KnowCore Data Processing Agreement (DPA)

Effective date: June 6, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between Greg Bolewitz, doing business as KnowCore ("KnowCore," "Processor") and the church or organization that agreed to the Agreement ("Customer," "Controller"). It governs KnowCore's processing of personal data on the Customer's behalf. If there is a conflict between this DPA and the Agreement on data-protection matters, this DPA controls.

1. Definitions

"Applicable Data Protection Law" means all privacy and data-protection laws applicable to a party's processing of Personal Data, including the EU/UK GDPR and U.S. state privacy laws (e.g., CCPA/CPRA), as applicable. "Controller," "Processor," "Personal Data," "Processing," "Data Subject," and "Personal Data Breach" have the meanings given in Applicable Data Protection Law. "Sub-processor" means a third party engaged by KnowCore to process Personal Data. Capitalized terms not defined here have the meaning in the Agreement.

2. Roles and scope

The Customer is the Controller of Personal Data about its members and attendees, and KnowCore is the Processor acting on the Customer's behalf. For KnowCore's own customer/ account and billing data, KnowCore is an independent controller (governed by the Privacy Policy). This DPA applies to KnowCore's Processing of Personal Data as a Processor.

3. Processing on documented instructions

KnowCore will Process Personal Data only on the Customer's documented instructions — including as set out in the Agreement, this DPA, and the Customer's configuration and use of the Service — and as required by law (in which case KnowCore will, where permitted, inform the Customer first). The Customer instructs KnowCore to Process Personal Data to provide, secure, and support the Service. KnowCore will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

The details of Processing (subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects) are set out in Annex 1.

4. Confidentiality

KnowCore will ensure that personnel authorized to Process Personal Data are bound by confidentiality obligations and Process Personal Data only as necessary to provide the Service.

5. Security

KnowCore will implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex 2 (consistent with GDPR Article 32). The Customer is responsible for securing its own administrator accounts and access.

6. Sub-processors

The Customer provides general authorization for KnowCore to engage Sub-processors. KnowCore's current Sub-processors are listed in Annex 3. KnowCore will: (a) impose data-protection obligations on each Sub-processor no less protective than this DPA; (b) remain responsible for its Sub-processors' performance; and (c) provide notice of any intended addition or replacement of a Sub-processor by email to the Customer's administrator or by posting an updated list in the Service, with at least 30 days' notice, giving the Customer an opportunity to object on reasonable data-protection grounds.

7. Assistance to the Customer

Taking into account the nature of the Processing, KnowCore will assist the Customer, by appropriate technical and organizational measures and insofar as possible, with: (a) responding to Data Subject requests to exercise their rights (access, correction, deletion, portability, objection, restriction) — the Service provides member access/deletion tooling for this purpose; (b) the security of Processing, breach notification, and data-protection impact assessments and prior consultations, where applicable.

8. Personal Data Breach

KnowCore will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, and will provide information reasonably available to help the Customer meet its notification obligations.

9. Deletion or return of data

On termination or expiry of the Agreement, or earlier at the Customer's request, KnowCore will delete or return the Customer's Personal Data and delete existing copies, except to the extent retention is required by law. Deletion from live systems is available on demand through the Service; residual copies in routine backups are purged within 14 weeks.

10. Audits

KnowCore will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, no more than once per 12 months, on at least 30 days' notice, and subject to reasonable confidentiality, scheduling, and scope limits.

11. International transfers

Where KnowCore transfers Personal Data outside the originating jurisdiction (e.g., outside the EEA/UK), it will ensure an appropriate transfer mechanism is in place, such as the Standard Contractual Clauses, which are incorporated by reference where required.

12. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. This DPA takes effect on the Effective date and continues for as long as KnowCore Processes Personal Data on the Customer's behalf.

Annex 1 — Details of Processing

• Subject matter: provision of the KnowCore Service to the Customer.
• Duration: the term of the Agreement, plus any legally required retention.
• Nature and purpose: hosting, storing, transmitting, and displaying member information; authenticating members; sending Service-related emails and SMS verification codes; automated screening of member-submitted content; AI-assisted features operated on the Customer's instructions (see Privacy Policy §4); optional synchronization with the Customer's chosen integrations.
• Types of Personal Data: name; email address; phone number; mailing address; household and campus; date of birth and anniversary; profile photo/selfie; check-in and attendance records; prayer requests and prayer activity; discipleship/spiritual-gifts assessment responses and discipleship matches; ministry depth-chart placements, statuses, growth and leadership plans, and materials completed; volunteer clearance status and uploaded clearance documents; pastoral-care cases, touchpoints, and notes (encrypted); community-need responses; meal-train claims; self-reported missionary support; sermon notes, reading-plan and scripture-memory progress; reward points, badges, and engagement streaks; authentication data (verification codes, passkey credentials, device identifiers, NFC tag identifiers); technical/usage and log data.
• Special categories / sensitive data: information that may reveal religious participation; free-text prayer requests and pastoral-care notes that may reveal health or personal circumstances; information about minors; volunteer background-check status.
• Categories of Data Subjects: the Customer's church members, attendees, and visitors, which may include minors (handled at the Customer's direction and responsibility).

Annex 2 — Technical and Organizational Security Measures

• Encryption of Personal Data in transit (TLS) and at rest.
• Secrets stored in a managed secret store; no plaintext credentials in code.
• Logical tenant isolation enforced by security rules and per-tenant query scoping.
• Access controls and least-privilege: multi-factor authentication on administrative cloud access; scoped service-account permissions for the application.
• Member-facing authentication via one-time verification codes (delivered by SMS or email) and optional passkeys (WebAuthn); short-lived session tokens.
• Automated content moderation of member submissions prior to publication.
• Logging and error monitoring; scheduled database backups with point-in-time restore.
• Data deletion tooling for both whole-account (church) and individual-member erasure.

Annex 3 — Sub-processors

Customer-elected integrations (Planning Center Online, Clearstream, Bitfocus Companion / Elgato Stream Deck) are independent services engaged by the Customer, not KnowCore Sub-processors; data is exchanged with them only when the Customer enables the integration.

Acceptance: This DPA is incorporated into the Agreement by reference and is accepted when the Customer accepts the Agreement at sign-up.