\n<strong>7.1 MyShul\u2019s rights.<\/strong> MyShul may create Aggregated Data from Shul Data and from use of the Services, and owns all Aggregated Data, as provided in Section 11.3 of the Terms. <strong>Aggregated Data does not identify the Customer, any User, or any natural person.<\/strong> Aggregated Data is not Personal Information and is treated as de-identified information, aggregate consumer information, or the equivalent under Applicable Privacy Law.\n\n<strong>7.2 De-identification commitments.<\/strong> With respect to Aggregated Data, MyShul will:\n\n(a) <strong>take reasonable measures to ensure that the information cannot be associated with, or reasonably linked to, an individual, household, Customer, or User<\/strong>;\n\n(b) <strong>maintain and use the information in de-identified or aggregated form and not attempt to reidentify it<\/strong>, except where reidentification is undertaken solely for the purpose of determining whether MyShul\u2019s de-identification processes satisfy the requirements of Applicable Privacy Law; and\n\n(c) <strong>contractually obligate any recipient of Aggregated Data to comply with the commitments in subsections (a) and (b)<\/strong>, and not to attempt to reidentify the information.\n\n<strong>7.3 Survival.<\/strong> <strong>MyShul\u2019s rights in Aggregated Data survive termination or expiration of the Terms and of this DPA, as provided in Section 11.3 of the Terms.<\/strong> No provision of this DPA concerning retention, return, or deletion \u2014 including Section 13 \u2014 applies to Aggregated Data, requires its deletion, or otherwise limits MyShul\u2019s rights in it. The deletion of Shul Data does not require the deletion or modification of any Aggregated Data previously created from it.\n\n<hr \/>\n\n<h2>8. Confidentiality of Personnel<\/h2>\n<strong>8.1 Access limited.<\/strong> MyShul limits access to Personal Information to those of its personnel who require access in order to provide, maintain, secure, or support the Services, and restricts access to production systems on a role-based basis, as stated in Section 14.2 of the Terms.\n\n<strong>8.2 Confidentiality obligations.<\/strong> MyShul requires that each individual authorized to Process Personal Information be subject to a written obligation of confidentiality or an equivalent professional duty of confidentiality. That obligation survives the end of that individual\u2019s engagement with MyShul.\n\n<strong>8.3 Training.<\/strong> MyShul informs personnel with access to Personal Information of the confidentiality and use restrictions applicable to it.\n\n<hr \/>\n\n<h2>9. Security<\/h2>\n<strong>9.1 Security measures.<\/strong> <strong>MyShul maintains the administrative and technical measures described in Section 14.2 of the Terms.<\/strong> Those measures are not restated here, and this DPA does not add to them. Additional detail concerning MyShul\u2019s security practices is set out in Section 15 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.\n\n<strong>9.2 No additional representation.<\/strong> <strong>As stated in Section 14.2 of the Terms, MyShul makes no representation that the Services are or will be free from vulnerability, intrusion, or compromise.<\/strong> Nothing in this DPA constitutes such a representation, and the disclaimers in Sections 22.1 and 22.2 of the Terms are unaffected by this DPA. <strong>This DPA does not create any warranty, guarantee, or service level with respect to security, availability, or the integrity of data.<\/strong>\n\n<strong>9.3 The Customer\u2019s security responsibilities.<\/strong> The Customer\u2019s responsibilities for the security of its Customer Workspace, its configuration of roles and permissions, its credentials and devices, and the prompt removal of access for individuals who no longer require it are stated in Section 14.3 of the Terms and are not modified by this DPA. <strong>The Customer acknowledges that the permissions it assigns determine which of its administrators can access which Personal Information within its Customer Workspace.<\/strong>\n\n<hr \/>\n\n<h2>10. Subprocessors<\/h2>\n<strong>10.1 General written authorization.<\/strong> <strong>The Customer gives MyShul general written authorization to engage Subprocessors<\/strong> to Process Personal Information in connection with the provision of the Services.\n\n<strong>10.2 Current list.<\/strong> The current list of Subprocessors is maintained at <a href=\"https:\/\/myshul.com\/software\/subprocessors\/\"><strong>myshul.com\/software\/subprocessors\/<\/strong><\/a>, as provided in Section 19.1 of the Terms. That list is incorporated into this DPA by reference and may be updated by MyShul as provided in Section 10.3.\n\n<strong>10.3 Changes.