Data Processing Addendum

This Data Processing Addendum (this "DPA", including its annexes) is between company legal name ("Bless", "we", "us") and the organization that has agreed to the Bless Terms of Service (the "Organization", "you"). Each is a "Party."

This DPA forms part of the Terms of Service (the "Agreement"). You accept it when you accept the Terms of Service, and it takes effect on the same date. You do not need to sign anything for it to apply. If your organization needs a countersigned copy for its records, email legal email and we will send one.

1. Definitions

Words with capitals that this DPA does not define have the meaning given in the Agreement.

• Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party. "Control" means the power to direct the entity, through ownership of voting securities, by contract or otherwise.
• Applicable Data Protection Laws means the privacy, data protection and data security laws and regulations of any jurisdiction in the United States that apply to Bless's Processing of Personal Data under the Agreement, including the State Privacy Laws where they apply.
• Customer Data means information that the Organization, or someone acting for it (including its donors, registrants, guests and volunteers using the Organization's pages), provides to Bless for Processing on the Organization's behalf to perform the Services.
• Data Subject means the identified or identifiable person the Personal Data is about.
• Information Security Incident means a breach of Bless's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Bless's possession, custody or control. It does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as failed sign-in attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.
• Personal Data means Customer Data that is "personal data," "personal information" or "personally identifiable information" under Applicable Data Protection Laws, or information of a similar kind they regulate. It does not include information Bless collects or generates on its own account and not on the Organization's behalf, such as a person's Bless login, the Organization's billing details with Bless, Bless's own marketing site data and Bless's product analytics, which our Privacy Policy covers.
• Process or Processing means any operation performed by or for Bless on Personal Data for the Organization under the Agreement, whether or not automated, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure by transmission, combination, restriction, erasure or destruction.
• Security Measures has the meaning given in Section 5.1.
• Services means the Bless software and services described in the Agreement, including event pages, ticketing, registration, donations and recurring gifts, auctions and paddle raises, check-in, contact and household records, and integrations the Organization chooses to connect.
• State Privacy Laws means the comprehensive state privacy laws of the United States (and their regulations) in effect and applicable to Bless's Processing of Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act.
• Subprocessor means a Bless Affiliate or a third party that Bless engages to Process Personal Data in connection with the Services.

2. Roles of the Parties

2.1 The Organization decides. The Organization chooses what Personal Data to collect through the Services and why: which events to run, which questions to ask registrants, which donors and households to record, and which integrations to connect. For that Personal Data the Organization is the "controller" or "business," and Bless is its "processor" or "service provider" under the State Privacy Laws.

2.2 Where Bless decides. Bless is the controller of the data it handles for its own purposes, which are described in the Privacy Policy: a person's Bless login (one login can be used with more than one organization), the Organization's account and billing relationship with Bless, Bless's marketing site, and product analytics. This DPA does not apply to that data.

2.3 Payments. Card payments on the Organization's pages are processed by Stripe on the Organization's own Stripe connected account. The Organization has its own agreement with Stripe and is the merchant of record. Stripe is listed as a Subprocessor for the part of its work that Bless arranges, but Stripe also acts under its direct agreement with the Organization.

2.4 Details. The details of the Processing are in Annex 1.

3. Duration and scope

This DPA stays in effect for as long as Bless Processes Personal Data for the Organization, even after the Agreement ends.

Processing of Personal Data subject to the State Privacy Laws is also subject to Section 11 (State Privacy Laws).

4. The Organization's instructions

4.1 Bless follows the Organization's instructions. Bless will Process Personal Data only on the Organization's documented instructions. Those instructions are this DPA, the Agreement, the settings the Organization chooses in the Services, and any other written instructions the Organization gives that are consistent with the Agreement and this DPA. By accepting this DPA, the Organization instructs Bless to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement.

4.2 Instructions outside the Services. If the Organization asks for something outside the scope of the Services, or something that would require Bless to materially change the Services or do work the Agreement does not cover, the Parties will agree to it in writing first.

4.3 Unlawful instructions. Bless will tell the Organization if, in Bless's opinion, an instruction breaks Applicable Data Protection Laws. Bless is not required to follow that instruction.

5. Security and confidentiality

5.1 Bless's Security Measures. Bless will put in place and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as described in Annex 2 (the "Security Measures"). In choosing them, Bless considers the state of the art, the cost of implementation, the nature, scope, context and purposes of the Processing, and the risks to Data Subjects. Bless may update the Security Measures from time to time, for example to improve security or follow changes in the law, as long as the update does not materially reduce the overall protection of Personal Data.

