MosqueFees Data Processing Terms

1. Agreement and authority

These Data Processing Terms (the DPT) apply when a mosque, madrassah, charity, or other organisation (the Customer) uses MosqueFees and Ribblesoft Ltd processes Customer Personal Data on its behalf. Ribblesoft Ltd is referred to as the Supplier.

The DPT form part of the Supplier's Terms of Service and any other service agreement between the parties (together, the Agreement). They become binding when the Customer's authorised representative accepts them electronically, signs them, or otherwise agrees to them in writing. The person accepting confirms that they have authority to bind the Customer.

If there is a conflict concerning the processing of Customer Personal Data, these DPT take priority over the rest of the Agreement.

2. Definitions

• Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018, and other UK privacy or data protection law that applies to the processing, in each case as amended or replaced.
• Customer Personal Data means personal data processed by the Supplier on the Customer's behalf through the Services.
• Services means the MosqueFees website, web application, mobile application, APIs, support, and related services supplied to the Customer.
• The terms controller, processor, data subject, personal data, personal data breach, processing, and special category data have the meanings given in Applicable Data Protection Law.

3. Scope and roles

For Customer Personal Data, the Customer is the controller and the Supplier is the processor. Each party will comply with the obligations that apply to it under Applicable Data Protection Law. The processing details are set out in Schedule 1.

These DPT do not apply where the Supplier processes personal data as an independent controller, including for its own account administration, billing, service security, legal compliance, or direct business relationship with the Customer. That processing is described in the MosqueFeesPrivacy Notice.

4. Customer obligations

The Customer is responsible for:

• ensuring its instructions and use of the Services comply with Applicable Data Protection Law;
• having an appropriate lawful basis and giving required privacy information to students, parents, guardians, staff, and other data subjects;
• deciding which personal data is entered into the Services and ensuring it is adequate, relevant, accurate, and limited to what is necessary;
• applying any additional safeguards required for children's data, special category data, criminal offence data, safeguarding information, or other particularly sensitive records;
• managing its authorised users, roles, access permissions, and account credentials; and
• responding to data subjects and regulators as controller, with the Supplier's assistance as described below.

5. Documented instructions

The Supplier will process Customer Personal Data only on the Customer's documented instructions, including for international transfers, unless UK law requires otherwise. The Agreement, the Customer's configuration and use of the Services, actions taken by its authorised users, and written support requests are the Customer's documented instructions.

If law requires processing outside those instructions, the Supplier will tell the Customer before processing unless the law prohibits that notice. The Supplier will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law and may suspend that instruction while the parties resolve the issue.

6. Confidentiality and personnel

The Supplier will ensure that people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and access the data only where necessary to perform their duties. The Supplier remains responsible for their handling of Customer Personal Data.

7. Security

Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to individuals, the Supplier will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

The current categories of measures are described in Schedule 2. The Supplier may update individual measures as technology and risks change, provided the overall level of protection is not materially reduced.

8. Personal data breaches

The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. As information becomes available, the Supplier will provide a description of the breach, affected data and data subjects, likely consequences, measures taken or proposed, and a contact for further information.

The Supplier will take reasonable steps to contain, investigate, mitigate, and remediate the breach and will reasonably assist the Customer with any legally required notifications. A notification is not an admission of fault or liability.

9. Rights and compliance assistance

Taking account of the nature of the processing and information available to it, the Supplier will provide reasonable assistance to help the Customer:

• respond to requests to exercise data subject rights, including access, rectification, erasure, restriction, objection, and data portability where applicable;
• meet its security and personal data breach obligations;
• carry out data protection impact assessments and any required prior consultation with the Information Commissioner's Office; and
• demonstrate compliance with its obligations relating to the Supplier's processing.

If the Supplier receives a request directly from a data subject relating to Customer Personal Data, it will not respond on the Customer's behalf unless authorised or legally required. Where reasonably possible, it will refer the request to the Customer.

10. Subprocessors

The Customer gives the Supplier general written authorisation to appoint subprocessors. The subprocessors used when this version takes effect are listed in Schedule 3.

The Supplier will impose written data protection obligations on each subprocessor that provide an equivalent level of protection for Customer Personal Data as these DPT require. The Supplier remains responsible to the Customer for a subprocessor's performance of those obligations.

The Supplier will give the Customer reasonable advance notice by email or within the Services before adding or replacing a subprocessor that will process Customer Personal Data. The Customer may object on reasonable data protection grounds. The parties will work in good faith to resolve the objection; if no reasonable solution is available, either party may terminate the affected Services.

11. International transfers

The Supplier will not make a restricted transfer of Customer Personal Data unless it complies with Applicable Data Protection Law. Where required, the Supplier will use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, or another lawful safeguard, and will carry out any required transfer risk assessment.

On reasonable request, the Supplier will provide information needed for the Customer to understand the relevant transfer mechanism, subject to confidentiality and security restrictions.

12. Return and deletion

At the end of the Services involving processing, the Supplier will, at the Customer's choice, return or delete Customer Personal Data and delete existing copies, unless UK law requires continued storage. The Customer must communicate its choice before or promptly after termination and use available export tools within any notified access period.

Data held in backups may remain until the applicable backup is overwritten or securely deleted in the ordinary cycle. Until then, it will remain protected under these DPT and will not be restored or otherwise processed except for recovery, security, or legal compliance. If no choice is communicated, the Supplier may delete the data in accordance with its applicable retention and deletion policy.

13. Information and audits

The Supplier will make available information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and will allow for and contribute to reasonable audits or inspections by the Customer or an independent auditor it appoints.

Unless a regulator, suspected breach, or material compliance concern requires otherwise, audits will take place no more than once in any 12-month period, on reasonable written notice, during normal business hours, and in a way that avoids unnecessary disruption or access to another customer's data. The parties will first seek to meet audit needs using current policies, reports, questionnaires, and remote evidence. Each party bears its own costs unless the audit identifies a material breach by the Supplier.

14. General terms

• Each party's liability under these DPT is subject to the liability provisions of the Agreement, except where Applicable Data Protection Law does not allow a limitation.
• The Supplier may recover reasonable additional costs for assistance or audits that go beyond the standard functionality and information included in the Services, provided it gives the Customer advance notice. This does not limit assistance the Supplier must provide because of its own breach.
• These DPT are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, unless the Agreement states otherwise.
• The Supplier may update these DPT to reflect changes in law, regulatory guidance, or the Services. It will identify the current version and notify the Customer of material changes. Where renewed agreement is legally required, the Supplier will obtain it through the Services or another written method.