Privacy Notice

This notice explains what Azon Group Ltd does with personal data when you visit azonation.com, when you have an Azonation account, and when an organisation you belong to keeps its records in Azonation. It is written for the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and it has a section for readers in other countries.

In short

• Your organisation decides what it records about its members. We store and process those records for the organisation, on its instructions.
• We decide what happens with your Azonation account, our invoices, your support requests and this website.
• We do not sell personal data, we show no adverts, and we do not build marketing profiles.
• This website sets no cookies. The app uses only the cookies it needs to work.
• You can download your data and ask for it to be erased from inside the app.
• You can write to us at support@azonation.com, and you can complain to the UK Information Commissioner’s Office.

Who we are

Azonation is a service of Azon Group Ltd, a company registered in England and Wales, company number 13783721.

• Registered office: 5 Brayford Square, London, England, E1 0SG
• Email: support@azonation.com
• Phone: +44 7570 772929
• Registration with the Information Commissioner’s Office (ICO): number ZB304457

Write to support@azonation.com for anything about privacy or personal data.

In this notice “we” means Azon Group Ltd. “Azonation” means the web app at app.azonation.com (which can also be installed on a phone), this website at azonation.com, and the websites that organisations make with Azonation at addresses ending in azonation.org.

Two roles: who decides about your data

Data protection law uses two words. A controller decides why and how personal data is used. A processor handles data for a controller and follows its instructions.

Azonation is software for clubs, charities, associations and similar membership organisations. Because of that, we have two different roles.

Your organisation is the controller of its own records. An organisation that uses Azonation decides what it records about its members, families, donors, volunteers and guests, and why. We are its processor. Our data processing agreement sets out what we may and may not do with those records.

We are the controller for four things: your Azonation account, billing, support requests, and this website.

Which applies to me?

(a) You are visiting azonation.com. We are the controller. We hold almost nothing about you: the site sets no cookies and counts visits without storing personal data. If you write to us or use the live chat, we handle what you send us.

(b) You have an Azonation account. We are the controller of the account itself: your name, email address, password or passkey, language, and a photo and phone number if you add them. One account can belong to several organisations. What each organisation records about you as a member is that organisation’s data, as described in (d).

(c) You are an admin or officer of an organisation. You are in both groups. We are the controller of your own account, of the organisation’s billing details and of your support requests. Your organisation is the controller of the records that you and your colleagues keep in Azonation, and it is responsible for keeping them lawfully. We are its processor.

(d) You are a member, and your organisation uses Azonation. Your organisation is the controller of your member record. You may have no Azonation account at all: the organisation simply keeps your record. Or you may have connected an account so that you can see your card, receipts, meetings and events, and reply, vote and pay. In both cases, questions about what the organisation records, why, and for how long go to the organisation first. We help the organisation answer you.

What data we handle

When you visit this website

• Visit counts. For each page view, the page address, the host name of the site you came from, the page language and a rough screen width are sent to us. No IP address is stored, nothing is stored on your device, and no visitor profile is built. If your browser sends Do Not Track or Global Privacy Control, the visit is not counted. These counts contain no personal data.
• Messages you send us. Your name, your email address and what you write.
• Live chat. If live chat is switched on and you say yes to it, the chat is run by another company (Tawk.to [to confirm]), which receives what you type and stores a small file in your browser. It does not load unless you say yes.

Fonts on this site are served from azonation.com. We do not load fonts from Google.

When you have an account

• Account details: name, email address, language, and a photo and phone number if you choose to add them.
• Sign-in details: your password (stored only in hashed form, so we cannot read it), passkeys, and two-step verification settings.
• Settings and device storage: the language you chose, light or dark mode, and which organisation you have open.
• Technical and security records: the records needed to keep you signed in and your account safe, and your actions in an organisation’s activity log.
• Push notices, if you allow them in your browser: a technical address that lets us send a notice to your device.

We collect this from you directly. You must give a name and an email address to have an account. The rest is optional.