5.2 Confidentiality of personnel. Bless will make sure that anyone it authorizes to access Personal Data is bound by an appropriate duty of confidentiality, and will give access only to those who need it to provide or support the Services.

5.3 The Organization's security responsibilities. Without limiting Bless's obligations under this Section 5, the Organization is responsible for how it uses the Services, including:

• (a) using the Services in a way that gives a level of security appropriate to the risk, including choosing who in the Organization gets an admin role and removing access when someone leaves;
• (b) keeping the sign-in credentials, systems and devices it uses to access the Services secure;
• (c) securing any systems the Organization makes available for Bless to access, including any Salesforce or other account it connects; and
• (d) keeping its own copies of Personal Data it needs, for example by using the CSV exports the Services provide.

5.4 The Organization's assessment. The Organization confirms that it has reviewed the Services, the Security Measures and Bless's commitments in this DPA, and that, based on the information Bless has made available, it considers them adequate for its needs, including its own security obligations under Applicable Data Protection Laws.

6. Information Security Incidents

6.1 Notice. Bless will notify the Organization within breach notice hours hours of confirming an Information Security Incident affecting the Organization's Personal Data. Bless will send the notice by email to the Organization's owner and to any security contact the Organization has given us.

6.2 What the notice says. The notice will describe, to the extent then known, what happened, what Personal Data and which Data Subjects are affected, the steps Bless has taken to reduce the risk, and the steps Bless recommends the Organization take. Bless will update the Organization as it learns more.

6.3 No admission. Notifying or responding to an Information Security Incident is not an acknowledgment by Bless of any fault or liability.

6.4 Cooperation. Bless will reasonably cooperate with the Organization, and take commercially reasonable steps within its control that the Organization reasonably requests and the Parties agree in good faith, to help investigate the Information Security Incident.

6.5 Notices to others. The Organization is responsible for complying with notification laws that apply to it and for any notices to third parties, including its donors, registrants and regulators. If the Organization decides to notify a regulator, Data Subjects, the public or others, and the notice refers to or identifies Bless, the Organization will, where the law allows, (a) tell Bless in advance and (b) in good faith consult with Bless and consider any clarifications or corrections Bless reasonably suggests about Bless's involvement, as long as they are consistent with the law.

7. Requests from people and help with assessments

7.1 Help with requests. Taking into account the nature of the Processing, Bless will give the Organization the help that is reasonably necessary and technically feasible for the Organization to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws (for example to know, access, correct or delete their Personal Data) ("Data Subject Requests"). This includes the tools in the Services, such as editing contact records and exporting data to CSV.

7.2 Cost of extra help. If the help needed goes beyond the Services' own tools and requires material work, Bless may charge for it at reasonable rates, which Bless will tell the Organization in advance on request. Bless will not charge for help with a Data Subject Request that arises from Bless's own failure to meet this DPA.

7.3 Requests sent to Bless. If Bless receives a Data Subject Request about the Organization's Personal Data, Bless will (a) promptly tell the Organization, unless the law prohibits it, and (b) tell the person to contact the Organization. The Organization is responsible for responding, unless the law requires otherwise.

7.4 Assessments. Taking into account the nature of the Processing and the information available to Bless, Bless will give the Organization reasonable information it needs to carry out data protection assessments or risk assessments that Applicable Data Protection Laws require of it about the Services.

8. The Organization's responsibilities

8.1 Notices and consents. The Organization is responsible for giving every notice to, and getting every consent and permission from, its donors, registrants, guests, volunteers and other Data Subjects that Applicable Data Protection Laws require for Bless to Process Personal Data as the Agreement describes. This includes:

• (a) a privacy notice on or linked from its pages that describes its use of the Services;
• (b) for a child, the consent of a parent or legal guardian where the law requires it. The Services are designed for a parent or guardian to add a child to a household and register the child, not for children to sign up themselves; and
• (c) any consent needed before connecting a third-party service, such as Salesforce, that receives Personal Data on the Organization's instruction.

8.2 Restricted Data. The Services are built to collect the Personal Data listed in Annex 1, including some sensitive data. Apart from that, the Organization will not use the Services, including custom registration questions and notes, to collect or store:

• Social Security numbers, driver's license numbers, passport numbers or other government identification numbers;
• health or medical records, diagnoses or treatment information, health insurance information, or protected health information under HIPAA (the dietary and accessibility notes described in Annex 1 are allowed);
• biometric information;
• full payment card numbers, card security codes or bank account credentials (payments go through Stripe's own fields, which Bless never sees);
• passwords or credentials for other services;
• tax return information; or
• precise geolocation, or information about a person's religious beliefs, sexual orientation, immigration status or criminal history, beyond what the Organization's own name and mission reveal about the people who give to or attend it

("Restricted Data"), unless the Parties have agreed otherwise in writing.

