Data Processing Agreement

Version 1.4.0 · Effective 20 November 2026

This Data Processing Agreement (the "DPA") forms part of, and is incorporated by reference into, the Master Subscription Agreement ("MSA") between Monosphere Ltd (the "Processor") and the Customer (the "Controller"). Terms used but not defined here have the meanings given in the MSA or in the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 (together, "UK Data Protection Law").

This DPA sets out the parties' obligations under Article 28(3) UK GDPR. Where there is a conflict between this DPA and the MSA in respect of personal data, this DPA prevails.

1. Scope and roles

1.1 In respect of Customer Personal Data (defined in section 2.1), the Customer is the controller and Monosphere is the processor.

1.2 Monosphere will only process Customer Personal Data on the documented instructions of the Customer. Those instructions are set out in: (a) the MSA; (b) this DPA, including the standard retention and deletion rules in section 9; (c) the configuration choices the Customer makes in the Service; and (d) any further written instructions agreed between the parties.

1.3 If Monosphere believes any instruction is unlawful, it will inform the Customer and may suspend processing of the relevant data until the instruction is amended.

1.4 Insurers and advisers. Monosphere acts only as a processor of Customer Personal Data and does not use it for its own purposes, including its own insurance or claims. Monosphere will not disclose Customer Personal Data to its insurers, insurance brokers, legal advisers or other professional advisers except:

(a) in anonymised or aggregated form that does not identify any individual, which is not personal data;

(b) on the Customer's prior documented instruction given for that specific matter, in which case Monosphere will disclose only the minimum Customer Personal Data needed and only to recipients bound by a duty of confidentiality; or

(c) where UK law requires it, in which case section 3(a) applies and Monosphere will inform the Customer before the disclosure unless the law prohibits it.

Monosphere may share its own information, such as the fact that an incident or claim has occurred, its general nature and timing, the Customer's identity as a business and the terms of the MSA, with its insurers, insurance brokers and professional advisers in confidence. Doing so does not involve disclosing Customer Personal Data.

2. Subject matter and details of processing

2.1 "Customer Personal Data" means personal data processed by Monosphere on behalf of the Customer through the Service.

2.2 Subject matter: provision of the Comnly platform.

2.3 Duration: for the term of the MSA and a reasonable period afterwards as set out in section 9.

2.4 Nature and purpose: hosting, transmission, organisation, retrieval, display, push and email notification, search, indexing, security, support and storage of Customer Personal Data, as required to operate the Service.

2.5 Categories of data subjects: (a) the Customer's administrators, owners, committee members and other authorised permissioned users (including front-desk, door and check-in kiosk operators); (b) members and prospective members (including people who request to join); (c) junior members, being children of members recorded as junior records under an adult member's membership by that member as a parent or guardian with parental responsibility; (d) guests invited to or checked in at the Customer's events or premises; (e) contacts at the Customer's sponsors whom the Customer invites to the Service; and (f) (where uploaded by the Customer) other third parties whose data the Customer chooses to record, including people named as a member's emergency contact where the Customer uses member records, whether the Customer or the member enters them. Section 7.1 of the MSA lists the same categories.

2.6 Categories of personal data: identity and contact data; organisational membership and role data, including membership numbers, membership categories and invite allowances; profile and preference data, including each member's choice whether to receive the Customer's own email marketing (with its date, wording version and change history); date of birth; photographs (where uploaded), including membership-card photos and photo-change requests; communications data (posts, replies, reactions, polls, RSVPs, acknowledgements, document uploads, committee discussions, meeting minutes, member-to-committee messages and attachments, and read/reply status); recognition preferences, spotlight introductions and referral attribution; payment request and transaction records relating to payments collected by the Customer through its own Stripe account (amounts, status and Stripe identifiers; no card data); event attendance, membership card, check-in and door-scan data, including front-desk check-in and visit records (arrival time, how and by which authorised user a member was checked in, and whether a check was accepted, refused or corrected); junior records (child first name, last name and date of birth, junior-section assignments and a separate parental-attestation audit record containing the child's name and identifier); member records, where the Customer uses them: a member's emergency contact (the contact's name, relationship to the member and phone number, entered by the Customer or by the member) and committee notes about a member written by the Customer's authorised users (the note, its author and when it was written); device and notification data (including wallet pass registrations where a data subject adds a pass to a device wallet); technical and log data.

2.7 Special categories of data: not intended. Monosphere does not solicit special-category data. The Customer is responsible for ensuring that special-category data is not entered into free-text or upload fields without an appropriate lawful basis under Article 9 UK GDPR. Committee notes about members are not for special-category data or criminal-offence data at all: the Customer instructs Monosphere to process them only on that basis and will tell its authorised users not to record such data in them. The Service refuses a note that appears to contain such data, but that check is an aid and does not change the Customer's responsibility.