When you are an admin or officer

Everything under “When you have an account”, and also:

• Billing details: the organisation’s name and address, the plan and modules it uses, invoices, and the record of payments. Card details are entered on Stripe’s pages and go to Stripe. We do not see or store full card numbers.
• Support requests: what you write to us and what we answer.
• Service messages: emails about invoices, changes to the terms, security, and planned maintenance.

When your organisation keeps records about you

We process this data for the organisation. What is recorded depends on the organisation and on the modules it uses. It can include:

• name, contact details, membership number, membership type and status, family members;
• fees, payments, receipts, donations and Gift Aid records, expense claims;
• attendance at meetings and events, replies to invitations, QR check-ins;
• committee and other roles, tasks, volunteering, certificates;
• votes in polls, motions and elections (in a secret ballot, nothing links a ballot to the voter, not even for our staff);
• messages sent to you, forms and surveys you fill in, documents and pictures.

If you did not give this data to the organisation yourself, the organisation entered it, for example when a secretary added you to the member list or imported a list. The organisation can tell you where your data came from.

Sensitive data

Azonation does not ask for health data, religion, ethnicity or similar special categories of data. Organisations must not record such data unless they have a lawful basis for it. In some organisations, membership itself can show a belief, for example a faith group, a political association or a trade union. Those organisations are responsible for handling that lawfully.

Why we use data, and our lawful bases

This table covers the data we control. For the records an organisation controls, the organisation chooses the lawful basis and can tell you what it is.

Where we rely on legitimate interests, you can object at any time: see “Your rights” below. Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect what was done before.

What we never do

• We do not sell personal data, and we do not rent or trade it.
• We show no adverts, and we do not give data to advertisers.
• We do not profile you for marketing.
• We do not use an organisation’s records for our own purposes.
• We make no decisions about you by automated means alone that have a legal or similarly significant effect on you.

Cookies

This website sets no cookies. The app uses only strictly necessary cookies: one that keeps you signed in and one that protects forms against forgery. It also keeps a few settings in your browser’s local storage. There are no advertising or tracking cookies. The cookie notice gives the full list.

Who we share data with

Companies that help us run Azonation (sub-processors). We use a small number of companies for hosting, card payments, sending email, WhatsApp and SMS messages, the AI helper, wallet passes and push notices. Each one receives only the data it needs for its task and is bound by a written contract. Several are used only if an organisation switches on a feature. The list of sub-processors names them.

Your organisation. If you connect your account to an organisation, its admins and the officers it has given a role can see your member record and what you do in that organisation, such as replies, payments and attendance. They cannot see your password or your membership of other organisations.

Other members of your organisation. Only where the organisation has switched on a feature that shows it, such as a members’ directory or members’ groups.

Services an organisation connects itself. An organisation can connect its own accounts with other services, such as Zoom, Google Meet, Microsoft Teams, Xero, QuickBooks, its own Stripe account or its own web address. Data then goes to that service on the organisation’s instructions and under that service’s own terms.

Authorities. We give data to a court, a regulator, the police or a tax authority only when the law requires it.

We do not share personal data with anyone else.

The AI helper

The AI helper writes drafts, for example of minutes or a notice. It is an optional module.

• It is off by default. Each organisation switches on each kind of draft.
• Only the notes that the person types and a few facts of the record are sent to the AI service.
• Contact details, payments and votes are never sent.
• We do not store the text that is sent.
• A person always reads the draft and decides what to do with it. The AI helper decides nothing.
• We instruct AI providers not to use the data to train their models, under their terms for business use [to confirm per provider].

The AI provider we use today is on the list of sub-processors. If we change to another one, we list it before we use it.

Azonation benefits (offers from other businesses) [to confirm: whole section]

Where Azonation benefits are switched on for your country:

• What we record. Each time you open the link of an offer or look at its code, we record which offer, the time, and the country on your account. If an offer gives each person a code of their own, we record which code we gave you.
• Why. To see which offers people want, to show the businesses totals, to stop misuse of codes, and, where a business pays us, to check what it owes us. Our lawful basis is our legitimate interest in running and improving the offers [to confirm].
• What a business receives. Totals only: how many times an offer was opened and by how many people. We never give a business your name, your email address or which organisation you belong to. If you buy from a business, what you give that business is under its own privacy notice.
• A code of your own. A business can see that one of its codes was used when you use it with them. On its own that code does not tell the business who you are, but if you give the business your name when you buy, the business can connect the two.
• Notices. We tell you about new offers inside the app. We send offers by email only if you switched that on yourself, and you can switch both off under Notifications.
• Your choices. You do not have to use any offer. Your data export includes the offers you opened. If you close your account, this record is deleted with it.