9. Subprocessors

9.1 Authorization. The Organization authorizes Bless to engage its Affiliates and third parties as Subprocessors under this Section 9.

9.2 The current list. The current Subprocessors, with what they do, the data involved and where they are, are listed at /legal/subprocessors (the "Subprocessor Page"), and Annex 3 points there. Bless may keep using the Subprocessors listed there on the date the Organization accepts this DPA.

9.3 Requirements. When Bless engages a Subprocessor, Bless will enter into a written contract with it that includes data protection obligations no less protective than this DPA, to the extent they apply to the service the Subprocessor provides. Bless remains responsible for its Subprocessors' performance and is liable for their acts and omissions as if they were Bless's own.

9.4 Notice of changes. Before a new Subprocessor starts Processing Personal Data, Bless will update the Subprocessor Page and email the Organization's owner at the address on its Bless account, naming the Subprocessor, where it is and what it will do. Bless will send this notice at least 15 days before the new Subprocessor starts, except where an urgent change is needed to keep the Services secure or running, in which case Bless will send it as soon as it can. Anyone may also ask to be told of changes by emailing legal email.

9.5 Right to object. The Organization may object to a new Subprocessor in writing, on reasonable grounds about the protection of Personal Data, within 15 days after the notice. The Parties will then work in good faith to resolve the objection. If they cannot within a reasonable time, the Organization may, as its only remedy, end the Agreement by written notice, and Bless will refund any fees the Organization has prepaid for the period after the end date.

10. Audits

10.1 Information first. On written request, no more than once a year (or more often if a regulator requires it or the law requires the Organization to audit), Bless will answer a reasonable written security and privacy questionnaire, and give the Organization a summary of its Security Measures and other information reasonably needed to show that Bless is meeting this DPA. Bless does not hold a SOC 2 or ISO 27001 certification today; if it obtains one, it will provide the report on request, and the Organization agrees to accept it in place of an audit of the controls it covers.

10.2 Audit. If the information under Section 10.1 is not enough to meet a legal requirement that applies to the Organization, the Organization may audit Bless's compliance with this DPA, once a year, on the following terms:

• (a) the Organization sends a proposed audit plan, with its scope, length and start date, at least two weeks in advance, and the Parties agree a final plan in good faith;
• (b) Bless may object to a third-party auditor that is not independent, is a competitor of Bless or is otherwise clearly unsuitable, and the Organization will then pick another auditor or do the audit itself;
• (c) any third-party auditor signs a customary confidentiality agreement;
• (d) the audit takes place during normal business hours, follows Bless's safety and security policies, and does not unreasonably disrupt Bless's business, and nothing in it requires Bless to break a duty of confidentiality, including to its other customers, or to expose information that could weaken its security;
• (e) the Organization tells Bless promptly of any non-compliance it finds and shares the audit report with Bless, unless the law forbids it, and uses the report only to meet its legal audit requirements or confirm compliance with this DPA; and
• (f) the Organization pays for its own audit and its auditor's fees, and reimburses Bless's reasonable, documented costs, unless the audit finds that Bless materially breached this DPA.

11. State Privacy Laws

11.1 Meaning of terms. In this Section, "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider" and "contractor" have the meanings given in the State Privacy Laws, and "personal information" means Personal Data to the extent the State Privacy Laws govern it.

11.2 Bless's commitments. For personal information, Bless is a service provider, contractor or processor, as the State Privacy Laws use those terms. Bless:

• (a) acknowledges that the Organization discloses personal information to Bless only for the limited and specified purposes described in the Agreement and Annex 1;
• (b) will comply with its obligations under the State Privacy Laws and give personal information the same level of privacy protection the State Privacy Laws require;
• (c) agrees that the Organization may take reasonable and appropriate steps to make sure Bless's Processing of personal information is consistent with the Organization's obligations under the State Privacy Laws;
• (d) will notify the Organization in writing if Bless decides it can no longer meet its obligations under the State Privacy Laws; and
• (e) agrees that the Organization may, on reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

11.3 No selling, sharing or combining. Bless will not:

• (a) sell or share personal information;
• (b) keep, use or disclose personal information for any purpose other than providing the Services, including for a commercial purpose other than providing the Services, except as the State Privacy Laws allow;
• (c) keep, use or disclose personal information outside the direct business relationship between Bless and the Organization; or
• (d) combine personal information it receives under the Agreement with personal information it receives from or for another person, including another organization using Bless, or collects from its own interactions with the Data Subject, except as the State Privacy Laws allow and as needed to provide the Services.

