Data processing agreement (DPA)
Last updated: 19 October 2026
1. Parties
This data processing agreement ("DPA") applies between: • Controller: the association (the "Association") that has registered an account in the Membly service and is represented by its administrator upon acceptance of this agreement. • Processor: Monile AB ("Membly"), company reg. no. 559273-6051, Nackagatan 3, 116 41 Stockholm, Sweden. This DPA forms an integral part of Membly's terms of service and meets the requirements of Article 28 of the GDPR. In the event of a conflict between the terms of service and this DPA, the DPA prevails for all processing of personal data covered by Article 28.
2. Subject matter, duration, nature and purpose
• Subject matter: processing of members' personal data for the purpose of providing association management tools via the Membly service. • Duration: the agreement applies for as long as the Association has an active account in the service, and for the period thereafter required for data export and erasure under section 11. • Nature and purpose of the processing: storage, access management, display, search, communication facilitation, payment processing, backup, association-level statistics, and other operational functions within the service that the Association activates. • The Association's role: controller of the members' personal data. • Membly's role: processor, processing the data exclusively on the Association's documented instructions.
3. Types of personal data and categories of data subjects
Categories of data subjects: the association's members, leaders, administrators, guardians, contact persons and any minor members. Types of personal data processed: • Identity and contact details (name, email, telephone, profile picture). • Membership data (membership status, roles, tags, custom fields). • Communication content (chat, feed, documents). • Attendance and activity data. • Payment metadata (actual card details are handled by Stripe, not by Membly). • Family relationships (guardian links). • Any national identity numbers for LOK subsidy reporting (sport). The Association is responsible for ensuring that special categories of personal data (Article 9 GDPR) are processed in the service only where there is an applicable legal basis and an exception under Article 9(2). For associations with a political, philosophical, religious or trade-union aim, section 3 a also applies.
3 a. Associations with a political, philosophical, religious or trade-union aim
This section applies where the Association has a political, philosophical, religious or trade-union aim. It supplements the other sections of this DPA and prevails over them where they differ. a) Nature of the data. The parties agree that the fact that a person is a member of, has been a member of, or has regular contact with the Association reveals that person's political opinions, religious or philosophical beliefs or trade-union membership, and is therefore a special category of personal data under Article 9(1) GDPR. The same applies to data that reveals the affiliation indirectly, such as attendance at the Association's activities, paid membership fees, posts in the Association's chat and feed, and sendouts received. The Association's entire member register and all communication within the Association are therefore treated as such data under this section. b) Instruction and legal basis. The Association instructs Membly to process this data to the extent needed to provide the service. The Association is responsible for having a legal basis under Article 6 and an exception under Article 9(2) GDPR. For members, former members and persons in regular contact with the Association in connection with its purposes, that is normally Article 9(2)(d). For others, such as people who register interest or apply for membership, sympathisers and subscribers, explicit consent under Article 9(2)(a) is normally required. The Association is also responsible for informing the data subjects. c) No disclosure outside the Association. Membly does not disclose the data to anyone outside the Association, except to sub-processors under section 7 to the extent the service requires, or where Membly is obliged to by law or by a decision of an authority or court. In the latter case Membly notifies the Association before the data is disclosed, unless prohibited by law. The service does not show users outside the Association, including members of other associations on Membly, that a given person belongs to the Association. Data the Association itself chooses to publish, such as contact persons on its public page, is published on the Association's instruction and responsibility. One exception is a person's name and contact details, which are stored on a profile shared by the associations on Membly that the person belongs to: if the person has never logged in, another association that adds the same email address can see the person's name, telephone number and address, but not that the person belongs to the Association. d) No purposes of Membly's own. Membly does not use the data, nor the knowledge that a given person belongs to the Association, for its own purposes. That includes marketing, profiling, recommendations, individual-level statistics, sale, and training AI models. Aggregate statistics under section 4 are compiled so that no individual can be identified. e) AI features. The service's AI features receive only what a user enters into them, that is a question to the assistant or a sendout text the user asks for help to write, together with the Association's legal form and activity category. Membly does not send the Association's member register, chat, feed or documents to sub-processors that provide AI features. The Association can switch off the service's AI features under Settings. When they are off, the service sends no data from the Association to such sub-processors. f) Membly staff. Membly staff may access the Association's personal data only when needed for support the Association has requested, to handle a security incident, or to meet a legal obligation. Access is limited to named individuals and requires multi-factor authentication. Searches, exports and changes in Membly's administration tool are logged. g) Sub-processors and transfers. As a consequence of point a), the sub-processors in section 7 may receive data revealing affiliation with the Association to the extent their service requires. This applies in particular to email: Resend processes the recipient's email address, the sender name (the Association's name) and the content of the sendout, and logs and metadata are stored in the United States under the EU-US Data Privacy Framework. Stripe processes data about the payer and the receiving association, and is also an independent controller for fraud prevention and anti-money-laundering measures. On request, Membly provides an overview of which sub-processors receive which data and where it is processed. h) Personal data breaches. A breach involving data under this section is deemed capable of resulting in a high risk to the data subjects. In addition to the notification under section 8, Membly assists the Association with material for its notification to the Swedish Authority for Privacy Protection (IMY) and for informing data subjects under Article 34 GDPR. i) Impact assessment and safeguards. On request, free of charge and at most once per calendar year, Membly provides a description of the processing in the service, its sub-processors and its security measures. The Association may use it in its impact assessment under Article 35 GDPR and to document the appropriate safeguards that Article 9(2)(d) requires.
