Data Processing Addendum (DPA)

Last updated: July 1, 2026

This Addendum governs the processing of personal data that Enrique Oriolo (Tax ID/CUIT 20-35165631-0), provider of Domo ("the Processor"), carries out on behalf of the Customer church ("the Controller") when using the Service. It forms part of the Terms of Service and is governed by Act No. 25.326 (Section 25) and other applicable law.

1. Subject matter and roles

The Controller determines the purposes and means of processing its community's data. The Processor processes that data only on the Controller's documented instructions —expressed through use of the Service and these terms— and not for its own purposes.

2. Scope of processing

• Subject matter: provision of the church management platform.
• Duration: while the Controller's account is active.
• Nature and purpose: hosting and processing data to operate the directory, groups, ministries, events, attendance and pastoral care.
• Data types: identification and contact data of the community; family group data; and sensitive data (religious membership and pastoral-care notes).
• Categories of data subjects: members, participants and contacts of the church, including minors when uploaded by the Controller.

3. Processor obligations

• Process data only on the Controller's instructions.
• Ensure the confidentiality of those who access the data.
• Apply reasonable technical and organizational security measures (per-database isolation, role-based access control, encryption in transit, backups).
• Reasonably assist the Controller in responding to data subjects exercising their rights, and in meeting its security obligations.
• Not transfer data to third parties except authorized sub-processors (Section 5) or where required by law.

4. Controller obligations

The Controller warrants that it has a lawful basis and consent —including express consent for sensitive data and parental-authority consent for minors— for all data it uploads, and is the party responsible to data subjects for exercising their rights.

5. Sub-processors

The Controller authorizes the Processor to use the following sub-processors, contractually bound to an equivalent level of protection:

• Amazon Web Services (AWS) — Alojamiento e infraestructura (Estados Unidos).
• Postmark / Resend — Envío de correos transaccionales (Estados Unidos).
• Lemon Squeezy — Procesamiento de pagos y facturación (Estados Unidos).

We will give reasonable prior notice of any new or changed sub-processor, so the Controller may object on reasonable grounds.

6. International transfer

Some sub-processors are in the United States, so processing may involve an international transfer. Where the Controller is in Argentina, such transfer to a country without an adequate level of protection under Act 25.326 relies on the Controller's consent and on contractual commitments requiring adequate security measures from sub-processors.

7. Security incident notification

In the event of a security incident affecting the Controller's personal data, the Processor will notify it without undue delay upon becoming aware, with the information available, so the Controller can meet its own notification obligations to data subjects and authorities.

8. Return and deletion

Upon termination, the Controller has a reasonable window to export its data (directory, groups, ministries, attendance and per-person data). After that window, the Processor will permanently delete the data, unless a legal retention obligation applies.

9. Audit cooperation

On reasonable request and under confidentiality, the Processor will make available the information needed to demonstrate compliance with this Addendum.

10. Contact

Data processing questions: hola@domoiglesia.com.