Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between [Company legal name] (“memberbeam”) and the Organization that uses the Service (“Customer”). It applies automatically when Customer accepts the Agreement, and no separate signature is required. If Customer needs a countersigned copy, contact privacy@memberbeam.com.

Capitalized terms not defined in this DPA have the meanings given in the Agreement. If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA controls. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

1. Definitions

“Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement, including, as applicable: the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as incorporated into UK law and the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (“CCPA”), and other US state privacy laws; the Australian Privacy Act 1988 (Cth); the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial laws; and the New Zealand Privacy Act 2020.

“Customer Personal Data” means personal data within Customer Data that memberbeam processes on behalf of Customer in providing the Service.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by memberbeam or its Sub-processors.

“Sub-processor” means any third party engaged by memberbeam to process Customer Personal Data.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

“UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

“Controller”, “processor”, “data subject”, “personal data”, “processing”, “business”, “service provider”, and “supervisory authority” have the meanings given in Data Protection Laws.

2. Roles of the parties

2.1 Customer as controller. Customer is the controller (or business) of Customer Personal Data. Customer may act as a processor on behalf of another controller, such as a parent association or national body, in which case Customer confirms that its instructions are authorized by that controller and memberbeam acts as Customer’s sub-processor.

2.2 memberbeam as processor. memberbeam is a processor (or service provider) and processes Customer Personal Data only on Customer’s behalf.

2.3 memberbeam as controller. memberbeam is an independent controller of personal data relating to Customer’s Admins for account administration, billing, security, and support, and of personal data of visitors to its marketing website. That processing is described in memberbeam’s Privacy Policy and is not covered by this DPA.

2.4 Customer’s responsibilities. Customer is responsible for:

the lawfulness of its instructions and of the collection of Customer Personal Data, including having a lawful basis and providing required notices to data subjects;
obtaining any consents required by law, including consent to receive marketing emails and SMS messages, and any parental or guardian consent needed for personal data relating to minors;
the content of waivers, releases, and consent forms it collects through the Service, and whether electronic signatures are appropriate for its purposes; and
configuring the Service, including user permissions, retention settings, and integrations, in a way that meets its obligations.

3. Processing instructions

3.1 memberbeam will process Customer Personal Data only on Customer’s documented instructions, unless required to do otherwise by applicable law. In that case, memberbeam will inform Customer of the legal requirement before processing, unless the law prohibits this.

3.2 Customer’s instructions are set out in the Agreement, this DPA, and Customer’s use and configuration of the Service, including through the API and integrations Customer enables. Additional instructions must be agreed in writing.

3.3 memberbeam will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.4 The details of processing are described in Annex 1.

4. Confidentiality

memberbeam will ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality, receive training on data protection and security, and access Customer Personal Data only as needed to provide the Service, provide support at Customer’s request, or meet legal obligations.

5. Security

5.1 memberbeam will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include those described in Annex 2.

5.2 memberbeam may update its security measures from time to time, provided the updates do not materially decrease the overall protection of Customer Personal Data.

5.3 Customer is responsible for its own secure use of the Service, including protecting Admin credentials, managing Admin access, enabling multi-factor authentication, and securing any data it exports from the Service.

6. Sub-processors

6.1 Authorization. Customer gives memberbeam general authorization to engage Sub-processors. The current list of Sub-processors, including their purpose and location, is published at Sub-processors.

6.2 Obligations. memberbeam will enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services provided. memberbeam remains responsible for each Sub-processor’s performance of its obligations.

6.3 Notice of changes. memberbeam will give at least 30 days’ notice before a new Sub-processor begins processing Customer Personal Data, by updating the Sub-processors page and emailing subscribers to that page. Customer can subscribe by emailing privacy@memberbeam.com. In an emergency, such as replacing a Sub-processor that has failed, memberbeam may give shorter notice, and will give notice as soon as reasonably practicable.

6.4 Objections. Customer may object to a new Sub-processor on reasonable data protection grounds by notifying privacy@memberbeam.com within the notice period. The parties will discuss Customer’s concerns in good faith. If memberbeam cannot reasonably accommodate the objection, Customer may terminate the affected part of the Service by written notice and receive a refund of any prepaid Subscription Fees for the unused period.

6.5 Optional Sub-processors. Some Sub-processors process Customer Personal Data only when Customer enables a related feature or integration, such as GoCardless, Twilio, QuickBooks Online, or Xero. By enabling the feature, Customer instructs memberbeam to share data with that provider.

7. Data subject requests

7.1 memberbeam will, taking into account the nature of processing, provide reasonable assistance to Customer through appropriate technical and organizational measures to help Customer respond to requests from data subjects to exercise their rights under Data Protection Laws.

