Data protection law requires a written contract between an organisation that decides how personal data is used (the controller) and a company that handles the data for it (the processor). This is that contract. It forms part of the terms of service and applies from the day the organisation opens its Azonation account. Nobody needs to sign it separately.
1. Who the parties are
- The organisation: the club, charity, association or other body that has an Azonation account. In this agreement it is “you”. You are the controller.
- Azon Group Ltd, a company registered in England and Wales, company number 13783721, registered office 5 Brayford Square, London, England, E1 0SG. In this agreement it is “we”. We are the processor.
2. Definitions
- Data protection law means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to the processing, the EU General Data Protection Regulation (EU GDPR) and any other data protection law that applies to you or to us.
- Personal data, controller, processor, processing, data subject and personal data breach have the meanings given in the UK GDPR. In this agreement we call data subjects “people”.
- Your data means the personal data that you, or people acting for you, put into Azonation or collect through it, and that we process for you.
- Sub-processor means another company that we use to process your data.
- The terms means the terms of service, and the service means Azonation as described there.
3. What this agreement covers
3.1 Subject matter
We process your data to provide the service to you: storing your records, showing them to the people you allow, sending your messages and producing your reports.
3.2 Duration
We process your data for as long as you have an Azonation account, and afterwards only for the short time needed to return and delete it under section 14.
3.3 Nature and purpose
We store, organise, show, send, export, back up and delete your data. The purpose is to provide, maintain, secure and support the service for you. Annex 1 gives the details.
3.4 What this agreement does not cover
For some data we are a controller ourselves: Azonation accounts of individual people, our billing records, support requests and our own website. Our privacy notice covers that data, not this agreement.
4. Types of personal data and categories of people
Your data concerns your members, their families, donors, volunteers, guests, and your officers. Annex 1 lists the types of data.
You decide what you record. Azonation does not ask for special category data, such as data about health, religion or ethnicity. You must not record such data unless you have a lawful basis for it. If membership of your organisation itself reveals a belief (for example in a faith group, a political association or a trade union), you are responsible for the lawful handling of that.
5. Your instructions
5.1 We process your data only on your documented instructions. Your instructions are:
- this agreement and the terms;
- the settings you choose and the actions that you, and the people you give a role, take in the service; and
- any other written instruction that you give us and that we accept as being within the service.
5.2 This also applies to transfers of your data outside the UK. Section 13 sets out your instructions on transfers.
5.3 If the law of the UK, or another law that applies to us, requires us to process your data in some other way, we tell you before we do so, unless that law forbids us to tell you on important grounds of public interest.
5.4 If we think that an instruction breaks data protection law, we tell you without delay. We may then wait before following that instruction until you confirm or change it.
5.5 We do not use your data for our own purposes. We do not sell it and we do not use it for advertising.
6. Your responsibilities
You are responsible for:
- having a lawful basis for the data you record and for each use you make of it, including messages you send by email, WhatsApp or SMS;
- telling the people concerned what you do with their data;
- recording data about children only where you have the right to do so;
- the accuracy of your data and how long you keep each record;
- choosing who gets a role, and removing roles when people leave;
- keeping sign-in details safe;
- the services you connect yourself with your own accounts (see annex 3); and
- giving us only lawful instructions.
7. Confidentiality
7.1 Only those of our staff who need access to your data for the service have it. All of them are bound by a duty of confidentiality, in their contract or by law, which continues after they leave.
7.2 Our staff open an organisation’s records only to provide support that you asked for, to keep the service secure and working, or where the law requires it.
7.3 In a secret ballot, nothing links a ballot to the voter. That is also true for our staff.
8. Security
8.1 We take appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as required by Article 32 of the UK GDPR.
8.2 The measures in place are listed in annex 2. We may change them as technology and risks change, but we will not lower the overall level of protection. Our security page describes them in plain words.
9. Sub-processors
9.1 General authorisation. You give us general written authorisation to use sub-processors. The sub-processors we use at the date of this agreement are on the list of sub-processors, and you approve them.
9.2 Same duties. We have a written contract with each sub-processor that places on it data protection duties equivalent to those in this agreement, in particular on security.
9.3 Our responsibility. If a sub-processor fails in its data protection duties, we remain fully responsible to you for it.
9.4 New sub-processors. Before we add or replace a sub-processor, we give you at least 30 days’ notice, by email to your admins and on the list of sub-processors.
9.5 Your right to object. You may object within those 30 days, in writing to support@azonation.com, on reasonable grounds that relate to data protection. We then discuss it with you in good faith. We may offer a way of using the service without the new sub-processor, for example by leaving an optional feature switched off. If no solution is found, you may end the affected part of the service, or your account, without penalty [to confirm: refund of fees paid in advance].
9.6 Services you connect yourself. Services that you connect with your own account are not our sub-processors. You have your own agreement with them. Annex 3 names them.
10. Helping with people’s rights
10.1 People have rights over their data: access, correction, erasure, restriction, portability and objection. You are the one who must answer them.
10.2 The service gives you tools for this. A person with an account can download their data and ask for erasure, and you answer data requests from a page in the app.
10.3 If a person sends a request about your data to us, we pass it to you without undue delay and do not answer it ourselves, except to tell the person that we have passed it on.
10.4 Where the tools are not enough, we give you reasonable further help, taking into account the nature of the processing.
11. Personal data breaches
11.1 If we become aware of a personal data breach that affects your data, we tell your admins without undue delay, and in any case within 72 hours of becoming aware [to confirm].
