Data Processing Addendum

Plain English: Your people’s data is yours. We only touch it to run the services you asked for.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Kingdom Performance Group, LLC, doing business as Anvil Rise ("Anvil Rise," "we," "us") and the client identified in that agreement ("you," "Client"). It applies whenever we process Client Personal Data on your behalf.

For Client Personal Data, you are the controller (the "business" under US state privacy laws) and we are the processor (the "service provider"). You decide what is collected and why. We act only on your documented instructions.

This DPA does not apply to information we hold about you as our own customer, such as your account and billing records. That is covered by our Privacy Policy, where we are the controller.

Client Personal Data means personal information relating to your visitors, members, guests, donors, volunteers, prospective attendees, and other contacts that we process on your behalf through the Services, including through your website, inquiry forms, review requests, optional guest follow-up, integrations, and related support.

Applicable Privacy Law means the privacy and data protection laws that apply to your processing, including the California Consumer Privacy Act as amended, and comparable US state laws.

Sub-processor means a third party we engage to process Client Personal Data. Security Incident means an actual or reasonably suspected breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data. It does not include an unsuccessful attempt that does not compromise Client Personal Data, such as a blocked login attempt, port scan, denial-of-service attempt, or similar event. Terms not defined here take their meaning from the Terms of Service.

Plain English: Only what the services need, only to run them for you.

The subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1. We process Client Personal Data only to provide, maintain, secure, and support the Services, and only on your instructions. The Terms of Service, this DPA, your Order Form, and your use of the Services constitute your documented instructions.

If we believe an instruction infringes Applicable Privacy Law, we will tell you and may pause that processing until it is resolved.

Plain English: We don’t sell it, market to your people, or mix your data with anyone else’s.

We will:

• Process Client Personal Data only on your documented instructions and for the purposes in Annex 1.
• Not sell or share Client Personal Data, as those terms are defined under Applicable Privacy Law.
• Not retain, use, or disclose Client Personal Data for any purpose other than performing the Services, including not for our own commercial purposes, and not outside the direct business relationship between us.
• Not market to your contacts on our own behalf, and not build our own marketing lists from Client Personal Data.
• Not combine Client Personal Data with personal information we receive from other sources, except as permitted by Applicable Privacy Law.
• Require everyone we authorize to process Client Personal Data to be bound by confidentiality.
• Maintain the security measures in Annex 2.
• Tell you promptly if we can no longer meet our obligations under Applicable Privacy Law.

We certify that we understand and will comply with these restrictions.

Plain English: You need a lawful reason to collect or contact people. That part is on you.

You are responsible for the lawfulness of the data you put into the Services and the instructions you give us. In particular you will:

• Have a lawful basis, and where required prior express written consent, before any person is contacted by call or text through the Services, and keep records of that consent.
• Maintain your own privacy policy and messaging disclosures, including opt-out instructions, on your website.
• Honor opt-out, unsubscribe, and do-not-contact requests promptly, and not re-add contacts who have opted out.
• Comply with telephone and messaging laws and carrier requirements applicable to your organization, including calling-time restrictions and identification requirements.
• Use review-request features only to seek honest feedback from people who had a genuine experience with your organization. You will not create or procure fake reviews, conceal an insider relationship, condition an incentive on sentiment, selectively route only positive reviewers to a public platform, suppress negative feedback, retaliate against a reviewer, falsely report a genuine review, or misrepresent which reviews are displayed.
• Not submit or cause the Services to process Social Security numbers or other government-issued identifiers; full payment-card numbers or financial-account credentials; account passwords or authentication secrets; protected health information; biometric, genetic, or neural data; precise geolocation beyond an ordinary address reasonably required for the Services; personal data knowingly relating to a child under 13; or any other data classified as sensitive under applicable law, unless we approve it in writing and the parties document the lawful basis and additional safeguards.

Ordinary addresses, ministry interests, prayer requests, and other free-form submissions can reveal sensitive facts. Collect only what is reasonably necessary, use clear notices, and do not ask people to submit confidential medical, financial, or counseling information through ordinary website forms.

If you submit prohibited data, you must notify us immediately. We may reject, quarantine, redact, return, or securely delete it; disable the affected feature; or suspend the account while the risk is addressed.

Plain English: We use a short list of providers to run this. We email you before that list changes.

You give us general authorization to engage Sub-processors. Our current direct Sub-processors are listed in Annex 3. We require each direct Sub-processor to enter written data-protection obligations appropriate to the nature of its processing and as required by Applicable Privacy Law. We remain responsible for our selection and use of direct Sub-processors to the extent required by this DPA and applicable law.

We will give the email address associated with your account at least 30 days’ written notice before adding or replacing a direct Sub-processor. Posting an updated list alone does not satisfy this notice obligation. If you reasonably object on documented data-protection grounds during that period, we will work in good faith to address the objection or provide a commercially reasonable alternative. If neither is possible, you may terminate the affected Services without penalty for the unused portion of a prepaid term.

Plain English: If one of your people asks about their data, we help you answer them.