7.2 The Service includes tools that let Customer access, correct, export, and delete Customer Personal Data. Where Customer cannot fulfill a request using those tools, memberbeam will provide reasonable additional assistance on request.

7.3 If memberbeam receives a request directly from a data subject relating to Customer Personal Data, it will promptly forward it to Customer where the Customer can be identified, and will not respond to the request itself except to direct the data subject to Customer, unless legally required to do so.

8. Assistance

memberbeam will provide reasonable assistance to Customer, taking into account the nature of processing and the information available to memberbeam, with:

data protection impact assessments and prior consultations with supervisory authorities, where required by Data Protection Laws;
Customer’s compliance with its security obligations; and
Customer’s responses to inquiries from supervisory authorities relating to the Service.

memberbeam may charge a reasonable fee for assistance that goes significantly beyond what is normally provided, after agreeing that fee with Customer in advance.

9. Personal Data Breaches

9.1 memberbeam will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.

9.2 The notice will be sent to the primary contact email on Customer’s Account and will describe, to the extent known:

the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned;
the likely consequences;
the measures taken or proposed to address the breach and mitigate its effects; and
a contact point for more information.

Where information is not yet available, memberbeam will provide it in phases as it becomes available.

9.3 memberbeam will take reasonable steps to contain, investigate, and remediate the Personal Data Breach, and will cooperate with Customer in meeting its own notification obligations to supervisory authorities and data subjects.

9.4 memberbeam’s notification of a Personal Data Breach is not an acknowledgement of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as blocked login attempts, pings, port scans, or denial-of-service attacks, are not Personal Data Breaches.

10. Audits

10.1 memberbeam will make available to Customer, on written request, the information reasonably necessary to demonstrate compliance with this DPA. This may include summaries of security policies, completed security questionnaires, and copies of third-party audit reports or certifications held by memberbeam or its hosting providers, subject to confidentiality.

10.2 If the information provided is not reasonably sufficient to demonstrate compliance, or if a supervisory authority requires it, Customer may conduct an audit, including an inspection, no more than once in any 12-month period, unless following a Personal Data Breach. Customer must:

give at least 30 days’ written notice;
agree the scope, timing, and duration of the audit with memberbeam in advance;
conduct the audit during normal business hours, without unreasonably disrupting memberbeam’s operations;
use an auditor that is not a competitor of memberbeam and is bound by confidentiality obligations; and
bear its own costs, and memberbeam’s reasonable costs where the audit requires significant time from memberbeam personnel.

10.3 Audits will not include access to data of other customers, or to facilities of Sub-processors such as AWS, where memberbeam will instead provide the Sub-processor’s relevant audit reports.

11. International transfers

11.1 Hosting regions. Customer Personal Data is stored at rest on Amazon Web Services in the region assigned to Customer’s Account, currently the United States or the European Union. Sub-processors may process Customer Personal Data in other locations as listed on the Sub-processors page.

11.2 Transfers from the EEA. To the extent memberbeam processes Customer Personal Data originating from the European Economic Area in a country that has not received an adequacy decision, the parties agree that the SCCs are incorporated into this DPA by reference, as follows:

Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor;
in Clause 7, the optional docking clause does not apply;
in Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 6.3 of this DPA;
in Clause 11, the optional language does not apply;
in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
in Clause 18(b), disputes will be resolved before the courts of Ireland; and
Annexes I and II of the SCCs are completed with the information in Annex 1 and Annex 2 of this DPA, and the competent supervisory authority is determined in accordance with Clause 13.

11.3 Transfers from the United Kingdom. To the extent memberbeam processes Customer Personal Data originating from the United Kingdom in a country that has not received adequacy regulations, the UK Addendum is incorporated into this DPA and applies to the SCCs as completed in Section 11.2. Table 1 of the UK Addendum is completed with the parties’ details in the Agreement, Tables 2 and 3 with the information in Section 11.2 and the Annexes of this DPA, and in Table 4 either party may end the UK Addendum as set out in its Section 19.

11.4 Transfers from Switzerland. For transfers subject to Swiss data protection law, the SCCs apply as completed in Section 11.2, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and “Member State” read to include Switzerland so that data subjects in Switzerland can bring claims there.

11.5 Data Privacy Framework. Where memberbeam or a Sub-processor is certified under the EU-U.S. Data Privacy Framework, the UK Extension, or the Swiss-U.S. Data Privacy Framework, transfers may rely on that certification. The SCCs remain in place as a fallback.