<\/strong> MyShul may add or replace Subprocessors and will update the list accordingly. <strong>Where a change is material, MyShul will provide notice as provided in Section 19.1 of the Terms<\/strong>, given to the email address associated with the Customer\u2019s account in accordance with Section 27.3 of the Terms. <strong>This DPA does not create a right to object to, or to require the removal of, any Subprocessor, and does not create a right of termination on account of a Subprocessor change.<\/strong> The Customer\u2019s remedy if it does not wish to continue is to cancel under Section 10.1 of the Terms, subject to Section 6.2 of the Terms.\n\n<strong>10.4 Flow-down.<\/strong> MyShul enters into a written agreement with each Subprocessor that imposes on the Subprocessor obligations with respect to Personal Information that are substantially equivalent to, and no less protective than, those imposed on MyShul by this DPA, to the extent applicable to the services the Subprocessor performs.\n\n<strong>10.5 Responsibility.<\/strong> <strong>MyShul remains responsible to the Customer for the performance of each Subprocessor\u2019s obligations with respect to Personal Information<\/strong>, to the same extent MyShul would be responsible if it performed those obligations itself. This Section is subject in all respects to Section 16 and to Section 23 of the Terms.\n\n<strong>10.6 Third-party services that are not Subprocessors.<\/strong> Where the Customer or a User elects to connect the Services to a third-party service, or where a third party acts as the Customer\u2019s own service provider, that third party is not a Subprocessor of MyShul, and Section 19.3 of the Terms applies. <strong>Stripe acts as a payment processor with respect to transactions on the Customer\u2019s connected account, for which the Customer is the merchant of record under Section 8.1 of the Terms<\/strong>, and Stripe\u2019s Processing is governed by Stripe\u2019s own terms.\n\n<hr \/>\n\n<h2>11. Consumer Requests<\/h2>\n<strong>11.1 The Customer controls the response.<\/strong> <strong>Requests from members, donors, and other individuals concerning records in a Customer Workspace are directed to the Customer, which controls that data.<\/strong> As stated in Sections 3 and 14.2 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>, MyShul does not delete, correct, or alter a Customer\u2019s Shul Data at the request of a member or donor. <strong>The Customer is responsible for responding to Consumer Requests concerning Personal Information contained in its Shul Data, including for verifying the identity of the requester, determining whether the request is valid, applying any exception, and responding within the time required by Applicable Privacy Law.<\/strong>\n\n<strong>11.2 Requests received by MyShul.<\/strong> Where MyShul receives a Consumer Request that concerns Personal Information contained in a Customer\u2019s Shul Data, MyShul will not respond to it substantively except as instructed by the Customer or as required by Applicable Privacy Law. MyShul will, where it is able to identify the relevant Customer, inform the individual that the request should be directed to that Customer, and may forward the request to the Customer at the email address associated with the Customer\u2019s account.\n\n<strong>11.3 Assistance.<\/strong> <strong>MyShul will provide reasonable assistance to the Customer in responding to Consumer Requests, through the functionality made available in the Services.<\/strong> That functionality includes the Customer\u2019s ability to access, search, correct, update, and delete records within its Customer Workspace, and the self-service export described in Section 12.1 of the Terms. <strong>MyShul\u2019s assistance obligation is limited to that functionality and to the prepared export described in Section 12.4 of the Terms where self-service export is unavailable.<\/strong> As stated in Section 12.3 of the Terms, MyShul has no obligation to prepare, extract, compile, or deliver data on the Customer\u2019s behalf beyond making that functionality available, and no obligation to build custom outputs, to transform or reformat data, or to migrate data to any other system. <strong>MyShul does not offer a self-service export to individual Users<\/strong>, as stated in Section 16 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.\n\n<strong>11.4 Requests concerning data MyShul controls.<\/strong> A Consumer Request concerning a Claimed Account, or concerning any other information described in Section 3.4, is handled by MyShul in its own right as described in Sections 14.2 and 16 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>. <strong>The Customer has no right under this DPA to make, direct, withdraw, or respond to such a request on an individual\u2019s behalf.<\/strong>\n\n<strong>11.5 Assessments.