← Back to home

Data Processing Agreement

Effective from November 1, 2026

The agreement consists of Part A (arrangements between the parties), Part B (standard contractual clauses between controllers and processors under Commission Implementing Decision (EU) 2021/915) and Annexes I–IV. The clauses are officially translated into all EU languages, so language versions of the agreement are created by adopting the official text and translating Part A and the Annexes.

Part A – Arrangements between the parties

This part supplements the standard contractual clauses in Part B (Clause 2(b)). Nothing in it may be interpreted in contradiction with the Clauses or in a way that would restrict the rights of data subjects; in the event of a contradiction, the Clauses prevail (Clause 4).

A.1 Parties. The processor is the operator of the myteo service (Annex I). The customer is the person who concludes the agreement for the needs of the congregation specified when the agreement is concluded. The customer declares that they are the controller of the personal data, or that they are authorised to act on behalf of the controller they specify when concluding the agreement (a religious organisation or another entity of which the congregation is a part, a congregation with legal personality, or the elders of the congregation as joint controllers), and to conclude this agreement on its behalf. If they are not so authorised, they are bound by the agreement themselves. The controller is listed in Annex I.

A.2 Conclusion. The agreement is concluded in electronic form (Article 28(9) GDPR) by confirmation in the MYJW app (when registering the congregation, or in Admin → Congregation → Data protection). The processor keeps a record of the conclusion (version and fingerprint of the agreement text, date and time, the person and their account, the congregation, the specified controller, the declaration under Section A.1, IP address and browser) and sends a confirmation of it, together with the text of the agreement, to the congregation's contact email.

A.3 Relationship to the service agreement. The agreement forms part of the agreement on the provision of the myteo service (terms of service) and remains in force for its entire duration and thereafter until the data is erased or returned under Section A.9.

A.4 Controller's instructions. The controller's documented instructions (Clause 7.1) are: this agreement, the settings and use of the app's features by authorised users of the congregation, and instructions sent from the congregation's contact email or by a person with the congregation administrator role in the app.

A.5 Contacts and notices. The processor sends notices under this agreement to the congregation's contact email and also displays them to the congregation administrators in the app. The customer is responsible for keeping the contact email up to date. The controller sends notices to the processor's contact in Annex I.

A.6 Sub-processors. The controller gives general written authorisation (Clause 7.7(a), Option 2) to engage the sub-processors listed in Annex IV. The processor gives notice of an intended change under Section A.5 at least 30 days in advance. The controller may raise a reasoned objection until the end of this period; if it does not, it is deemed to agree to the change. If the processor does not accommodate the objection, the customer may terminate the service agreement as of the date the change takes effect, and the processor will refund the proportionate part of the price for the unused prepaid period.

A.7 Personal data breach. The processor notifies the controller of a personal data breach (Clause 9.2) without undue delay and no later than 48 hours after becoming aware of it, to the extent set out in Clause 9.2 and Annex III, point 11.

A.8 Information and audits. On request, the processor provides, within 30 days, the information necessary to demonstrate compliance (Clause 7.6), in particular a current description of the measures and a completed questionnaire. An on-site audit or an audit by an independent auditor is possible at reasonable intervals, as a rule no more than once a year, and always if there are indications of non-compliance, if a personal data breach has occurred, or if a supervisory authority requests it. It is announced at least 30 days in advance (in the other cases listed, with a reasonably shorter notice period), the auditor is bound by confidentiality, and the costs of the audit are borne by the controller, unless the audit reveals a serious breach of this agreement by the processor. The processor does not charge fees for its cooperation in the audit.

A.9 End of the agreement, return and erasure (Clause 10(d)). The service agreement ends at the controller's request to delete the congregation, or 12 months after the end of the subscription if the congregation has not renewed it by then (Terms of Service, Section 5). Data is returned by means of the export feature in the app, available to the congregation administrators throughout the agreement, including the period when the congregation is locked after the subscription ends. The processor erases all personal data of the congregation from its operational systems within 60 days at the latest and from backups within 90 days at the latest after the agreement ends. It confirms the erasure to the congregation's contact email.