11.6 Other jurisdictions. For transfers of Customer Personal Data subject to the laws of Australia, Canada, New Zealand, or other jurisdictions with transfer requirements, memberbeam will take reasonable steps to ensure that recipients protect the data in a way that is comparable to Data Protection Laws, including through contractual safeguards with Sub-processors.

11.7 Government access requests. If memberbeam receives a request from a public authority for access to Customer Personal Data, it will, unless legally prohibited, notify Customer and redirect the authority to Customer. memberbeam will review each request for legality, challenge requests it reasonably considers unlawful or overly broad, and disclose only the minimum data necessary to comply.

12. Deletion and return of data

12.1 Customer may export Customer Personal Data at any time while its Account is active, and for 30 days after its Account is closed or its subscription ends (the “Export Window”), using the tools in the Service or by request to support@memberbeam.com.

12.2 After the Export Window ends, memberbeam will delete Customer Personal Data from its active systems within 30 days, and from backups within a further 35 days as backups expire on their normal rotation.

12.3 memberbeam may retain Customer Personal Data to the extent required by applicable law, in which case it will continue to protect the data in accordance with this DPA and process it only for the purposes for which it is retained.

12.4 On request, memberbeam will confirm in writing that deletion has been completed.

12.5 Customer acknowledges that information on Apple Wallet or Google Wallet passes already installed on a data subject’s device remains on that device until the data subject removes it, and that copies of data shared with Third-Party Services that Customer has connected, such as Stripe or accounting software, are governed by Customer’s agreements with those providers.

13. CCPA service provider terms

To the extent the CCPA applies, memberbeam is a service provider and will not:

sell or share Customer Personal Data, as those terms are defined in the CCPA;
retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service, or outside the direct business relationship between memberbeam and Customer;
use Customer Personal Data for targeted or cross-context behavioral advertising; or
combine Customer Personal Data with personal data it receives from other sources, except as permitted by the CCPA.

memberbeam will comply with applicable obligations under the CCPA, provide the same level of privacy protection as required by the CCPA, and notify Customer if it determines it can no longer meet its obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data. memberbeam certifies that it understands and will comply with these restrictions.

14. AI features

Where Customer uses optional AI features, memberbeam will send only the inputs needed to provide the feature to its AI Sub-processor, which processes them to generate output and is contractually prohibited from using Customer Personal Data to train its models. memberbeam does not use Customer Personal Data to train third-party AI models.

15. Liability and term

15.1 Each party’s liability arising out of or relating to this DPA is subject to the limitations of liability in the Agreement, except to the extent such limitations are prohibited by Data Protection Laws or the SCCs.

15.2 This DPA remains in effect for as long as memberbeam processes Customer Personal Data, and ends automatically once all Customer Personal Data has been deleted in accordance with Section 12.

15.3 memberbeam may update this DPA to reflect changes in Data Protection Laws or the Service, provided the changes do not materially reduce the protection of Customer Personal Data. Material adverse changes will be notified in accordance with the Agreement.

Annex 1: Details of processing

A. List of parties

Data exporter: Customer, as identified in its Account. Contact details: the primary contact on Customer’s Account. Role: controller (or processor on behalf of another controller). Activities: use of the Service to manage its membership, events, payments, and communications.

Data importer: [Company legal name], [Registered address]. Contact: privacy@memberbeam.com. Role: processor. Activities: provision of the Service as described in the Agreement.

B. Categories of data subjects

Members, including current, former, and lapsed members
Household and family members, which may include minors
Prospects, applicants, and leads
Donors and payers
Event registrants, ticket holders, attendees, and guests
Volunteers, speakers, and sponsors
Form, survey, and waiver respondents and signers, including parents or guardians signing on behalf of minors
Recipients of email and SMS communications
Customer’s Admins and staff, to the extent their data is processed as part of Customer Data
Any other individuals whose data Customer chooses to store in the Service

C. Categories of personal data

Identity and contact data: name, email address, phone number, postal address, date of birth, photo, membership number
Membership data: membership level, status, start and renewal dates, household relationships, chapter or group affiliation, directory profile, custom fields defined by Customer
Transaction data: payments, invoices, refunds, donations, platform and processing fees, payment method type and last four digits (full card and bank details are held by Stripe or GoCardless)
Event data: registrations, tickets, attendance, check-in times, badge details
Wallet pass data: pass content, serial numbers, device library identifiers, push tokens, and pass registration and update history
Waiver and signature data: signed documents, typed or drawn signatures, signer name, relationship to a minor where applicable, date and time of signing, IP address, device and browser information, and the version of the document signed
Communications data: email and SMS content, delivery, open, click, bounce, and unsubscribe events, consent records
Form and survey data: responses to forms and surveys created by Customer
Technical data: IP addresses, device and browser information, and activity logs for member portal, website, and kiosk use
AI feature data: inputs and outputs of AI features used by Customer’s Admins
Integration data: data exchanged with integrations Customer enables, such as QuickBooks Online, Xero, and Zapier