Bless certifies that it understands the restrictions in this Section 11.3 and will comply with them.

11.4 De-identified data. If Bless receives de-identified data from the Organization, or de-identifies Personal Data, Bless will (a) take reasonable measures to make sure it cannot be linked to a person or household, (b) publicly commit to keep and use it only in de-identified form and not try to re-identify it, and (c) require anyone it shares it with to do the same. Bless may use de-identified and aggregated data, such as counts of events, tickets and donations across all organizations, to run, improve and report on the Services, as long as it does not identify the Organization, a Data Subject or a household.

11.5 Subprocessor notice and audits. Notice of Subprocessors under Section 9 meets Bless's obligation under the State Privacy Laws to give notice of, and a chance to object to, Subprocessors. The Organization may use Section 10 to make sure Bless's use of personal information is consistent with the State Privacy Laws.

11.6 Integral to the Services. The Parties agree that Bless's keeping, use and disclosure of personal information as the Organization's instructions in the Agreement and this DPA authorize are integral to providing the Services and to the business relationship between them.

12. Artificial intelligence

12.1 Bless does not use Customer Personal Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless the Organization expressly authorizes it in writing.

12.2 Bless will not give Personal Data to an AI model provider as a Subprocessor without listing it on the Subprocessor Page under Section 9, and will forbid any such provider from using Personal Data to train or improve its own models.

12.3 The Services do not make decisions about people by automated means that produce legal or similarly significant effects on them.

13. Return and deletion

13.1 When the Services end. When the Agreement ends or the Organization closes its Bless account (the "End Date"), Bless will stop Processing the Organization's Personal Data for any purpose other than storing it, returning it, deleting it or de-identifying it, or as this DPA or the law otherwise allows or requires.

13.2 Getting your data back. Until the End Date, the Organization can export its contacts, households, registrations, orders and donations to CSV from the Services. For deletion days days after the End Date, the Organization may ask Bless in writing at legal email for a copy of its Personal Data, and Bless will provide it in a commonly used format by a secure method within a commercially reasonable time.

13.3 Deletion. Within deletion days days after the End Date, Bless will delete or de-identify the Organization's Personal Data, to the extent technically feasible. Copies in backups will be deleted as the backups expire, within backup retention days days, and are protected under the Security Measures until then. Payment records held by Stripe on the Organization's own connected account are governed by the Organization's agreement with Stripe, not by this Section.

13.4 Data Bless must keep. Bless may keep Personal Data where the law requires or permits it, such as records of payments, platform fees and tax, and only for as long as the law requires. While it does, Bless will keep the data confidential, protect it under the Security Measures, use it only for the purpose the law requires, and delete or de-identify it when it is no longer required.

14. General

14.1 The Agreement still applies. Apart from what this DPA changes, the Agreement stays in full force. If this DPA and the rest of the Agreement conflict on the Processing of Personal Data, this DPA controls.

14.2 Not payment. Bless's access to Personal Data is not part of what the Organization pays for the Services.

14.3 Notices. Bless may send notices under this DPA (a) as the Agreement's notice clause provides, (b) by email to the Organization's owner at the address on its Bless account, or (c) to any other email address the Organization names in writing for this purpose. The Organization is responsible for keeping those email addresses current. The Organization may send notices to Bless at legal email, or about security matters at security email.

14.4 Changes to this DPA. Bless will work in good faith with the Organization on any amendment reasonably needed to comply with Applicable Data Protection Laws. Bless may change this DPA by notice to the extent needed to keep it compliant with Applicable Data Protection Laws, as long as the change does not materially reduce the protection of Personal Data or materially increase the Organization's obligations without its written agreement. Each version is published at /legal/dpa with its version number and effective date.

14.5 Liability. Each Party's total liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Agreement.

Signatures (optional)

This DPA binds both Parties when the Organization accepts the Terms of Service. A countersigned copy is available on request to legal email and, if signed, records the same terms.

company legal name By: ____________________ Name: ____________________ Title: ____________________ Date: ____________________

Organization: ____________________ By: ____________________ Name: ____________________ Title: ____________________ Date: ____________________

Annex 1: Details of the Processing

Bless

• Name: company legal name, a company state company entity type
• Address: company address
• Data protection contact: privacy email; security incidents security email
• What Bless does: Bless provides software that nonprofit organizations use to run events, sell tickets and take registrations, receive one-time and recurring donations, run auctions and paddle raises, check guests in, and keep records of their contacts and households.

