Data Processing Terms

For personal data an Operator submits about its own customers, the Operator is controller and Memberra is processor. Memberra is an independent controller for Operator account, security, platform billing and legal-compliance data. These terms form part of the Memberra Terms of Service.

Memberra processes end-customer identity, subscription, payment-status, support, provisioning and configured analytics data only to provide, secure and support the service, on the Operator’s documented instructions and as required by law. The Operator is responsible for lawful collection, notices, instructions and its customer-facing policies.

Processing lasts for the relevant Operator account term plus deletion, backup and legal retention periods. It includes collection, receipt, organisation, hosting, retrieval, analysis, transmission to configured providers, provisioning, restriction and deletion. Data subjects include an Operator's customers, prospective customers, staff, contractors, affiliates and authorised users. Data may include identity and contact details, account identifiers, subscription and payment status, support communications, device/network data, viewing and media metadata, preferences, referrals, fraud and enforcement records. The Operator must not submit special-category or criminal-offence data unless separately agreed in writing with an identified lawful basis and safeguards.

Access is limited to authorised personnel and service providers subject to confidentiality duties. Memberra maintains proportionate technical and organisational measures including encryption in transit, access controls, tenant isolation, audit logging, encrypted secrets, backups and incident procedures.

Memberra may use infrastructure, authentication, payments, communications and support subprocessors described in the Privacy Policy. Appropriate UK transfer safeguards will be used where required. Operators may contact [email protected] for the current list or to raise a reasoned objection to a material new subprocessor.

Taking account of the nature of processing, Memberra will reasonably assist with data-subject requests, security, breach assessment, DPIAs and regulator consultations. Memberra will notify the Operator without undue delay after becoming aware of a personal-data breach affecting Operator-controlled data.

Taking account of the nature of processing and information available, Memberra will reasonably assist the Operator with rights requests, security obligations, breach notifications, data-protection impact assessments and prior consultation. Unless legally prohibited, Memberra will notify the Operator of a request relating solely to Operator-controlled data and will not respond substantively except on instruction or as required by law. Additional work beyond standard platform functionality may be charged at a reasonable rate agreed in advance.

On termination or documented instruction, Memberra will delete or return Operator-controlled personal data within a reasonable period unless retention is legally required. Archived billing and audit records may be retained where necessary for legal claims, fraud prevention, tax or accounting. On reasonable request, Memberra will provide information needed to demonstrate compliance. Audits must normally use current reports and questionnaires first; any on-site or intrusive audit requires reasonable advance notice, confidentiality, minimal disruption, no access to other tenants' data, and reimbursement of reasonable costs unless a material breach by Memberra is established.

Memberra will inform the Operator if, in its reasonable opinion, an instruction infringes applicable data-protection law, unless prohibited from doing so, and may suspend the affected processing. The Operator warrants that its instructions, disclosures, lawful bases and collection of personal data are lawful. Nothing in these terms relieves either party of its own statutory responsibilities.

Where an applicable US state law treats Memberra as a service provider, processor or contractor, Memberra will not sell or share Operator customer data for cross-context behavioural advertising, will process it only for the contracted business purpose, and will provide assistance reasonably required for applicable consumer requests.

Measures appropriate to the assessed risk include access control and least privilege, tenant isolation, authentication controls, encryption in transit, encryption of selected secrets and credentials at rest, logging, backups, vulnerability and dependency management, incident handling, recovery procedures, supplier controls, staff confidentiality, and secure deletion processes. Measures evolve with technology and risk provided that overall protection is not materially reduced.