Data Processing Agreement (DPA)

Last updated: 18.10.2026. Version: 1.1.

 

1. Who this agreement is between

The church (the “controller”): the church whose lead accepts this agreement on Pastors Network.

Concentric IT Ltd (the “processor”), which runs Pastors Network. Company number 05012213. 179 Walmersley Road, Bury, Lancs, BL9 5DF.

This agreement forms part of the arrangement between the church and Concentric IT Ltd for using Pastors Network. It sets out what UK GDPR Article 28 requires.

 

2. How it is accepted

The church’s lead accepts this agreement on the church’s behalf on a screen shown before they first reach the Dashboard. By accepting, they confirm they have the church’s authority. We record who accepted, when, and which version. If we change this agreement, the lead is asked to accept the new version. Until a version is accepted, the church cannot add compliance records.

If the church’s lead changes, the church’s acceptance stays in place.

The church may also sign a paper copy if it prefers (section 15).

 

3. What the church keeps on Pastors Network

Whose information:

• members, attenders, contacts and their households;
• people the church visits, prays for or cares for;
• people who serve, volunteer or work for the church, and their clearances and training;
• people involved in processes the church runs, such as couples marrying, families arranging a funeral, and newcomers;
• children, where the church records them in its members list.

What information:

• names, contact details, addresses, dates of birth or age group, gender and marital status;
• member type, households, tags, milestones and key dates;
• pastoral visit records and prayer points, including anything written in their notes;
• compliance records: the requirement, dates, the level and reference number of a DBS check, training records and, for items other than DBS, a copy of the certificate if the church uploads one. DBS items do not accept certificate images;
• roles, references, interviews and probation records for safer recruitment;
• wedding, funeral and other process details, which may include contact details of people outside the church and, for a funeral, the name, age and date of death of the person who has died;
• serving rotas and the answers people give;
• anything else the church’s team types into free-text boxes.

Special category information (UK GDPR Article 9): religious belief (implied by a link with a church), and health or family matters if written in notes.

Criminal offence information (UK GDPR Article 10): DBS check results, including a clear result.

 

4. What we do with it

We process the information only to provide Pastors Network to the church:

• storing it and showing it to the people the church’s team settings allow;
• sending the emails, notices and reminders the church’s use of the platform sets off;
• making reports, lists and PDFs the church asks for;
• keeping nightly copies so the church can be put back after an accident.

We do not use the church’s information for our own purposes. We do not sell it, share it with other churches, or use it to market anything.

 

5. The church’s responsibilities

The church is the controller. It must:

• have a lawful basis for everything it keeps: both an Article 6 basis and, for special category or criminal offence information, the right condition. Our member privacy notice template sets out legitimate interests as the Article 6 basis, with the not-for-profit condition, Article 9(2)(d), for special category information;
• for DBS records, rely on the right condition in Schedule 1 to the Data Protection Act 2018. For volunteers who are members or regular attenders, this is normally paragraph 31 (not-for-profit bodies). For anyone else, such as staff who are not members, it is normally paragraph 18 (safeguarding), with the church’s own appropriate policy document (we provide a template);
• record only the details of a DBS check (its level, reference number and dates), and not copy anything else from the certificate into notes;
• give its people a privacy notice that says it uses Pastors Network. We provide a template;
• decide who on its team can see what, using Manage Team;
• not enter more than it needs;
• not put a member’s health, family or private details into anything another church sees, such as Ask for Help, pulpit dates, recommendations or shared events. The not-for-profit condition does not cover sharing outside the church without consent;
• not record safeguarding concerns or allegations. Compliance tracks clearances and training only;
• tell us promptly about any request or complaint it receives that involves our part;
• keep its own records of processing where the law requires them.

 

6. Our responsibilities

We will:

(a) Act only on the church’s instructions. Using Pastors Network, and the settings the church chooses, are the church’s instructions. Anything outside the normal service must be asked for in writing, including by email. We will tell the church if we think an instruction breaks data protection law.

(b) Keep it confidential. Everyone we allow to handle the church’s information has signed a written confidentiality commitment.

(c) Not look at it without a request. Nobody in our office has standing access to a church’s records. We look only when the church asks us in writing, for example to help with a problem. We log each look, and only someone who has signed the confidentiality commitment may do it. A person’s own notes and the prayers they keep for “Just me” are theirs, not the church’s: we put one back only when that person asks us in writing from the email address on their account, never on the church’s request. To find it we see only its date and its first few words. We log it and tell the person when it is done.