Payments

When an organisation pays us. We issue an invoice. The organisation pays by card through Stripe or by bank transfer. Stripe handles the card details. We receive a confirmation of the payment, not the full card number.

When a member pays an organisation. With the Online payments module, the money goes from the member straight to the organisation’s own Stripe account. We do not hold or receive the organisation’s money. The organisation and Stripe handle the payment, and refunds to members are the organisation’s decision. Azonation records that the payment was made so that the organisation’s books and your receipts are right.

Stripe also uses payment data under its own privacy policy, for example to prevent fraud.

Messages by email, WhatsApp and SMS

Organisations use Azonation to send notices, reminders, receipts and newsletters to their members. The organisation decides who receives which message and is responsible for having the right to send it.

• Email is sent through Amazon Web Services. Your name, email address and the message pass through it.
• WhatsApp messages are sent through Meta’s WhatsApp Business service, only for organisations that use WhatsApp. Your phone number and the message pass through it.
• SMS is sent through an SMS gateway in the country concerned, only for organisations that use SMS. Your phone number and the message pass through it.

If you do not want messages from an organisation, tell the organisation. We send our own service messages (invoices, security, changes to the terms) to account holders and admins by email.

International transfers

We plan to host Azonation in the UK or the EU [to confirm: hosting provider and country].

Some of the companies that help us are outside the UK and the European Economic Area (EEA), or may process data there. When personal data goes to such a company, we protect it with one of these safeguards:

• the UK International Data Transfer Agreement; or
• the EU Standard Contractual Clauses together with the UK Addendum.

These are standard contracts that bind the company receiving the data to protect it. You can ask us for a copy of the safeguard used for a transfer by writing to support@azonation.com.

How long we keep data

These periods are proposed [to confirm].

When your account is deleted, records that an organisation holds about you as its member stay with that organisation, because they are the organisation’s records. Ask the organisation if you want those erased as well.

Security

• All connections to Azonation are encrypted in transit (HTTPS).
• Passwords are stored only in hashed form.
• Tokens and keys are encrypted at rest.
• Two-step verification and passkeys are available to everyone, and are compulsory for our staff.
• Each organisation has an activity log that shows who did what.
• Inside an organisation, people see only what their role allows.
• In a secret ballot, nothing links a ballot to the voter.

Our security page says more. If a breach of personal data is likely to put you at risk, we will tell you and the organisation concerned without undue delay, and we will report it to the ICO where the law requires.

Children

You must be at least 13 years old to have an Azonation account.

Organisations may record data about children, for example in families or youth sections. The organisation is the controller of that data and is responsible for having the right to record it, including a parent’s or guardian’s agreement where the law requires one. If you are a parent or guardian and have a question about a child’s record, ask the organisation first. You can also write to us.

Your rights

Under UK data protection law you have these rights:

• Access: to know whether we hold data about you and to have a copy.
• Correction: to have wrong or incomplete data put right.
• Erasure: to have your data deleted, where the law allows.
• Restriction: to ask us to stop using your data for a time, for example while a correction is checked.
• Portability: to receive the data you gave us in a common, machine-readable form, or to have it sent to another service.
• Objection: to object to use that is based on legitimate interests. We then stop unless we have compelling reasons that the law accepts.
• Withdrawing consent: at any time, where we rely on consent.
• Automated decisions: not to be subject to a decision made by automated means alone that has a legal or similarly significant effect on you. We make no such decisions.

These rights have limits in law. For example, we must keep invoices for 6 years even if you ask us to erase them.

How to use your rights

In the app. If you have an account, you can correct your details, download your data and ask for erasure from your account pages.

