Data Processing Agreement

1. Scope and Roles

This Data Processing Agreement (this “DPA”) is entered into between RAIZEIT LLC, an Alabama limited liability company doing business as Manna (“Manna”), and the organization that uses the Platform (the “Organization”). It governs Manna’s processing of Personal Information on the Organization’s behalf.

As between the parties, the Organization is the controller, or “business,” of Organization Data, and Manna is the processor, or “service provider.” The Organization determines the purposes and means of processing. Manna processes Personal Information only as permitted by Section 3.

Manna acts as a separate and independent controller with respect to data it processes for its own purposes, including account administration, billing, fraud and abuse prevention, security, legal compliance, and the operation and improvement of the Platform. That processing is governed by the Privacy Policy and not by this DPA.

Terms not defined in this DPA have the meaning given in the Organization Terms of Service or in applicable data protection law.

2. Details of Processing

1. Subject matter. Provision of the Platform under the Organization Terms of Service.
2. Duration. The term of the Organization’s account, together with any retention period described in Section 9.
3. Nature and purpose. Hosting, storing, organizing, transmitting, and making available Organization Data so that the Organization may accept contributions, maintain contribution records, communicate with donors, and export its data.
4. Types of Personal Information. Donor name, email address, postal address, telephone number, occupation, employer, contribution amount and date, and payment method type, brand, and last four digits; organization details including legal name, employer identification number, address, and application materials; and, for the Organization’s members, name, email address, telephone number, and account credentials.
5. Categories of data subjects. The Organization’s donors, its members and personnel, and visitors to its donation pages.
6. Sensitive data. The Platform is not designed to collect special categories of personal information beyond information inherent in political contribution records. The Organization shall not submit other categories of sensitive personal information through the Platform.

3. Manna’s Obligations

Manna shall:

1. process Personal Information only on the Organization’s documented instructions, which comprise this DPA, the Organization Terms of Service, and the Organization’s use of the Platform;
2. not sell or share Personal Information, and not process it for cross-context behavioral advertising or targeted advertising;
3. not retain, use, or disclose Personal Information for any purpose other than performing the services, except as permitted by applicable law;
4. not combine Personal Information with information received from another source, except as permitted by applicable law;
5. ensure that personnel with access to Personal Information are bound by a duty of confidentiality; and
6. notify the Organization where Manna determines that it can no longer meet its obligations under applicable data protection law.

Manna may process Personal Information where required by law. Where legally permitted, Manna shall inform the Organization before doing so.

4. The Organization’s Obligations

The Organization is responsible for, and warrants that:

1. it has a lawful basis to collect and process the Personal Information it submits to the Platform, and its instructions do not cause Manna to violate any law;
2. it has provided all notices and obtained all consents required for the collection, use, and disclosure of Personal Information through the Platform, including for its own communications with donors;
3. the content and accuracy of Organization Data, and its configuration of donation pages and fields;
4. responding to data subjects concerning its own use of their information; and
5. maintaining its own records as required by law, the Platform not being its system of record.

5. Security

Manna shall maintain reasonable and appropriate technical and organizational measures designed to protect Personal Information against unauthorized access, use, disclosure, alteration, and destruction, having regard to the nature of the processing and the state of the art. Those measures presently include encryption in transit, encryption at rest provided by Manna’s infrastructure providers, application-level role-based access controls, and automated error monitoring.

Manna may update these measures provided the overall level of protection is not materially reduced. The Organization is responsible for its own security practices, including safeguarding account credentials, managing member access, and removing members whose access should end.

6. Subprocessors

The Organization authorizes Manna to engage subprocessors in the provision of the Platform. Manna presently engages subprocessors in the following categories: payment processing; hosting and database infrastructure; transactional email delivery; error monitoring and performance diagnostics, which may include masked recordings of page interactions; website analytics; and content delivery.

A current list of named subprocessors is available on request at support@mannagive.com.

Manna shall impose on each subprocessor data protection obligations substantially similar to those in this DPA and remains responsible for each subprocessor’s performance of those obligations.