11.2 Our notice says, as far as we know it at the time: what happened; the kinds of data and roughly how many people are affected; the likely consequences; what we have done and plan to do; and who to contact. What we do not yet know, we add in stages without further undue delay.
11.3 We take reasonable steps to contain the breach and to limit its effects, and we help you to meet your own duties to notify the Information Commissioner’s Office and the people affected.
11.4 You decide whether to notify the regulator and the people affected.
12. Impact assessments and consulting the regulator
If you must carry out a data protection impact assessment for your use of the service, or consult the Information Commissioner’s Office beforehand, we give you the information about the service that you reasonably need, taking into account the nature of the processing and the information available to us.
13. International transfers
13.1 We host the service in the UK or the EU [to confirm: hosting provider and country].
13.2 You instruct us to transfer your data to the sub-processors on the list of sub-processors, including where they are outside the UK and the European Economic Area (EEA), for the tasks shown there.
13.3 Where a sub-processor is outside the UK and the EEA, we make the transfer only under a safeguard that data protection law accepts. We use the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum.
13.4 You may ask us for a copy of the safeguards we rely on. We may remove commercial details from it.
14. Return and deletion at the end
14.1 Return. While your account is open, and during the waiting time in 14.2, you can export your data from the service in common file formats.
14.2 Deletion. When an admin closes the organisation, there is a waiting time of 30 days, during which the closing can be undone. After that, we delete your data from the live service. Backups that still contain your data roll off within a further 30 days [to confirm].
14.3 Unpaid invoices. We do not delete your data for non-payment during 12 months [to confirm]. Before we delete data for that reason, we tell your admins in good time so that you can export it.
14.4 What we may keep. We may keep your data for longer only where UK law requires us to. We then keep it confidential and use it for no other purpose. Our own invoices and payment records are our data as a controller and are kept for 6 years under UK tax law.
14.5 On request, we confirm in writing that your data has been deleted.
15. Audits and information
15.1 We make available to you the information needed to show that we meet our duties under Article 28 of the UK GDPR.
15.2 Once in any 12 months, you may send us reasonable written questions about how we process and protect your data. We answer in writing within 30 days. This is the usual way of carrying out an audit under this agreement.
15.3 If our written answers do not give you what Article 28 requires, or if a regulator requires it, you may ask for a further audit, which may include an inspection. The parties agree its scope and time beforehand. It is carried out with reasonable notice, by you or by an independent auditor bound by confidentiality, and without putting other customers’ data at risk. Each party pays its own costs.
16. Liability
Each party’s liability under this agreement is subject to the limits and exclusions of liability in the terms of service. This agreement does not create a separate or additional cap. Nothing in this agreement limits liability that cannot be limited by law, or a party’s liability directly to people or to a regulator under data protection law.
17. Order of precedence
If this agreement and the terms say different things about the processing of your data, this agreement comes first. In everything else the terms apply, including the governing law and courts: those of England and Wales.
18. Changes to this agreement
We may change this agreement when the law or the service changes. For changes that matter, we give your admins 30 days’ notice by email.
19. Contact
Write to support@azonation.com about anything in this agreement.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Controller | The organisation that has the Azonation account |
| Processor | Azon Group Ltd |
| Subject matter | Providing Azonation, software for running a membership organisation |
| Duration | While the account is open, then until deletion under section 14 |
| Nature of the processing | Storing, organising, showing, sending, exporting, backing up, deleting |
| Purpose | To provide, maintain, secure and support the service for the organisation |
| Categories of people | Members; members’ families, including children where the organisation records them; donors; volunteers; guests at meetings and events; officers and other people with a role; people who fill in the organisation’s forms or visit its website and send something |
| Types of personal data | Names and contact details; membership number, type and status; family links; fees, payments, receipts, donations and Gift Aid records; expense claims; attendance, replies and check-ins; committee and other roles; tasks and volunteering; certificates; votes in open votes (in a secret ballot, the ballot is not linked to the voter); approvals and signatures; messages sent and received; answers to forms and surveys; documents and pictures; the activity log |
| Special category data | Not asked for by Azonation. Only what the organisation chooses to record on its own responsibility, or what membership itself may reveal |
| Sub-processors | See annex 3 |
| How long data is kept | As decided by the organisation while the account is open; then section 14 |
Annex 2: Security measures
At the date of this agreement we have these measures in place:
- Encryption in transit. All connections to the service use HTTPS.
- Passwords. Passwords are stored only in hashed form. We cannot read them.
- Tokens and keys. Tokens and keys are encrypted at rest.
- Strong sign-in. Two-step verification and passkeys are available to all account holders. They are compulsory for our staff.
- Roles. Inside an organisation, the admin gives people roles, and a person can open only what their role allows.
- Activity log. Each organisation has an activity log that shows who did what.
- Secret ballots. Nothing links a ballot to the voter, also not for our staff.
- Backups. Backups are made daily and kept for 30 days [to confirm].
- AI helper. Off by default. Only the notes typed and a few facts of the record are sent, never contact details, payments or votes. We do not store the text. AI providers are instructed not to train on the data [to confirm per provider].
- Staff. Access is limited to staff who need it, and they are bound by confidentiality.
- Hosting. In the UK or the EU [to confirm: hosting provider and country].
Annex 3: Sub-processors
The sub-processors that you authorise are those on the list of sub-processors at the date of this agreement, as changed under section 9.
These services, which you connect yourself with your own account, are not sub-processors: Zoom, Google Meet, Microsoft Teams, Xero, QuickBooks, your own Stripe account and your own web address.