For data your organisation controls. If you are a member, ask your organisation first for the data it keeps about you. It is the controller, and it has a page in the app for answering data requests. If you write to us about such data, we pass your request to the organisation and help it to answer.

By writing to us. For data we control, write to support@azonation.com. We may ask you to confirm who you are. We answer within one month. If a request is complex, the law lets us take up to two months more, and we tell you if we need that time. Using your rights is free of charge.

How to complain

Please tell us first: support@azonation.com. We want to put things right.

You can also complain to the UK Information Commissioner’s Office at any time: ico.org.uk. If you live outside the UK, you can complain to the data protection authority where you live or work instead. If your complaint is about what your organisation has done with your data, you can complain to the organisation and to the authority as well.

If you live outside the UK

Azonation is run from the United Kingdom, and this notice applies wherever you are. The rights tools in the app are the same in every country, and requests go to support@azonation.com. The sub-sections below add what is particular to some countries. Where local law gives you more protection than this notice, you keep that protection.

European Economic Area and Switzerland

If you are in the EEA, the EU General Data Protection Regulation may apply to our handling of your data. You have the rights listed under “Your rights”. The lawful bases in the table above are the same under EU law. Transfers out of the EEA are covered by the EU Standard Contractual Clauses.

You can complain to the data protection authority of the country where you live or work, or where you think the law was broken.

We have not yet appointed a representative in the EU [to confirm before selling in the EU].

If you are in Switzerland, the Swiss Federal Act on Data Protection may apply. You have the same rights, and you can contact the Federal Data Protection and Information Commissioner.

United States, including California

We do not sell personal information, and we do not share it for advertising that follows people across websites. We have not done so in the past 12 months.

For residents of California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), sets out rights. We offer them to you whether or not that law applies to us:

• Right to know what personal information we collect, where it comes from, why we use it and who receives it. This notice tells you, and you can ask for the details that are specific to you.
• Right to delete your personal information, within the limits of the law.
• Right to correct wrong personal information.
• Right to opt out of sale or sharing. There is nothing to opt out of, because we do neither.
• Right to limit the use of sensitive personal information. We use sign-in details only to sign you in and to keep your account secure.
• No discrimination. We do not treat you differently for using these rights.

The categories of personal information we collect as a controller are: identifiers (name, email address, phone number); account sign-in details; commercial information (plans, invoices and payments of an organisation); and what you write to us. We collect them from you, and we give them only to the service providers on the list of sub-processors, for the purposes in the table above.

You, or a person you have authorised in writing, can make a request at support@azonation.com. We confirm who you are before we answer. For records that an organisation keeps about you, we act as that organisation’s service provider: please ask the organisation.

Canada

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws may apply. You can ask for access to your personal information, ask for it to be corrected, and withdraw consent. Your data is processed outside Canada, and may be subject to the laws of the country where it is held. You can complain to the Office of the Privacy Commissioner of Canada or to your provincial commissioner.

Australia

The Privacy Act 1988 and the Australian Privacy Principles may apply. You can ask for access to your personal information and for it to be corrected. Your data is held outside Australia. If you are not satisfied with our answer to a complaint, you can complain to the Office of the Australian Information Commissioner.

India

The Digital Personal Data Protection Act 2023 (DPDP Act) may apply. You have the right to a summary of your personal data and how it is processed, to have it corrected, completed, updated or erased, to withdraw consent, to have a complaint dealt with, and to name another person to use your rights if you die or become unable to. Send complaints to support@azonation.com first. If you are not satisfied, you can go to the Data Protection Board of India.

Bangladesh

The data protection law of Bangladesh may apply to you. You have the same rights and the same tools as described in this notice, and requests go to support@azonation.com.

Other countries

Wherever you live, you can use the rights tools in the app and write to support@azonation.com. We handle your request under UK law and under the law of your country where it applies to us. You can complain to the data protection authority of your country.

Changes to this notice

We may change this notice, for example when we add a feature or a sub-processor, or when the law changes. The date at the top shows the latest version. If a change matters, we tell account holders and admins by email 30 days before it takes effect.