D. Special categories and sensitive data

The Service is not designed to process special categories of personal data. However, Customer may choose to collect such data, for example health, dietary, or accessibility information for events, or information that reveals religious or political affiliation by virtue of membership in a particular organization. Customer is responsible for ensuring it has a lawful basis and appropriate safeguards for any such data, and for using the Service’s access controls to restrict access to it. The safeguards in Annex 2 apply to all Customer Personal Data.

E. Frequency of transfer

Continuous, for the duration of the Agreement.

F. Nature and purpose of processing

Hosting, storage, organization, retrieval, transmission, display, synchronization, and deletion of Customer Personal Data to provide the Service, including: member database and portal; membership renewals; online payments and fee collection; events and QR check-in; issuing and updating wallet passes; organizer mobile apps, including offline sync, kiosk mode, badge printing, and Tap to Pay; email campaigns and automations; SMS; websites and member directories; forms, surveys, and digital waivers; accounting and other integrations; API and webhooks; optional AI features; customer support; and security, fraud prevention, and troubleshooting.

G. Retention period

For the duration of the Agreement, subject to Customer’s own deletion and retention settings, and then as set out in Section 12 of this DPA.

H. Sub-processor transfers

As set out on the Sub-processors page, for the purposes and in the locations listed there, for the duration of the Agreement.

Annex 2: Technical and organizational security measures

memberbeam maintains the following measures, which it reviews and updates regularly.

Governance

Documented information security policies, reviewed at least annually
A named individual responsible for security and data protection
Confidentiality obligations for all personnel and contractors
Security and privacy training at onboarding and at least annually
Background checks for personnel with access to production systems, where permitted by law

Infrastructure and hosting

Hosting on Amazon Web Services, whose data centers maintain recognized certifications such as ISO 27001 and SOC 2
Logical separation of customer data, with tenant isolation enforced at the application and database layers
Regional hosting, with each Organization pinned to the US or EU region
Network segmentation, firewalls, and restricted security groups
DDoS protection and web application firewall through Cloudflare

Encryption

Encryption in transit using TLS 1.2 or higher for all connections to the Service
Encryption at rest using AES-256 for databases, backups, and file storage
Secrets and keys managed in a dedicated secrets management service, with access restricted and rotated
Passwords stored using a strong, salted, adaptive hashing algorithm

Access control

Role-based access controls within the Service, configurable by Customer
Multi-factor authentication available to all Admins, and required for memberbeam personnel
Least-privilege access to production systems, granted only to personnel who need it and reviewed regularly
Single sign-on and centralized identity management for internal systems
Prompt removal of access when personnel leave or change roles
Customer data accessed by support staff only when needed to resolve a support request or security issue

Logging and monitoring

Centralized logging of access to production systems and administrative actions
Audit logs of significant actions in the Service available to Customer, where provided by the Plan
Automated monitoring and alerting for availability, errors, and suspicious activity
Error monitoring configured to minimize collection of personal data

Secure development

Code review for all changes to production code
Separate development, staging, and production environments; production data is not used in development
Automated dependency and vulnerability scanning
Periodic penetration testing by independent third parties, with findings tracked to remediation
A responsible disclosure program, with reports accepted at security@memberbeam.com

Availability and resilience

Automated, encrypted backups with point-in-time recovery for primary databases
Backups retained for up to 35 days and tested periodically
Infrastructure deployed across multiple availability zones within each region
Documented incident response and business continuity procedures, tested periodically

Payments

Card and bank account details collected directly by Stripe or GoCardless using their hosted or embedded components; memberbeam does not store full card numbers
Reliance on Stripe’s and GoCardless’s PCI DSS compliant infrastructure

Mobile apps and devices

Encrypted local storage of offline data on organizer devices
Kiosk mode that restricts access to check-in functions
Ability for Customer to revoke access for a lost or stolen device by removing the Admin’s session

Vendor management

Security and privacy review of Sub-processors before engagement and periodically afterward
Written data protection terms with all Sub-processors

Data minimization and deletion

Collection limited to what is needed to provide the Service
Tools for Customer to delete individual records and export data
Deletion of Customer data after account closure as set out in Section 12 of this DPA

Annex 3: Sub-processors

The list of Sub-processors authorized by Customer is published at https://memberbeam.com/legal/subprocessors and is incorporated into this DPA by reference.