A.10 Liability. The processor is liable to the customer for damage caused by a breach of this agreement up to an amount equal to the price paid for the service over the last 12 months, but not less than CZK 25,000. The limitation does not apply to damage caused intentionally or through gross negligence, or to harm to a person's natural (personality) rights. This is without prejudice to liability towards data subjects (Article 82 GDPR) or to obligations under the GDPR.

A.11 Amendments to the agreement. The processor updates the Annexes to reflect the actual situation (Clause 2(a)); it gives notice of a change to Annex IV under Section A.6. The processor gives notice of a change to Part A under Section A.5 at least 30 days before it takes effect. The customer may reject it and terminate the service agreement as of the date the change takes effect; the processor will refund the proportionate part of the price for the unused prepaid period. The customer confirms a material change in the app.

A.12 Governing law. The agreement is governed by the law of the Czech Republic. Disputes are decided by the court of general jurisdiction of the processor; this is without prejudice to mandatory consumer protection provisions or to Article 79 GDPR.

Part B – Standard Contractual Clauses

The Standard Contractual Clauses between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (OJ L 199, 7.6.2021, p. 18) form part of this agreement in their official wording, English version on EUR-Lex, with these options selected: Clauses 1, 8 and 9 – Regulation (EU) 2016/679; Clause 5 (docking clause) does not apply; Clause 7.7 – Option 2 (general written authorisation), with a time period of 30 days. The Annexes to the Clauses are Annexes I–IV below.

Annex I – List of parties

Controller: the entity the customer names when concluding the agreement (Art. A.1), i.e. depending on the situation: the religious organisation or other entity the congregation is part of; a congregation with its own legal personality; or the elders of the congregation as joint controllers. Congregation: name, country and identifier of the congregation in myteo. Acting for the controller: the customer – name, email and role in the congregation. Contact email for data protection: the email set in Admin → Congregation → Data protection (by default the customer's email). The details are kept in the app and sent by email when the agreement is concluded. Signature and date: electronic confirmation in the app (Art. A.2).

Processor: Tomáš Leitl, sole trader, company ID 03857867, registered address Nad Stadionem 355, 267 01 Králův Dvůr, operator of the myteo service. Data protection contact: info@myjw.app. Signature and date: by publishing this version of the agreement and its confirmation by the controller.

Annex II – Description of the processing

Categories of data subjects

• people the congregation keeps in the app: members of the congregation (publishers, unbaptized publishers, including minors) and other people taking part in congregation activities (e.g. speakers and guests from other congregations);
• users of the app (a subset of the above);
• people whose addresses the congregation keeps at points in territories (e.g. addresses where residents do not wish to be visited), if the congregation uses this feature.

Categories of personal data

• identification and contact details: first name, last name, email, phone, group, congregation;
• data on congregation activities: roles and privileges (e.g. baptized, pioneer, ministerial servant, elder), meeting assignments, meetings for field service, cart shifts, assigned territories and their coverage, absences, connections with friends, change history;
• field service reports (participation, hours, Bible studies, notes) – encrypted with the congregation key;
• address, date of birth, date of baptism – encrypted with the congregation key;
• login and technical data: password verifier (bcrypt), login tokens, encrypted keys, push subscriptions, settings, time of last login, operational logs (IP address, time, request);
• location: only when a user in a territory group turns on location sharing; only the last point is stored and it is deleted at the latest 10 minutes after the last update; drawn covered parts of a territory;
• addresses and notes at points in territories, if the congregation enters them.

Sensitive data The data reveal religious beliefs (membership of a congregation of Jehovah's Witnesses), i.e. a special category of data under Art. 9 GDPR. Specific restrictions and safeguards (Clause 7.5): the most sensitive data (field service reports, address, date of birth and baptism) are encrypted in the browser with the congregation key, which the processor does not know; access in the app only according to roles and permissions set by the controller; no transfer to third parties and no use for other purposes (analytics only aggregated and without identifying people); servers and backups only in the Czech Republic; the data are processed personally by the processor.