<\/strong> Where Applicable Privacy Law requires the Customer to conduct a data protection assessment, MyShul will, on written request, make available to the Customer the information described in Section 14.1 to the extent it is reasonably necessary for that assessment and is within MyShul\u2019s possession. <strong>MyShul is under no obligation to conduct, prepare, or contribute to any assessment on the Customer\u2019s behalf.<\/strong>\n\n<hr \/>\n\n<h2>12. Security Incidents<\/h2>\n<strong>12.1 Notification.<\/strong> <strong>Notification of security incidents is governed by Section 14.4 of the Terms.<\/strong> If MyShul becomes aware of a security incident resulting in the unauthorized acquisition of Shul Data, MyShul will notify the Customer without undue delay and will provide the information reasonably available to it.\n\n<strong>12.2 No different standard.<\/strong> <strong>This DPA does not establish a notification standard, trigger, timeline, content requirement, or method different from that in Section 14.4 of the Terms<\/strong>, and does not impose any fixed period within which notice must be given.\n\n<strong>12.3 The Customer\u2019s responsibility.<\/strong> <strong>The Customer is responsible for determining whether notification to its members, donors, any regulator, or any other person is required, and for making any such notification<\/strong>, as provided in Section 14.4 of the Terms. MyShul will reasonably cooperate with the Customer in that process. Nothing in this DPA obligates MyShul to notify any individual on the Customer\u2019s behalf, to fund or reimburse the cost of any notification, or to provide credit monitoring or any similar remedy.\n\n<strong>12.4 Notice address.<\/strong> Notice under this Section is given to the email address associated with the Customer\u2019s account as provided in Section 27.3 of the Terms. <strong>The Customer is responsible for keeping that address current.<\/strong>\n\n<hr \/>\n\n<h2>13. Retention, Return, and Deletion<\/h2>\n<strong>13.1 Governed by the Terms.<\/strong> <strong>Retention, return, and deletion of Shul Data are governed by Sections 12 and 13 of the Terms.<\/strong> This Section cross-references those provisions and does not alter them. <strong>This DPA creates no retention period and no deletion obligation beyond those stated in the Terms.<\/strong>\n\n<strong>13.2 Return of Shul Data.<\/strong> Self-service export is available to accounts in good standing during the term under Section 12.1 of the Terms. <strong>Where self-service export is unavailable to the Customer \u2014 including during suspension of administrative access, following cancellation, and following termination \u2014 MyShul will, on written request, prepare and deliver a copy of the Customer\u2019s Shul Data at no charge, as provided in Section 12.4 of the Terms<\/strong>, on the terms and within the availability periods stated in that Section. <strong>That export is not conditioned on payment of any outstanding balance.<\/strong> The limitations in Sections 12.3, 12.4(e), and 12.4(f) of the Terms apply.\n\n<strong>13.3 Deletion where an account is unpaid.<\/strong> Where an account remains unpaid, MyShul may delete Shul Data on the schedule and following the notices set out in Section 13.2 of the Terms.\n\n<strong>13.4 Deletion following cancellation or termination.<\/strong> Following cancellation or termination, MyShul retains the Shul Data in the Customer Workspace for ninety (90) days after the Customer\u2019s access to the Services ends, provides notice not less than fourteen (14) days before deletion, and may delete the Shul Data thereafter, all as provided in Section 13.7 of the Terms. <strong>As provided in Section 13.3 of the Terms, deletion under Section 13.2 and Section 13.7 of the Terms is a right and not an obligation<\/strong>, and MyShul\u2019s retention of Shul Data beyond any period described in those Sections does not waive its right to delete thereafter.\n\n<strong>13.5 Deletion on the Customer\u2019s written request.<\/strong> <strong>The Customer may request in writing that MyShul delete the Shul Data in its Customer Workspace before the ninety (90) day period has run, and MyShul will act on that request, as provided in Section 13.7(f) of the Terms.<\/strong> MyShul may require verification of the requester\u2019s identity and authority, and may decline or defer where Section 4.7(b) of the Terms applies or where MyShul reasonably believes the request is not authorized. <strong>Timing is at MyShul\u2019s discretion.<\/strong> Such a request is irreversible in effect and forecloses the prepared export under Section 12.4 of the Terms; the Customer should obtain its export before making one.\n\n<strong>13.6 Carve-outs.