(d) Keep it secure (Article 32). Our measures include:

• encrypted connections (HTTPS);
• scrambled passwords, optional passkeys, sign-out after 30 minutes without use, and lockouts after repeated failed sign-ins;
• the church’s own permission settings for each person;
• certificate and document files kept outside the public part of the site, served only to people allowed to see them, with each download logged;
• nightly copies of each church’s records, locked (encrypted) with a key kept offline, not on our server, and kept for 30 days;
• regular updates and security fixes.

We do not currently require two-factor sign-in or passkeys.

(e) Use only approved sub-processors (section 7).

(f) Help the church with people’s rights. We will help the church answer requests to see, correct, delete, restrict, move or object to information, as far as the platform allows. Each person can download their own account data themselves. If someone contacts us directly about a church’s records, we will pass the request to the church.

(g) Help with security, breaches and impact assessments. We will give the church the information it needs. We will provide our platform data protection impact assessment (DPIA) before the church enters real records. The church can adopt it, with a one-page addendum about its own use.

(h) Delete or return at the end (section 10).

(i) Show we are keeping to this agreement, and allow audits (section 11).

 

7. Sub-processors

The church agrees to these sub-processors:

If Postmark cannot deliver a message, it may be sent through 20i’s own mail system instead.

Push notices, if a person turns them on, are delivered through that person’s own browser maker. The message is locked so the browser maker cannot read it.

We will tell the church by email at least 30 days before we add or replace a sub-processor that handles the church’s records. The church may object in writing within 14 days. If we cannot resolve the objection, either side may end this agreement on 30 days’ notice.

Our sub-processors use their own suppliers. We bind each sub-processor to data protection terms that meet Article 28. We check their published lists of their own suppliers, but we cannot promise 30 days’ notice of their changes. For Postmark, those terms are Postmark’s newer data processing addendum, which applies to accounts opened after 10 December 2024, as ours was: the version effective 17 November 2025.

 

8. Where the information is kept

The church’s records are kept in the United Kingdom. Emails pass through Postmark in the United States, as above. We will not move the church’s records anywhere else outside the UK without the church’s written agreement and a lawful safeguard.

 

9. Breaches

If we find a breach affecting the church’s records, we will tell the church without undue delay, and in any case within 48 hours of becoming aware. We will give the church what it needs to decide whether to report it to the Information Commission (ICO) (within 72 hours where required) and to tell the people affected. If we do not have everything at first, we will send it as we get it. We will help contain and fix the problem.

The church decides whether to report the breach to the ICO and whether to tell the people affected.

 

10. Ending this agreement

This agreement lasts as long as the church uses Pastors Network.

When the church closes its account, it has 30 days to download its records, or to ask us for a copy of them. At the end of those 30 days, we delete its records. If the church asks us to delete them sooner, we will.

The church can download its records from these tools: Members, Pastoral Visits, Compliance, Operations, Documents, Library and Guest speakers. Each person on the church’s team can also download their own account data. On the church’s written request, we will send any other records we hold for it within those 30 days.

Its nightly copies are deleted at the same time as its records. We will confirm the deletion in writing (email is fine) within 30 days of the church’s request.

Our host, 20i, also takes a daily backup of the whole site. These can be restored for 30 days. 20i deletes older ones when it needs the space, so some may be kept for longer. They are used only to restore the site after a failure. If one is ever used, anyone erased since is erased again at once.

 

11. Audits

We will give the church the information it needs to show we are keeping to this agreement. The church, or an auditor it appoints, may audit our handling of its records:

• with at least 30 days’ written notice, unless after a confirmed breach;
• no more than once a year, unless a breach or a regulator’s investigation needs it;
• at the church’s cost, unless the audit finds we have materially broken this agreement;
• limited to how we handle the church’s records.

We may meet this, in whole or in part, by giving reports or certificates.

 

12. Liability

Each side is liable to the other for direct losses caused by its own breach of this agreement. The limit of liability in our Terms of Use does not apply to this agreement, to breaches of data protection law, or to anyone’s right to compensation under UK GDPR Article 82.

If someone claims against either side, or the ICO fines either side, for a breach of data protection law, each side bears the part caused by its own breach. If that cannot be worked out, it is shared in proportion to each side’s responsibility.

Nothing here limits liability for fraud, for death or personal injury caused by negligence, or for anything else the law does not allow to be limited.

 

13. Records of processing

We keep a record of the processing we carry out for churches, as Article 30(2) requires, and will show it to the ICO on request.

 

14. The law that applies

This agreement is governed by the law of England and Wales. The courts of England and Wales deal with any dispute.

 

15. Signing a paper copy (optional)

 

Annex: where each Article 28(3) requirement is met