3. Processor obligations

Monosphere will:

(a) process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers under section 7, unless UK law requires Monosphere to do otherwise, in which case Monosphere will inform the Customer of that legal requirement before processing unless the law prohibits it;

(b) ensure that personnel authorised to process Customer Personal Data are subject to a duty of confidentiality;

(c) implement and maintain appropriate technical and organisational security measures (see Annex II) to ensure a level of security appropriate to the risk, taking into account the nature, scope, context and purposes of processing and the risks to data subjects' rights and freedoms;

(d) only engage sub-processors in accordance with section 4;

(e) taking into account the nature of the processing, assist the Customer with appropriate technical and organisational measures, insofar as possible, to fulfil the Customer's obligations to respond to requests from data subjects exercising their rights under UK GDPR;

(f) assist the Customer in ensuring compliance with its obligations under Articles 32–36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Monosphere;

(g) at the Customer's choice, delete or return all Customer Personal Data after the end of the provision of services relating to processing, and delete existing copies, unless UK law requires storage of the personal data (see section 9);

(h) make available to the Customer the information necessary to demonstrate compliance with its obligations under Article 28 UK GDPR, and allow for and contribute to audits and inspections in accordance with section 8.

4. Sub-processors

4.1 The Customer provides general written authorisation for Monosphere to engage sub-processors to process Customer Personal Data. The current list of sub-processors is set out in Annex III and is also available on request from support@comnly.com.

4.2 Monosphere will: (a) impose, by written contract, data protection obligations on each sub-processor that are equivalent to those set out in this DPA; and (b) remain liable to the Customer for the performance of each sub-processor's obligations under that contract.

4.3 Monosphere will give the Customer at least 30 days' prior written notice of any addition or replacement of a sub-processor processing Customer Personal Data. The Customer may object to a proposed change on reasonable data-protection grounds within 30 days. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected portion of the Service on written notice to Monosphere, with Monosphere refunding any unused prepaid fees relating to that portion on a pro-rata basis.

5. Personal data breach

5.1 Monosphere will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

5.2 The notice will include the information described in Article 33(3) UK GDPR, namely the nature of the breach (including, where possible, the categories and approximate number of data subjects and personal data records concerned), the name and contact details of a contact point for further information, the likely consequences of the breach, and the measures taken or proposed to be taken to address it and mitigate its possible adverse effects. Where it is not possible to provide all of that information at the same time, Monosphere will provide it in phases as it becomes available, without undue further delay, and will not delay the initial notice in order to complete it.

5.3 Monosphere will reasonably cooperate with the Customer in the Customer's investigation and any required notifications to the Information Commissioner's Office or affected data subjects.

6. Data subject rights and assistance

6.1 If Monosphere receives a request from a data subject relating to Customer Personal Data, Monosphere will (where lawful and practicable) refer the request to the Customer and not respond to the data subject directly except as permitted by the Customer.

6.2 Taking into account the nature of the processing, Monosphere will assist the Customer to respond to data subject requests, including by providing self-service tools in the Service for the Customer to access, correct, export or delete Customer Personal Data. Reports and exports that name data subjects are available only to users the Customer has given the relevant permission, and each time a printable report or export is opened or downloaded the Service records which user did so and when; Monosphere will provide that record to the Customer on request. Committee notes and emergency contacts are not shown to the member in the Service; the Customer's authorised users can view them in full in the Service, and they are included in the Customer's data export, so that the Customer can answer a member's request for access.

7. International data transfers

7.1 Monosphere will not transfer Customer Personal Data outside the United Kingdom except where the transfer is to a country covered by adequacy regulations made by the UK Government, or where the transfer is protected by an appropriate transfer mechanism under Article 46 UK GDPR (such as the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses).

7.2 The current sub-processor list (Annex III) identifies processing locations. Details of the applicable UK transfer mechanism for each relevant provider are available on request under section 7.1.

8. Audits

8.1 Monosphere will, on reasonable prior written notice of at least 30 days, make available to the Customer (or a mutually-agreed independent auditor bound by confidentiality) information necessary to demonstrate compliance with this DPA.

8.2 Audits are limited to information directly relevant to the Customer's compliance, must take place during business hours, must minimise disruption to Monosphere's other customers, and must not give the Customer access to other customers' data, Monosphere's commercially sensitive information or systems beyond what is necessary.

8.3 The Customer bears the costs of audits, save where the audit reveals a material breach by Monosphere, in which case Monosphere will bear its own audit-cooperation costs.

8.4 The parties may use relevant third-party audit reports or compliance certifications to support an audit where available. This does not remove Monosphere's obligation to allow for and contribute to audits and inspections required under Article 28 UK GDPR.

9. Return or deletion of Customer Personal Data

9.1 On termination of the MSA the Customer may request return of Customer Personal Data during the 30-day export period, using the available export tools or by contacting support@comnly.com for data not covered by those tools or where access has ended. This does not limit the Customer's choice to require deletion or return under section 3(g).