<\/strong> Deletion under this Section and under Section 13 of the Terms reaches Shul Data within the Customer Workspace only. <strong>It does not reach, and this DPA does not require the deletion of:<\/strong>\n\n(a) <strong>any Claimed Account<\/strong>, which is governed by Section 13.4 of the Terms and by Section 3.5 of this DPA;\n\n(b) <strong>records of funds processed through the Services, including transaction history<\/strong>, which MyShul retains regardless of any deletion of Shul Data for accounting, audit, tax, fraud-prevention, dispute-resolution, and legal-compliance purposes under Section 13.5 of the Terms, and transaction records held by Stripe, which are retained by Stripe under its own terms and are not within MyShul\u2019s control or ability to delete;\n\n(c) <strong>data persisting in backups, archives, and system logs<\/strong>, which is governed by Section 13.6 of the Terms and which is deleted in accordance with MyShul\u2019s ordinary retention cycles;\n\n(d) <strong>Aggregated Data<\/strong>, as provided in Section 7.3; and\n\n(e) information described in Section 3.4, including the acceptance records described in Section 1.3 of the Terms, which MyShul retains as evidence of the agreement between the parties.\n\n<strong>13.7 Retention required by law.<\/strong> MyShul may retain Personal Information where required by applicable law, and will limit its Processing of information so retained to the purpose that requires its retention.\n\n<strong>13.8 Deletion of individual records.<\/strong> <strong>The Customer may delete individual records within its Customer Workspace using the functionality of the Services at any time during the term.<\/strong> This DPA does not obligate MyShul to delete any individual record on the Customer\u2019s behalf.\n\n<hr \/>\n\n<h2>14. Documentation and Audit<\/h2>\n<strong>14.1 Information available.<\/strong> On the Customer\u2019s written request, MyShul will make available information reasonably necessary to demonstrate MyShul\u2019s compliance with this DPA, in the form of <strong>(a) reasonable documentation concerning MyShul\u2019s Processing of Personal Information and its security measures, and (b) written responses to a reasonable written questionnaire prepared by the Customer.<\/strong>\n\n<strong>14.2 Limits.<\/strong> Requests under Section 14.1:\n\n(a) may be made <strong>not more than once in any twelve (12) month period<\/strong>, except where required more frequently by Applicable Privacy Law or following a security incident notified under Section 12;\n\n(b) are <strong>at the Customer\u2019s expense<\/strong>, including MyShul\u2019s reasonable costs of responding;\n\n(c) must be reasonable in scope and must allow MyShul a reasonable period to respond;\n\n(d) are subject to Section 17 of the Terms, and all information provided is MyShul\u2019s confidential information; and\n\n(e) do not extend to information that MyShul is prohibited from disclosing by law or by an obligation of confidentiality owed to a third party, to information concerning another Customer, or to MyShul\u2019s source code, internal security testing results, or non-public elements of the Services beyond what is reasonably necessary to respond.\n\n<strong>14.3 No inspection, certification, or audit report.<\/strong> <strong>This DPA does not grant any right of on-site inspection, physical or remote access to MyShul\u2019s systems, premises, personnel, or networks, or any right to conduct penetration testing, vulnerability scanning, or any other technical assessment of the Services.<\/strong> <strong>MyShul does not hold, and does not undertake to obtain, maintain, or provide, a SOC 2 report, ISO 27001 certification, or any other third-party audit report, attestation, or certification<\/strong>, and nothing in this DPA obligates it to engage an independent assessor.\n\n<strong>14.4 Alternative satisfaction.<\/strong> Where Applicable Privacy Law contemplates that a processor make available to a controller information sufficient to demonstrate compliance, or permit reasonable assessments, <strong>the parties agree that the mechanism in this Section 14 is the means by which MyShul satisfies that requirement<\/strong>, and that it is reasonable having regard to the nature and scale of the Services.\n\n<hr \/>\n\n<h2>15. Customer Obligations and Representations<\/h2>\n<strong>15.1 Notice, consent, and legal basis.<\/strong> The Customer represents and warrants, as provided in Section 15.5 of the Terms, that <strong>it has provided its members, donors, and other individuals whose information it submits to the Services with any privacy notice or disclosure required by law applicable to its organization, and that it has any consent or other legal basis required for MyShul to receive and Process that information as described in the Terms, in this DPA, and in the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.<\/strong> This includes any consent required by Applicable Privacy Law for the Processing of Sensitive Personal Information, and any consent required for the Processing of information concerning a known child.\n\n<strong>15.2 Rights in the data submitted.