Data processing agreement

Your organization decides what donor information is collected and why. KindPath processes it on your instructions, and for no other purpose. In PIPEDA terms you remain accountable for the personal information under your control; KindPath is your service provider.

Separately, KindPath is responsible for your own account information — staff names, sign-in credentials, billing records.

We use it only to:

• run the service you asked for — receipts, recurring giving, reporting;
• keep it secure and diagnose faults;
• meet a legal obligation that applies to us.

We do not sell it, we do not use it to advertise, and we do not use one organization's data to benefit another.

Each organization's data is separated at the database level using PostgreSQL row-level security, so a fault in the application cannot expose one organization's records to another. That isolation is verified automatically before every deployment, and a change that would weaken it fails the build rather than shipping.

We use a small number of providers to operate the service: application hosting, a Canadian-region managed PostgreSQL database, transactional email delivery, and error monitoring. Payment card details are handled entirely by your own payment gateway and never reach KindPath's servers.

We'll give you notice before adding a sub-processor that handles donor personal information, so you have the opportunity to object.

Encryption in transit and at rest; gateway credentials sealed with AES-256-GCM so they are never readable in the database or in a backup; least-privilege database roles; multi-factor authentication available for staff accounts; audit logging of receipt issue and void, exports, and erasure requests.

If we become aware of a breach affecting your data, we will notify you without undue delay and give you the information you need to meet your own obligations to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, and to affected individuals.

Donors can access, correct, port and request erasure of their information directly in their donor portal, and your team can action the same requests from a donor's record. When a donor is erased, the receipts already issued to them are retained — the Income Tax Act requires it, and each receipt keeps the name and address it was issued with so your records stay valid.

You can export donors, donations and receipts at any time while your account is active. On termination we will provide an export on request, and delete your data once any applicable retention period has passed.