Data Processing Agreement

This Data Processing Agreement is an annex to Membrio’s Terms of Service and forms part of them. The Club accepts it at sign-up, together with the Terms of Service. It applies from the moment the Club first enters personal data into Membrio, including during a free pilot or trial period.

1. Parties

Controller:
The club or association that uses the Service (the “Club”)

Processor:
DeRRudi.org, trading as “Membrio”
Nieuwendijk 41
8131 CD Wijhe
Netherlands
KvK: 42136693

Terms not defined here have the meaning given in the Terms of Service and the GDPR.

2. Subject matter and roles

2.1 This agreement covers the processing of personal data by Membrio for the Club in providing the Service.

2.2 The Club determines the purposes and means of processing the personal data of its members, guests and administrators in Membrio. Membrio processes that data only on behalf of the Club, as processor within the meaning of Article 28 GDPR.

2.3 Membrio is itself the controller for the account data of administrators that it needs for its accounts and security, and for its own website, as described in the privacy policy. That processing is not covered by this agreement.

2.4 Annex A describes the processing: its nature and purpose, the categories of personal data and the categories of data subjects.

3. Duration

The processing lasts as long as the agreement does and ends afterwards with the return or deletion of the data (article 11).

4. Instructions

4.1 Membrio processes personal data only on documented instructions from the Club. The Terms of Service, this agreement and the Club’s use of Membrio’s features constitute those instructions.

4.2 Membrio informs the Club without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection law.

4.3 If Membrio is required by law to process personal data otherwise, it informs the Club beforehand, unless the law prohibits this.

5. Confidentiality

Membrio ensures that everyone authorised to process the personal data is bound by confidentiality. Access is limited to people who need it, for example for support, maintenance, resolving faults or security.

6. Security

Membrio implements appropriate technical and organisational measures (Article 32 GDPR). The measures in force on the date of this agreement are listed in Annex B. Membrio may change them, as long as the level of security does not decrease.

7. Sub-processors

7.1 The Club gives general authorisation for the use of the sub-processors listed in Annex C.

7.2 Membrio announces any intended addition or replacement of a sub-processor at least 30 days in advance, by email or in the app. Membrio then also updates Annex C and the privacy policy.

7.3 Within that period the Club may object on reasonable grounds relating to data protection. If the parties cannot reach agreement, the Club may cancel the agreement under the Terms of Service before the change takes effect.

7.4 Membrio imposes obligations on each sub-processor by contract that are no less protective than this agreement. Membrio remains liable to the Club for the sub-processor’s performance.

8. Transfers outside the EU

8.1 Membrio processes personal data within the European Union. The exception is Firebase Cloud Messaging (Google) for push notifications (Annex C). Through Google’s global infrastructure, a device token and the content of the notification may be processed outside the EU/EEA. This transfer relies on Google’s data processing terms and the Standard Contractual Clauses of the European Commission.

8.2 The Club can avoid this transfer by not using push notifications. Members can also switch off push notifications on their own device.

8.3 Membrio does not transfer any other personal data outside the EU/EEA without a valid transfer mechanism under Chapter V GDPR.

9. Assistance

9.1 Membrio assists the Club, by appropriate measures and as far as reasonably possible, in responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability and objection).

9.2 If a data subject contacts Membrio directly about data processed for the Club, Membrio refers that person to the Club, unless the law requires otherwise.

9.3 Membrio also assists the Club with its obligations on security, data breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).

9.4 Membrio may charge for assistance that goes beyond its standard features, at a reasonable rate agreed in advance.

10. Personal data breaches

10.1 Membrio notifies the Club without undue delay after becoming aware of a personal data breach affecting the Club’s data. The notification is sent by email to the Club’s account administrator.

10.2 The notification states, as far as known, the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences and the measures taken or proposed. Membrio supplements this as more becomes known.

10.3 The Club decides whether to inform the supervisory authority and the data subjects.

11. Return or deletion

11.1 After the agreement ends, the Club can still export its personal data for 30 days (see the Terms of Service).

11.2 After that, Membrio deletes the personal data from the active service, and deletes existing copies as well, unless the law requires storage. Copies in backups are overwritten within a limited period afterwards.

11.3 On request, Membrio confirms the deletion in writing.

12. Audits and information

12.1 Membrio provides the Club with the information needed to demonstrate compliance with Article 28 GDPR, for example by answering reasonable written questions about security and sub-processors.

12.2 If that is not sufficient, the Club may have an audit carried out at most once a year by an independent auditor who is bound by confidentiality. The Club announces the audit in writing at least 30 days in advance. The audit takes place during business hours, does not unreasonably disrupt Membrio’s operations and gives no access to the data of other clubs. The Club bears the costs.

13. Liability

The liability provisions of the Terms of Service apply to liability under this agreement. A data subject’s rights against either party under Article 82 GDPR remain unaffected.

14. Order of precedence and governing law

14.1 If the Terms of Service and this agreement conflict on the processing of personal data, this agreement prevails.

14.2 This agreement is governed by Dutch law. The competent court is the one named in the Terms of Service.

14.3 For questions about this agreement or to report a security incident: info@membrio.eu and security@membrio.eu.

Annex A: Processing

Subject matter: providing the Membrio platform for member communication and member administration.

Nature of the processing: storing, organising, displaying, sending (messages, email, push notifications), importing, exporting and deleting.

Purpose: enabling the Club to communicate with its members and keep its membership records.

Categories of data subjects:

• members of the Club, including minors
• guests and contacts, such as parents or guardians
• administrators of the Club

Categories of personal data:

• identification data (name, initials, gender, date of birth, member number)
• contact details (email address, phone number, postal address)
• membership data and membership history, groups and labels
• messages, events, polls and poll responses
• attachments and documents uploaded by the Club or its members
• membership lists uploaded during an import
• push device tokens (FCM) and calendar feed tokens
• any other data the Club records in the fields Membrio provides

Special categories: Membrio does not ask for special categories of personal data. If the Club records any anyway, for example health data, it does so as controller and under its own responsibility.

Annex B: Security measures

• encrypted connections (TLS/HTTPS) for data in transit
• passwords stored only as salted hashes, with optional two-factor authentication
• role-based access, so that administrators can only reach the members they manage
• hosting within the EU, with access control and monitoring
• access for Membrio staff only where necessary and under confidentiality, and, where reasonably possible, anonymised or pseudonymised data for development and analysis
• regular security updates and backups for recovery
• minimal logging, kept only briefly for security and troubleshooting

Annex C: Sub-processors

Membrio uses the following sub-processors to provide the Service:

All sub-processors process personal data only on documented instructions and under agreements that comply with the GDPR.