<\/strong> The Customer represents that it has all rights necessary to submit Shul Data to the Services and to grant the licenses in Section 11 of the Terms, as provided in Section 11.4 of the Terms.\n\n<strong>15.3 Records concerning minors.<\/strong> The Customer\u2019s obligations with respect to records concerning individuals under thirteen (13) years of age, including its representation that it holds the parental or guardian consent necessary to submit such records, are stated in Section 4.2 of the Terms.\n\n<strong>15.4 Communications.<\/strong> The Customer\u2019s representations concerning its right to provide each phone number and email address, its consents for the messages it sends, and its compliance with the Telephone Consumer Protection Act, the CAN-SPAM Act, and other applicable communications laws are stated in Section 15.5 of the Terms. <strong>The Customer is the sender and content owner of messages it sends through the Services, and MyShul acts solely as a conduit<\/strong>, as provided in Section 15.2 of the Terms.\n\n<strong>15.5 Migration and onboarding outreach.<\/strong> The Customer\u2019s authorization of migration and onboarding outreach, and its representation that it has the right to provide the contacts used for it, are stated in Section 15.6 of the Terms.\n\n<strong>15.6 Custom fields and content.<\/strong> <strong>The Customer determines what information it records in the Services, including in custom fields and notes fields. MyShul does not control, review, or limit what a Customer records in them<\/strong>, as stated in Sections 4.5 and 5 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>. The Customer is responsible for ensuring that the categories of Personal Information it submits are lawful, are consistent with the notices it has given, and are appropriate to the Services.\n\n<strong>15.7 Instructions.<\/strong> The Customer is responsible for ensuring that its instructions comply with Applicable Privacy Law. The Customer\u2019s indemnification obligations under Section 24.1 of the Terms, including subsections (a), (b), (c), and (h), apply to claims arising from the matters described in this Section 15.\n\n<strong>15.8 Individuals outside the United States.<\/strong> Where the Customer submits to the Services information concerning individuals located outside the United States, <strong>the Customer is responsible for compliance with any non-United States data protection law applicable to it<\/strong> in respect of that information, including any notice, consent, legal basis, or data subject rights obligation. Section 3.7 applies, and MyShul\u2019s representations and obligations under this DPA are unchanged.\n\n<hr \/>\n\n<h2>16. Liability<\/h2>\n<strong>16.1 Subject to the Terms.<\/strong> <strong>Each party\u2019s liability arising out of or relating to this DPA is subject to the exclusions of damages, the limitations of liability, and the aggregate liability cap set out in Section 23 of the Terms<\/strong>, and all claims arising out of or relating to this DPA are aggregated with all other claims under the Terms for the purpose of that cap.\n\n<strong>16.2 No increase in liability.<\/strong> <strong>This DPA does not increase, alter, expand, or create any exception to MyShul\u2019s aggregate liability under the Terms.<\/strong> The exceptions in Section 23.4 of the Terms are unaffected and are neither expanded nor narrowed by this DPA. This DPA creates no indemnification obligation, and Section 24 of the Terms is unaffected.\n\n<strong>16.3 No third-party beneficiaries.<\/strong> <strong>This DPA is for the sole benefit of MyShul and the Customer. No User, member, donor, or other individual is a third-party beneficiary of this DPA or has any right to enforce any provision of it<\/strong>, consistent with Section 27.8 of the Terms.\n\n<hr \/>\n\n<h2>17. Term, Amendment, and General<\/h2>\n<strong>17.1 Term.<\/strong> This DPA takes effect on the Effective Date stated above, or on the date the Customer accepts the Terms if later, and <strong>remains in effect for as long as MyShul Processes Personal Information contained in the Customer\u2019s Shul Data<\/strong>. Section 14.5 of the Terms survives termination as provided in Section 27.7 of the Terms, and the provisions of this DPA that by their nature should survive \u2014 including Sections 5.4, 6, 7, 8, 13, 16, and this Section 17 \u2014 survive the termination or expiration of the Terms.\n\n<strong>17.2 Amendment.<\/strong> MyShul may modify this DPA as provided in Section 25 of the Terms, including the thirty (30) day notice requirement for material changes in Section 25.1 and the version archive in Section 25.3.\n\n<strong>17.3 Notices.<\/strong> Notices under this DPA are given as provided in Section 27.3 of the Terms. Notices to MyShul must be sent to <a href=\"mailto:info@myshul.com\">info@myshul.com<\/a> and, for any formal legal notice, also by mail to MYSHUL LLC, 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020.