Data processing terms

These data processing terms form part of our terms of service. They apply to personal information that Shep handles on your church’s behalf (“church data”). Your church is the controller of church data and Shep is its processor (or, in Australia and New Zealand, its service provider and agent).

They are written to meet APP 8 and APP 11 of the Australian Privacy Act 1988, IPPs 5 and 12 of the New Zealand Privacy Act 2020, and Article 28 of the UK and EU GDPR. If these terms and the terms of service conflict on church data, these terms win.

We handle church data only to provide Shep, following your church’s documented instructions. Using Shep’s features and settings counts as an instruction. If the law requires us to handle church data another way, we will tell your church first unless the law forbids it. If we think an instruction breaks privacy law, we will tell your church.

Everyone at Shep who can access church data is bound by confidentiality and accesses it only when needed to support your church, keep Shep secure or fix a problem.

We keep appropriate technical and organisational measures in place, including:

• encryption in transit (TLS) and at rest;
• role-based access and row-level security separating each church’s data;
• encryption of credentials for connected systems;
• audit logs of privileged actions;
• least-privilege staff access to production systems; and
• regular encrypted backups.

More detail is on our security page.

Your church gives general authorisation for us to use the sub-processors listed on our sub-processors page. We bind each one to data protection terms at least as protective as these, and we remain responsible for them.

We will give church admins at least 30 days’ notice by email before adding or replacing a sub-processor. If your church reasonably objects, we will work with it in good faith; if we cannot resolve the objection, your church may end the agreement without penalty.

Church data is stored in Australia. Where a sub-processor handles church data outside Australia, we take the reasonable steps APP 8 and IPP 12 require, including binding contracts. For data subject to the UK or EU GDPR, we rely on adequacy decisions or the standard contractual clauses (and the UK addendum), which are incorporated into these terms by reference where needed.

If a person asks us to access, correct or delete church data about them, we will pass the request to your church within 5 business days, unless your church has asked us to answer such requests directly. Shep’s features let your church respond to most requests itself, and we will help with the rest.

If we become aware of a breach affecting church data, we will tell your church without undue delay, and in any case within 48 hours. We will share what we know about what happened, the information and people affected, what we are doing about it, and a contact person.

We will help your church assess whether the breach is an eligible data breach under the Notifiable Data Breaches scheme, a notifiable breach under the NZ Privacy Act, or a breach requiring notice under the GDPR, and with notifying regulators and affected people.

Your church can export church data at any time while it uses Shep, and for 30 days after it leaves. We then delete church data within 90 days, except where the law requires us to keep it. Copies in encrypted backups are overwritten on their normal cycle.

We will give your church the information it reasonably needs to show it is meeting its privacy obligations, including answers to security questionnaires. Where that is not enough, your church may audit our compliance once a year, with 30 days’ notice, at its own cost, and under confidentiality.