Manna may add or replace subprocessors and shall give notice of a new subprocessor by updating the categories listed above or by notice to the Organization. Where the Organization reasonably objects to a new subprocessor on data protection grounds, it may notify Manna within 10 days of that notice, and the parties shall discuss the objection in good faith. Where the objection is not resolved, the Organization’s sole and exclusive remedy is to cease using the affected feature or to terminate its account.

7. Assistance With Individual Rights

The Platform provides features enabling the Organization to access and export Organization Data. Where a request from a data subject can be satisfied using those features, the Organization shall do so.

For correction or deletion of individual records, and for any request that cannot be satisfied using Platform features, the Organization may contact Manna at support@mannagive.com. Manna shall provide reasonable assistance at the Organization’s expense, having regard to the nature of the processing. Contribution records subject to campaign finance record-keeping or public disclosure requirements may not be eligible for deletion.

Where Manna receives a request directly from one of the Organization’s data subjects concerning Organization Data, Manna shall not respond substantively except to direct the individual to the Organization, and shall forward the request to the Organization, unless required by law to do otherwise.

8. Security Incidents

Manna shall notify the Organization without undue delay after becoming aware of a confirmed breach of security resulting in unauthorized access to, or disclosure of, Personal Information processed on the Organization’s behalf. Manna shall provide the information reasonably available to it and shall take reasonable steps to mitigate and remediate the incident.

The Organization is responsible for determining whether an incident requires notification to any individual or regulator in respect of Organization Data, and for making any such notification. Notification by Manna is not an acknowledgment of fault or liability.

9. Retention and Deletion

The Organization may export Organization Data at any time using Platform features.

Upon termination, Manna shall deactivate the Organization’s account and shall retain Organization Data in accordance with the retention periods described in the Privacy Policy. The Organization may request deletion of Organization Data that is not subject to a legal retention obligation, and that is not necessary to resolve a dispute or enforce an agreement, by contacting support@mannagive.com. Data contained in backups, logs, and archives is deleted on a routine cycle.

Manna may retain aggregated and de-identified data that does not identify the Organization or any data subject.

10. Demonstrating Compliance

Manna shall make available information reasonably necessary to demonstrate compliance with this DPA. Where a documented assessment or third-party report is available, Manna may satisfy any audit or assessment right by providing it.

Where applicable law requires an audit beyond the foregoing, that audit is subject to each of the following conditions:

1. no more than once in any twelve-month period, unless required by a regulator;
2. not less than 30 days’ prior written notice;
3. conducted during normal business hours and without unreasonable disruption to Manna’s operations;
4. limited to information relevant to Personal Information processed for the Organization;
5. conducted by the Organization or by a qualified and independent assessor bound by confidentiality and not a competitor of Manna; and
6. entirely at the Organization’s expense, including Manna’s reasonable costs of participation.

Manna shall not be required to disclose information concerning other customers or information the disclosure of which would compromise its security or its confidentiality obligations.

11. Liability

Each party’s liability arising out of or relating to this DPA is subject to the disclaimers, exclusions, and limitation of liability set out in the Organization Terms of Service. This DPA creates no additional liability, and any claim under it counts toward, and does not increase, the aggregate cap in those terms.

12. Term, Modification, and Conflict

This DPA takes effect upon the Organization’s acceptance of the Organization Terms of Service or its first use of the Platform, and continues for so long as Manna processes Personal Information on the Organization’s behalf.

Manna may modify this DPA by posting an amended version, including to reflect changes in law or in the Platform. A modification takes effect upon posting, and continued use of the Platform constitutes acceptance.

In the event of conflict between this DPA and the Organization Terms of Service, this DPA controls with respect to the processing of Personal Information, and the Organization Terms of Service control in all other respects. This DPA is governed by the law and the dispute resolution provisions of the Organization Terms of Service.

13. Contact

RAIZEIT LLC, doing business as Manna. support@mannagive.com. Enquiries may also be submitted through the Contact page.