\n\n<strong>17.4 Governing law and venue.<\/strong> <strong>This DPA is governed by the laws of the State of Florida, without regard to its conflict-of-laws principles, and the exclusive jurisdiction and venue provisions of Section 26 of the Terms apply<\/strong>, including the jury trial waiver in Section 26.3. Sections 6.8 and 26.4 of the Terms apply to any dispute arising under this DPA.\n\n<strong>17.5 Severability.<\/strong> If any provision of this DPA is held invalid, illegal, or unenforceable, Section 27.5 of the Terms applies. <strong>The invalidity or unenforceability of any provision of this DPA does not affect the validity or enforceability of Section 11.2 or Section 11.3 of the Terms.<\/strong>\n\n<strong>17.6 Assignment.<\/strong> Section 27.2 of the Terms applies to this DPA.\n\n<strong>17.7 Entire agreement.<\/strong> This DPA, together with the Terms, the Order Form, and the other documents identified in Section 1.4 of the Terms, constitutes the entire agreement between the parties concerning the Processing of Personal Information contained in Shul Data and supersedes any prior or contemporaneous understanding on that subject. <strong>No purchase order, vendor form, security questionnaire response, or other document issued by the Customer modifies this DPA<\/strong>, and any conflicting or additional terms in such a document are void, as provided in Section 27.4 of the Terms.\n\n<hr \/>\n\n<h2>Annex 1 \u2014 Details of the Processing<\/h2>\n<strong>A. Subject matter.<\/strong> MyShul\u2019s provision of the Services to the Customer under the Terms, and the Processing of Personal Information contained in Shul Data in the course of that provision.\n\n<strong>B. Duration.<\/strong> For the term of the Customer\u2019s subscription and thereafter for so long as MyShul holds the relevant Shul Data, as determined by Sections 12 and 13 of the Terms. MyShul\u2019s rights in Aggregated Data survive as provided in Section 11.3 of the Terms.\n\n<strong>C. Nature of the Processing.<\/strong> Hosting, storage, transmission, display, reproduction, back-up, organization, retrieval, consultation, modification, creation of derivative works, and deletion, by automated and non-automated means, as necessary or useful to provide, maintain, secure, support, and improve the Services.\n\n<strong>D. Purposes of the Processing.<\/strong>\n<ol>\n \t<li>Providing the Services described in Section 3.1 of the Terms, including member and constituent management, invoicing and billing, payment processing through Stripe, donation processing, scheduling, event management, member engagement and communications tools, self-service kiosk functionality, and the related web and mobile applications.<\/li>\n \t<li>Creating, verifying, and authenticating accounts and administering access.<\/li>\n \t<li>Processing payments and generating invoices, receipts, statements, and payout reports.<\/li>\n \t<li>Sending transactional messages, including verification codes, payment requests, billing notices, and account notices.<\/li>\n \t<li>Transmitting communications that the Customer sends to its members and donors, for which the Customer is the sender.<\/li>\n \t<li>Providing customer support and troubleshooting.<\/li>\n \t<li>Operating features that use artificial intelligence, as described in Section 7 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>, at the direction of the Customer\u2019s administrators.<\/li>\n \t<li>Maintaining security, detecting and preventing fraud and abuse, and maintaining security and audit logs.<\/li>\n \t<li><strong>Developing, training, and improving the Services, including the machine learning and artificial intelligence features of the Services<\/strong>, as instructed under Section 5.3 of this DPA and permitted by Section 11.2 of the Terms.<\/li>\n \t<li><strong>Creating and using Aggregated Data<\/strong>, as instructed under Section 5.3 of this DPA and permitted by Section 11.3 of the Terms.<\/li>\n \t<li>Complying with legal obligations and enforcing the Terms.<\/li>\n<\/ol>\n<strong>E. Categories of individuals.<\/strong> Members of the Customer; donors and other contributors; prospective members and other constituents whose records the Customer enters or imports; guests and other individuals who transact at a kiosk or as a guest without signing in; event registrants; household and family members recorded on a Customer\u2019s records, including individuals under thirteen (13) years of age whose records the Customer submits under Section 4.2 of the Terms; the Customer\u2019s administrators, officers, clergy, staff, and volunteers; and other Users affiliated with the Customer.\n\n<strong>F. Categories of Personal Information.<\/strong> As determined by the Customer\u2019s use of the Services, and drawn from Sections 4 and 5 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>:\n<ol>\n \t<li><strong>Identifiers and contact information<\/strong> \u2014 name, email address, phone number, mailing address, and Hebrew name.