Nature of the processing Operating the myteo web application: storing, organising, searching and making data available to congregation users according to their permissions, sending notifications by email and push, export, backup, restore and erasure.

Purpose of the processing Providing the myteo service to the congregation: organising congregation activities (meetings, field service, territories, carts, field service reports, absences) under the service agreement.

Duration of the processing For the duration of the myteo service agreement. After it ends, according to Part A, Art. A.9 (erasure from operational systems within 60 days, from backups within 90 days).

Sub-processors: see Annex IV.

Annex III – Technical and organisational measures

1. Encryption. All traffic over HTTPS (TLS). Field service reports and sensitive fields (address, date of birth and baptism) are encrypted in the browser with the congregation key (AES-GCM 256); the key is passed only between users of the congregation (ECDH P-256), the processor does not know it and cannot read the content. Passwords: the verifier is derived in the browser (PBKDF2) and only its bcrypt hash is stored on the server.
2. Separation of congregations and access control. Every record carries the congregation identifier, which the server checks on every request. In the app, roles and permissions set by the controller decide. Only the processor has access to the server (SSH keys, no passwords); the app uses a database user with the least privileges needed. Accounts with the hosting, code hosting and email service are protected by two-factor authentication.
3. Location. The server and backups are in the Czech Republic (WEDOS). Copies of backups held by the processor are only on an encrypted disk.
4. Backup and restore. Regular database backups kept for at most 30 days; restoring from backup is tested regularly.
5. Retention. Application logs at most 12 weeks, web server logs at most 14 days, usage analytics only without identifying people and at most 90 days, trash 24 hours, location 10 minutes, records of sent emails at most 90 days.
6. Minimisation. Emails and push notifications contain only the data needed for their purpose; field service reports and encrypted fields are never sent in them.
7. Development and testing use made-up sample data, not congregation data.
8. Vulnerabilities and updates. Automatic monitoring of vulnerable dependencies, checks for leaked secrets in the code, ongoing server updates.
9. Monitoring. Automatic checks of availability, certificates, services and backup age every 15 minutes.
10. Assisting the controller (Clause 8). The controller can correct data in the app, delete a person (permanently anonymise), export the data of a person or of the whole congregation and download the list of sub-processors. The processor handles other requests within 14 days of receipt.
11. Personal data breach (Clause 9.2). The processor informs the congregation's contact email at the latest within 48 hours of becoming aware of it and shows a notice to administrators in the app. The notice also includes: when it happened and was discovered, the features affected, whether encrypted data were affected and whether the congregation key may have been disclosed, and recommended steps for the congregation (e.g. changing the key, passwords).
12. Confidentiality. The data are processed personally by the processor. Any collaborators are bound by confidentiality and have access only to the extent necessary.
13. Records and documentation. The processor keeps records of processing activities (Art. 30(2) GDPR) and a register of personal data breaches. It provides congregations with materials for a data protection impact assessment (DPIA template).

Annex IV – List of sub-processors

Sub-processor	Registered office	Activity	Data location
WEDOS Internet, a.s., company ID 28115708	Hluboká nad Vltavou, Czech Republic	application server, database, backups	Czech Republic
[email provider – to be added once selected]	EU	sending email notifications	EU

Other recipients of technical data (not sub-processors):

• Seznam.cz, a.s. (Czech Republic) – Mapy.com map tiles. The user's browser downloads the map directly; Seznam.cz receives the IP address and the displayed map area.
• OpenStreetMap Foundation (United Kingdom, adequacy decision) – fallback map tiles, as above.
• Push service operators of browsers (Google, Mozilla, Apple) – deliver notifications; the content of notifications is encrypted and only the user's device reads it. Data may be transferred to the USA (EU–US Data Privacy Framework).
• Google – only when a user signs in with Google: Google learns that they are signing in to myteo, and the processor receives from it only the verified email. This is a relationship between the user and Google; signing in with a password works without it.
• Paddle.com Market Limited (United Kingdom) – reseller of the subscription (Merchant of Record), an independent controller of the payer's payment and billing data. It does not receive data of congregation members.