Taking into account the nature of the processing, we will assist you with reasonable technical and organizational measures to respond to requests from individuals exercising their rights under Applicable Privacy Law, including access, correction, deletion, and opt-out.

If we receive such a request directly, we will not respond to it substantively. We will refer the individual to you and notify you, unless the law requires otherwise.

Plain English: If something goes wrong, we tell you within 24 hours, even if we’re still investigating.

We will notify you without undue delay and, in any event, within 24 hours after we discover a Security Incident affecting Client Personal Data. We will not delay the initial notice because the investigation is incomplete. The initial notice will describe the facts then known, the categories of data and individuals reasonably believed to be affected, likely consequences, containment and remediation steps, and a contact for follow-up. We will provide material supplemental information as it becomes available and reasonably assist with your investigation and legally required notices. Our notice is not an admission of fault or liability.

Plain English: Your contact data leaves with you.

On request during the term, and on termination, we will make Client Personal Data available for export to you in a commonly used format. After a reasonable wind-down period we will delete or de-identify Client Personal Data, except where we are required to retain it by law or where it exists in routine backups, which are deleted on their ordinary cycle and remain protected by this DPA until then.

This mirrors section 12 of the Terms of Service: your domain, content, contact lists, inquiries, and reviews are yours and go with you.

Plain English: Ask us how we protect it and we’ll show you.

On reasonable written request, and no more than once in any twelve-month period unless required by a regulator or following a Security Incident, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where available, we may satisfy this by providing our Sub-processors’ third-party audit reports or security documentation. Any on-site audit must be at your expense, during business hours, subject to confidentiality, and must not unreasonably disrupt our operations.

Plain English: This is a US service for US organizations. Some vendor support happens outside the US, and we say so rather than pretend otherwise.

The Services are offered to U.S. organizations for their U.S. operations. You may not intentionally use the Services to target individuals outside the United States or knowingly submit Client Personal Data subject to non-U.S. data-protection law without our prior written approval. If we approve that processing, the parties will execute any required jurisdiction-specific terms and complete any required transfer assessment before the processing begins.

Our direct Sub-processors may process Client Personal Data from the locations disclosed in Annex 3 and their incorporated sub-processor lists. Those locations may include countries outside the United States. Where a transfer mechanism is legally required for approved processing, the applicable provider’s data-processing terms and transfer mechanism will apply to the extent legally valid. Nothing in this section limits a person’s non-waivable rights or either party’s obligations under applicable law.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA controls. In all other respects the Terms of Service continue in full force.

This DPA takes effect when you accept the Terms of Service or an Order Form that incorporates it and continues for as long as we process Client Personal Data on your behalf. Sections that by their nature should survive termination will survive.

Data protection questions and requests under this DPA:

Kingdom Performance Group, LLC (dba Anvil Rise)
chris@anvilrise.com or privacy@anvilrise.com
110 Huntcliff Village Ct
Atlanta, GA 30350
770-670-7895

Subject matter. Provision of the Services described in your Order Form and section 4 of the Terms of Service.

Duration. The term of the Services, plus the wind-down period in section 9 of this DPA.

Nature and purpose. Hosting a website that captures inquiries; processing form submissions; supporting ethical review requests; sending acknowledgments or guest follow-up when included; storing related conversations and contact records; and providing support and reporting.

Categories of data subjects. Your website visitors, members, guests, donors, volunteers, prospective attendees, other contacts who interact with your website or organization, and your own staff or volunteers who use the Services.

Types of personal data. Name; phone number; email address; postal address when reasonably needed; the content of messages and form submissions; follow-up and appointment details; review requests and responses; and technical data such as IP address and device information.

Sensitive data. No sensitive data is requested or required. Free-form submissions may incidentally reveal sensitive facts. Clients must minimize those details and may not intentionally submit the prohibited categories listed in section 5 without prior written approval and additional safeguards.

We maintain administrative, technical, and physical safeguards appropriate to the nature of the data, including:

• Access to Client Personal Data limited to personnel who need it to deliver the Services, on a least-privilege basis.
• Individual named accounts with multi-factor authentication enabled on the platform and on administrative email.
• Encryption of data in transit over public networks, and encryption at rest as provided by our Sub-processors.
• Prompt removal of access when personnel or contractors leave or change roles.
• Confidentiality obligations binding on all personnel and contractors.
• Reliance on established Sub-processors that maintain their own recognized security programs, as listed in Annex 3.

HighLevel’s current sub-processor list is available at gohighlevel.com/sub-processors. OpenAI’s ChatGPT Sites Data Processing Addendum is available at openai.com/policies/chatgpt-sites-data-processing-addendum. Providers engaged by HighLevel and OpenAI are governed by their respective data-processing terms. Anvil Rise will add any other direct provider to this Annex before allowing it to process Client Personal Data.

Our payment processor, Stripe, handles subscription and other payments. Those are account and billing records, which section 1 excludes from Client Personal Data, so Stripe is not a Sub-processor under this DPA. Stripe is disclosed in our Privacy Policy.