<\/li>\n \t<li><strong>Membership and household records<\/strong> \u2014 membership status, household and family relationships, and constituent categorization.<\/li>\n \t<li><strong>Dates and life events<\/strong> \u2014 dates of birth, anniversaries, and yahrzeits.<\/li>\n \t<li><strong>Synagogue records<\/strong> \u2014 seat assignments, aliyah honors and other synagogue honors, event registrations, and attendance.<\/li>\n \t<li><strong>Financial and transactional records<\/strong> \u2014 donation, pledge, dues, tuition, and event payment history; invoices, receipts, and payment records; and limited payment method information consisting of card brand, last four digits, and expiration month and year. <strong>Full payment card numbers, CVC and CVV codes, PINs, and magnetic stripe data are not received or stored by MyShul and are held by Stripe<\/strong>, as stated in Section 8.1 of the Terms and Section 8.1 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.<\/li>\n \t<li><strong>Communications<\/strong> \u2014 messages sent to or from individuals through the Services and records of those communications, together with consent and opt-out status.<\/li>\n \t<li><strong>Notes and free-text content<\/strong> \u2014 notes written by the Customer\u2019s administrators.<\/li>\n \t<li><strong>Custom fields<\/strong> \u2014 <strong>any additional category of information the Customer chooses to create and record. MyShul does not control, review, or limit what a Customer records in a custom field or notes field, and cannot predict what categories a particular Customer may record.<\/strong> See Sections 4.5 and 5 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a> and Section 15.6 of this DPA.<\/li>\n \t<li><strong>Technical information<\/strong> \u2014 IP address, device and browser type, operating system, and usage, interaction, diagnostic, and performance data associated with use of the Customer Workspace.<\/li>\n<\/ol>\n<strong>G. Sensitive Personal Information.<\/strong> <strong>Shul Data can reveal religious affiliation.<\/strong> A record showing that an individual belongs to, attends, donates to, or holds honors at a synagogue can reveal religious or ethnic affiliation, whether or not the individual considers themselves religious; records such as aliyah honors, Hebrew names, and yahrzeits are more specific still. Yahrzeit records identify the death of a relative, and household records identify family relationships. Shul Data may also include records concerning individuals under thirteen (13) years of age. <strong>Because the Customer controls what it records in custom fields, MyShul cannot predict or limit what further categories of Sensitive Personal Information a particular Customer may submit.<\/strong>\n\nThe Services are not designed to hold, and MyShul does not ask for, Social Security numbers, government identification numbers, driver\u2019s license numbers, health or medical records, or biometric information. <strong>Where a Customer\u2019s Stripe connected account representative provides identity and verification information to Stripe, which may include a government identification number, that information is collected by Stripe directly and is not received by MyShul<\/strong>, as stated in Section 8.10(c) of the Terms and Section 5 of the <a href=\"https:\/\/myshul.com\/software\/privacy\/\">MyShul Privacy Policy<\/a>.\n\n<strong>H. Frequency of Processing.<\/strong> Continuous, for the duration stated in paragraph B.\n\n<strong>I. Subprocessors.<\/strong> As listed at <a href=\"https:\/\/myshul.com\/software\/subprocessors\/\">myshul.com\/software\/subprocessors\/<\/a>, and as provided in Section 10.\n\n<hr \/>\n\n<strong>MYSHUL LLC<\/strong> | 2843 Pembroke Rd, Suite 3, Hollywood, FL 33020 | <a href=\"mailto:info@myshul.com\">info@myshul.com<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>MyShul Data Processing Addendum Effective Date: October 26, 2026 This Data Processing Addendum (the \u201cDPA\u201d) is incorporated into the MyShul Administrator Terms of Service (the \u201cTerms\u201d) by Section 14.5 of the Terms, and forms part of the agreement between MYSHUL LLC, a Florida limited liability company with offices at 2843 Pembroke Rd, Suite 3, Hollywood, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3176","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/pages\/3176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/comments?post=3176"}],"version-history":[{"count":17,"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/pages\/3176\/revisions"}],"predecessor-version":[{"id":3648,"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/pages\/3176\/revisions\/3648"}],"wp:attachment":[{"href":"https:\/\/myshul.com\/software\/wp-json\/wp\/v2\/media?parent=3176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}