9.2 When the export period ends, the Customer's organisation is archived and Monosphere's scheduled clean-up then permanently deletes the Customer's organisation and Customer Personal Data, normally within 30 days after the export period ends. Monosphere will not carry out that deletion while the Customer is subject to a legal hold notified to Monosphere. Deletion includes the records the Service holds of payments the Customer collected through it (such as dues and payment requests), which are Customer Personal Data: copies of those transactions remain available to the Customer in its own Stripe account, and the Customer is responsible for keeping any records it needs for its own accounting and should export them before the export period ends. Monosphere's own billing records for the Customer's subscription are Monosphere's records, not Customer Personal Data, and are retained as set out in the Privacy Policy. Any Customer Personal Data that Monosphere must retain where required by law or for the establishment, exercise or defence of legal claims is locked down and retained for the minimum necessary period.

9.3 Members who have left. A member's login is a single account that may belong to more than one organisation using the Service. Where every membership on that account has ended because the member left or was removed (by the Customer or by another organisation), Monosphere will delete or anonymise the account's identity data (including name, email address, date of birth and photographs) 30 days after the most recent membership ended. This does not happen while the member holds a membership that has been suspended rather than ended, while they have a pending request to join an organisation, or while the Customer is subject to a legal hold notified to Monosphere. Content the Customer retains in the Service, such as posts, replies and attendance history, is kept and shown as a former member. Payment and transaction records are kept as required for accounting and legal purposes, under section 9.2. The Customer instructs Monosphere to apply this rule and should export any member records it needs to keep before the 30 days end.

9.4 Membership cards. When a membership ends, Monosphere will stop the member's digital membership card from being accepted at check-in and, where the member has saved it to a device wallet, update the saved pass so that it is shown as no longer valid.

9.5 Member records. A member's emergency contact and the committee notes about them are deleted: (a) when the Customer deletes the member's membership in the Service; (b) when the member's account is deleted or anonymised under section 9.3 or at the member's request; and (c) in any event 30 days after that membership ended because the member left or was removed, even where the member's account continues because they belong to another organisation. This does not happen while the membership is suspended rather than ended or while the Customer is subject to a legal hold notified to Monosphere. Notes written by a user whose account is later deleted or anonymised are kept, with the author shown as a former member. The Customer instructs Monosphere to apply this rule and should export any record it needs to keep before it is deleted.

10. Liability

10.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the MSA. Nothing in this DPA limits any party's liability where it cannot lawfully be limited.

11. Conflict and term

11.1 In case of conflict, the order of precedence is: (a) UK Data Protection Law; (b) this DPA; (c) the MSA.

11.2 This DPA is effective from the date the Customer accepts the MSA and remains in force for the duration of the MSA and any survival period.

12. Governing law

12.1 This DPA is governed by, and to be construed in accordance with, the laws of England and Wales.

Annex I: Description of processing

Subject matter, duration, nature and purpose, categories of data subjects and personal data: as set out in section 2.

Frequency: continuous, for the duration of the MSA.

Annex II: Technical and organisational security measures

Monosphere implements (without limitation) the following measures, and will continue to develop them in line with industry standards:

1. Encryption in transit (TLS 1.2+) for all client-server connections. 2. Encryption at rest for the hosted database (PostgreSQL on Supabase) and object storage. 3. Authentication and access control: passwords stored using a strong password-hashing algorithm; role-based access control enforced via row-level security in the database; principle of least privilege for staff access. 4. Network and application security: hardened cloud-hosted infrastructure; signed webhook payloads; CSRF and XSS protections in web frontends; rate limiting on sensitive endpoints; parameterised queries to prevent injection. 5. Software development practices: code review, automated tests, separation of development, staging and production environments, secure secret management. 6. Operational security: audit logging of administrative actions; monitoring of error and security signals; backup of databases. 7. Personnel: confidentiality obligations for staff with access to Customer Personal Data; training on UK Data Protection Law and security. 8. Incident response: documented procedure for detection, containment and notification of personal data breaches in accordance with section 5 of this DPA. 9. Sub-processor controls: contractual data protection obligations equivalent to this DPA imposed on every sub-processor. 10. Data retention and deletion: data deletion procedures aligned with section 9 of this DPA and with the Privacy Policy, including the automated deletion or anonymisation of accounts under section 9.3, each recorded in an internal audit log. 11. Access to reports: printable reports and exports naming data subjects are limited by the permissions the Customer assigns, and each view or download is recorded.

Annex III: Authorised sub-processors

The current list of authorised sub-processors processing Customer Personal Data on behalf of Monosphere is as follows. The Customer is asked to review this list in conjunction with section 4.

The list above may be updated from time to time in accordance with section 4 of this DPA. The current authoritative list is available from support@comnly.com.

Monosphere Ltd (trading as Comnly), a company registered in England and Wales under company number 16315949. Registered office: 3 Broadway East, Chester, CH2 2DW, United Kingdom. Contact: support@comnly.com.