4. The Association's instructions
Membly processes the personal data solely on the Association's documented instructions. The terms of service, this DPA and the Association's configuration of the service (settings, integrations, data flows) constitute the Association's initial instructions. Membly notifies the Association without undue delay if Membly considers that an instruction infringes applicable data protection legislation. Membly does not process the personal data for its own purposes beyond what is required to provide the service (e.g. security, operations and aggregated statistics without identifiability).
5. Confidentiality
Membly ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to those employees who need it in order to perform their duties ("need to know").
6. Security measures (Article 32 GDPR)
Membly implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This includes, among other things: • Encryption in transit: TLS 1.2+ for all communication. • Encryption at rest: AES-256 in the Supabase database and for the storage of attachments. • Access control: role-based access, Row-Level Security (RLS) in the database, separation between service roles. • Authentication: passwordless login (magic link or Google account) for users; mandatory multi-factor authentication for Membly's administrative access. • Audit logs: security-relevant events are logged for at least 12 months. • Backups: daily backups with 30 days' retention; restoration tests are carried out regularly. • Incident management: documented incident response plan; notification of the Association within 48 hours under section 8. • Vulnerability management: continuous monitoring, regular patching, and review of third-party dependencies. Membly evaluates and updates the security measures on an ongoing basis to meet new threats and technical standards.
7. Sub-processors
The Association gives general authorisation for Membly to engage the following sub-processors for the processing of personal data: • Supabase Inc. — database, authentication and file storage. EU (AWS eu-west, Ireland). • Stripe Payments Europe Ltd. — payment processing. Ireland. Stripe is also an independent controller for fraud prevention and anti-money-laundering measures. • Vercel Inc. — hosting and frontend delivery. USA, EU-US Data Privacy Framework + SCC. • Resend (Drip Email Inc.) — transactional email, sent from Resend's EU region; logs and metadata are stored in the USA. EU-US Data Privacy Framework. • Anthropic PBC — AI features (Claude API). USA, SCC. • Voyage AI (MongoDB, Inc.) — AI embeddings (vectorisation of the user's question and of Membly's own knowledge base) for the AI assistant. USA, SCC. • Sentry (Functional Software, Inc.) — error reporting. USA, EU-US Data Privacy Framework + SCC. • Upstash, Inc. — rate limiting and technical deduplication of webhooks (Redis). USA, SCC. • Google Ireland Limited (with Google LLC, USA) — address lookup and geocoding (Google Places/Maps). EU-US Data Privacy Framework + SCC. Membly ensures that the sub-processors are bound by the same data protection obligations as set out in this DPA. Membly notifies the Association of planned changes to sub-processors (additions or replacements) at least 30 days in advance. The Association may object to the change within 14 days; if it does, the parties will seek a joint solution, and if no such solution is reached the Association is entitled to terminate the affected part of the service at no additional cost.
8. Assistance with requests and incidents
Membly assists the Association, taking into account the nature of the processing and within reasonable limits: • With requests from data subjects exercising rights under Articles 15–22 GDPR (access, rectification, erasure, restriction, data portability, objection). The service offers self-service tools for administrators; for more complex cases Membly provides technical support. • With the Association's obligations under Articles 32–36 GDPR (security, notification of incidents, impact assessments). In the event of a personal data breach affecting the Association's members, Membly notifies the Association without undue delay and at the latest within 48 hours of the breach being discovered. The notification contains at least: the nature of the breach, the categories of data and data subjects concerned, the likely consequences, and the measures taken or proposed.
9. Right of audit
The Association is entitled, once per calendar year, to request written documentation demonstrating that Membly complies with the obligations under this DPA. This normally comprises a summary of security measures, any third-party assessments and the list of sub-processors. An on-site or in-depth audit may be carried out by the Association or by an independent auditor appointed by the Association, against reasonable cost coverage for Membly's preparation and participation. The audit must be planned at least 30 days in advance, conducted during normal office hours and without undue impact on Membly's operations. The auditor must sign a confidentiality agreement before access is granted to sensitive information.
10. International transfers
To the extent the processing involves the transfer of personal data to a third country outside the EU/EEA, Membly ensures that appropriate safeguards are in place: • The EU-US Data Privacy Framework for sub-processors certified under the framework. • The EU Standard Contractual Clauses (Commission Decision 2021/914), Module 3 (processor-to-processor), for other transfers. • Where necessary, supplementary technical and organisational measures in line with the recommendations of the European Data Protection Board (EDPB). The Association authorises Membly to enter into standard contractual clauses with sub-processors in the Association's name where this is necessary.
11. Return and erasure on termination
On termination of the agreement, or at the Association's request: • Membly makes available an export window of at least 30 days during which the Association can download all data via the service's export functions. • After the export window, Membly erases the Association's personal data within 90 days, including any backups in line with the ordinary rotation schedule. • Personal data that must be retained under a legal obligation (e.g. accounting data under Chapter 7, Section 2 of the Swedish Accounting Act) is stored separately and only for as long as the obligation persists. At the Association's request, Membly can provide written certification that erasure has been carried out.
12. Governing law, amendments and contact
This DPA is governed by Swedish law. Disputes are settled as set out in Membly's terms of service. Membly may update this DPA to reflect new legal requirements, security standards or changes of sub-processors. Material changes are notified to association administrators by email at least 30 days in advance. If the Association does not accept the change, the Association is entitled to terminate the service at no additional cost. Contact: Monile AB ("Membly") Company reg. no. 559273-6051 Nackagatan 3, 116 41 Stockholm, Sweden Email: privacy@membly.app
Language versions
This document was drafted in Swedish. The English translation is provided for convenience only. In the event of any discrepancy between the versions, the Swedish version governs.