The Organization

• Name and address: as shown on the Organization's Bless account
• Data protection contact: the Organization's owner, at the email address on its Bless account, unless the Organization names someone else in writing
• What the Organization does: uses the Services to run its events, fundraising and supporter records, as the Agreement allows.

Whose Personal Data (categories of Data Subjects)

• Donors, including recurring donors
• People who register for events or buy tickets, and the attendees they register
• Minors who attend events, registered by a parent or guardian
• Household members, including spouses, children and grandchildren, that the Organization or a household member records
• Auction bidders and paddle-raise givers
• Volunteers the Organization gives access to event-night screens
• The Organization's own staff and admins who use the Services
• Other contacts the Organization chooses to record

What Personal Data (categories)

• Identity and contact details: names, email addresses, phone numbers and home addresses. Bless does not text or call phone numbers.
• Household details: household membership and relationships, including spouses, children and grandchildren.
• Registration and event details: tickets and registrations, seat and table assignments, check-in records, and answers to the Organization's custom registration questions.
• Giving and purchase details: donation, order and auction history, amounts, funds and campaigns, recurring gift schedules, bids, winning items and bidder paddle numbers.
• Payment references: Stripe customer and payment-method references, and the card brand and last four digits. Stripe holds the card itself; Bless never receives or stores full card numbers or security codes.
• Volunteer details: volunteer names and email addresses, and which actions a volunteer took on event-night screens.
• Staff account details: names, email addresses and roles of the Organization's users.
• Technical details: IP addresses and browser user agents in Bless's operator audit logs, and a random visitor identifier on giving pages (no IP address is stored with it).

Sensitive Personal Data

The Services collect the following, which some laws treat as sensitive or as needing extra care:

• Date of birth (optional), which also tells the Services whether a person is under 18
• Gender and marital status (optional)
• Children's data: names, dates of birth and household relationships of minors, added by a parent, guardian or the Organization
• Dietary and accessibility notes for seated guests, which may reveal health information or disability

Extra safeguards: these fields are optional; they are visible only to the Organization's admins and to the household they belong to; and they are protected by the Security Measures in Annex 2. The Organization must not use custom questions or notes to collect Restricted Data (Section 8.2), such as health records, government identification numbers, Social Security numbers or full card numbers.

Frequency

Continuous, for as long as the Organization uses the Services.

Nature and purposes of the Processing

Bless Processes Personal Data to provide the Services on the Organization's instructions, including to:

• host the Organization's event, giving and auction pages and take registrations, ticket purchases, donations, recurring gifts and bids;
• arrange payments, refunds and auction charges through Stripe on the Organization's connected account;
• send receipts, confirmations, reminders, auction notices and the Organization's announcements by email;
• let the Organization manage contacts, households, guest lists, seating and check-in, and export its data;
• sync data to services the Organization chooses to connect, such as Salesforce;
• keep the Services secure, prevent fraud and abuse, fix errors and provide support; and
• meet Bless's legal obligations.

Duration and retention

For the term of the Agreement and then until the data is returned or deleted under Section 13.

Transfers to Subprocessors

As described on the Subprocessor Page, for the purposes listed there. Bless hosts the Services and stores Personal Data in the United States.

Annex 2: Security Measures

Bless maintains the following measures today. Section 5.1 allows Bless to update them as long as the overall protection does not go down.

• Encryption in transit. The Services force HTTPS for every page and request.
• Browser protections. A content security policy, with a per-request nonce for scripts, limits which scripts and resources a page can load.
• Rate limiting. Requests are throttled to slow down password guessing, scraping and abuse.
• Encryption of certain fields at rest. Donor details on donations and the access tokens for an Organization's Salesforce connection are encrypted in the database at the application level.
• Payment cards. Card details are entered into Stripe's own fields and go straight to Stripe. Bless never receives or stores full card numbers or security codes; it stores only Stripe references and the card brand and last four digits.
• Log filtering. Passwords, tokens and personal fields are filtered out of application logs, and error reports sent to PostHog have sign-in tokens and similar values removed from addresses.
• Access by role. Each Organization's data is separated from every other Organization's in the application. Inside an Organization, admins, members and event-night volunteers see only what their role allows, and the Organization can end a volunteer's access at any time.
• Audit logs. Money actions, and any time a Bless operator signs in as one of the Organization's users, are logged with who acted and when.
• Passwords. Passwords are stored only as salted hashes, never in readable form.

Annex 3: Subprocessors

The current list of Subprocessors, with the purpose of each, the Personal Data involved and its location, is published at /legal/subprocessors. That page forms part of this Annex. Changes are notified under Section 9.4.

---

Portions adapted from templates published by General Legal, PC under CC0. General Legal has not reviewed this document.