DATA PROCESSING AGREEMENT

FLUMC Daily Devotionals

Current Series: Awakened to Grace

Effective Date: 2026-01-02

1. PARTIES

This Data Processing Agreement (“DPA”) is entered into between:

Data Controller: The Florida Conference of The United Methodist Church, operating FLUMC Daily Devotionals (current series: Awakened to Grace)

Data Processor: The third-party service providers listed below

2. PURPOSE

This DPA governs the processing of personal data by our third-party service providers in accordance with GDPR, CCPA, and other applicable data protection laws.

3. DATA PROCESSORS

We engage the following data processors:

3.1 Firebase (Google Cloud Platform)

• Services: Authentication, database, storage, analytics, hosting
• Location: United States, European Union
• Compliance: GDPR, CCPA compliant
• Data Types: User accounts, content, usage analytics
• Security: ISO 27001 certified, SOC 2 Type II

3.2 Google Analytics

• Services: Web and app analytics
• Location: United States
• Compliance: GDPR, CCPA compliant
• Data Types: Usage statistics, page views, user interactions
• Security: Industry-standard encryption

3.3 PostHog

• Services: Product analytics and session replay
• Location: United States, European Union
• Compliance: GDPR compliant
• Data Types: Privacy-protected session recordings, analytics
• Security: Privacy-by-design, data masking

4. PROCESSING ACTIVITIES

Our processors handle: - User Authentication: Secure login and account management - Data Storage: User content, preferences, settings - Analytics: Usage statistics and performance metrics - Content Delivery: Serving app content and media

5. DATA SECURITY

All processors are required to: - Implement appropriate technical and organizational measures - Maintain confidentiality of personal data - Report data breaches promptly - Comply with applicable data protection laws

6. DATA SUBJECT RIGHTS

Processors must assist us in fulfilling data subject rights: - Right to access - Right to rectification - Right to erasure - Right to data portability - Right to object

7. DATA RETENTION

Processors retain data according to our instructions: - Active Accounts: While account is active - Inactive Accounts: Up to 24 months - Analytics Data: Up to 26 months (Google Analytics default)

8. SUB-PROCESSORS

Processors may engage sub-processors with our prior written consent. Current sub-processors are listed in each processor’s privacy policy.

9. INTERNATIONAL TRANSFERS

Data may be transferred internationally using: - Standard Contractual Clauses (SCCs) - Adequacy decisions - Other lawful transfer mechanisms

10. AUDIT RIGHTS

We reserve the right to audit processor compliance with this DPA.

11. CONTACT

For questions about data processing: - Email: privacy@awakenedtograce.app - Mail: The Florida Conference of The United Methodist Church, Privacy Department

Effective Date: 2026-01-02