For the buyer who has to put this in a procurement file.

Last updated 4 September 2026.

Whether you need one at all

A data processing agreement is needed when we handle personal data on your behalf. For most of what we sell, we do not.

• Calendar feeds and the API. These carry religious observance dates and nothing about any person. Subscribing an Outlook or Google calendar to a feed sends us no personal data about your staff. There is nothing here for us to process, so no agreement is required.
• Your own account. The billing contact and the person who holds the API key are personal data, but we hold them as a controller in our own right, in the ordinary way any supplier holds a customer contact. That is covered by our privacy notice, not by a processing agreement.
• A list of your people. If you ask us to mail your staff directly, we would be processing your data on your instructions and an agreement is required. We do not currently offer this.

We say this rather than handing over a signed agreement you do not need, because a pointless one obscures where the real responsibility sits.

What a data protection impact assessment would need

Buyers in the public sector often have to screen a supplier before purchase. The answers are short.

• Personal data we receive from you: a billing contact, and the email address of whoever administers the account.
• Special category data: none. Beliefs are described at the level of a tradition, never a person. We never learn who observes what.
• Children’s data: none. The service is sold to organisations and is not directed at children.
• Where it is held: Amazon Web Services, Ireland, eu-west-1.
• International transfers: none outside the UK and the EEA for customer data.
• Automated decision-making: none affecting any individual.
• Sub-processors: Amazon Web Services for hosting and email. A language model is used to check our own wording against religious bodies’ public pages; it never receives customer data.

A point schools and universities ask about

Displaying a religious calendar tells you which dates matter to which tradition. It does not tell you which of your pupils or staff observe them, and we never receive that information. If you record who has asked for leave on a given date, that record is yours and sits in your systems, not ours. It will usually be special category data under Article 9, and your own assessment should cover it.

Security

• Everything is served over HTTPS. The operational domain is HTTPS-only by registry policy.
• Storage is encrypted, and no storage bucket is publicly readable.
• API access requires a key checked at the gateway before any request reaches our code. Two keys can be live at once so a rotation needs no downtime.
• Staff tools sit on a separate domain behind a password and a second sign-in code.
• Automated jobs that could remove content hold no credential to publish it, and the job that proposes content can only propose.

If something goes wrong

If we suffer a breach affecting your data we will tell you without undue delay and in any event within 72 hours of becoming aware, with what we know, what we are doing, and what you may need to report. Report a suspected vulnerability to security@beliefcalendar.app.

Asking for the paperwork

If your procurement process needs a signed agreement, a supplier assurance questionnaire or a completed impact assessment, write to legal@beliefcalendar.app. We would rather answer your form than send you a template that does not fit.