Data Processing Agreement

Last Modified: 29 October 2026

This Pembee Data Processing Agreement (“DPA”) reflects the parties’ agreement with respect to the Processing of Personal Data by us on behalf of you in connection with the Pembee Subscription Services under the Terms and Conditions between you and us (also referred to in this DPA as the “Agreement”).

This DPA is supplemental to, and forms an integral part of, the Agreement and is effective upon its incorporation into the Agreement, which may be specified in the Agreement, an Order or an executed amendment to the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.

We update these terms from time to time. If you have an active Pembee subscription, we will let you know when we do via email (if you have subscribed to receive email notifications).

The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.

1. Definitions

“Applicable Laws” means any law to which we or a Sub-Processor are subject, including Data Protection Laws.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

“Company”, “Customer” or “You” means the user, or business that the user represents, that is entering into this Agreement with Pembee.

“Company Personal Data” means any Personal Data Processed by a Contracted Processor on behalf of Company pursuant to or in connection with the Agreement.

“Contracted Processor” means us or a Sub-Processor.

“Data Privacy Framework” means the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework (also known as the UK-US data bridge), operated by the U.S. Department of Commerce; as may be amended, superseded or replaced.

“Data Protection Law” means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement as it relates to the Customer, including Regulation 2016/679 (General Data Protection Regulation) (“GDPR”), and Cal. Civ. Code Title 1.81.5, § 1798.100 et seq. (California Consumer Privacy Act) (“CCPA”).

“Data Subject” means the individual to whom Personal Data relates.

“Europe” means the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom.

“European Data” means Personal Data that is subject to the protection of European Data Protection Laws.

“European Data Protection Laws” means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (iii) applicable national implementations of (i) and (ii); (iv) GDPR as it forms part of United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2018; and (v) the Swiss Federal Act on Data Protection (“Swiss DPA”); in each case, as may be amended, superseded or replaced.

“Instructions” means the written, documented instructions issued by a Controller to a Processor, and directing the same to perform a specific or general action with regard to Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making available).

“Permitted Affiliates” means any of your Affiliates that (i) are permitted to use the Subscription Services pursuant to the Agreement, but have not signed their own separate agreement with us and are not a “Customer” as defined under the Agreement, (ii) qualify as a Controller of Personal Data Processed by us, and (iii) are subject to European Data Protection Laws.

“Personal Data” means any information relating to an identified or identifiable individual where (i) such information is contained within Customer Data; and (ii) is protected similarly as personal data, personal information or personally identifiable information under applicable Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by us and/or our Sub-Processors in connection with the provision of the Subscription Services. “Personal Data Breach” will not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms “Process”, “Processes” and “Processed” will be construed accordingly.

“Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller. In this DPA, “Processor” refers to Pembee Ltd (“we”, “us”).

“Standard Contractual Clauses” means the standard contractual clauses annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021 currently found at Standard Contractual Clauses, as may be amended, superseded or replaced.

“Sub-Processor” means any Processor engaged by us or our Affiliates to assist in fulfilling our obligations with respect to the provision of the Subscription Services under the Agreement. Sub-Processors may include third parties or our Affiliates but will exclude any Pembee employee or consultant.

“Sub-Processor List” means our current list of Sub-Processors, published at www.pembee.app/security#subprocessors.

“UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at UK Addendum, as may be amended, superseded, or replaced.

“UK IDTA” means the International Data Transfer Agreement issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, as may be amended, superseded, or replaced.

2. Processing of Company Personal Data

2.1 Processor shall:

2.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and

2.1.2 not Process Company Personal Data other than on the relevant Company’s documented instructions.

2.2 The Company instructs Processor to process Company Personal Data.

2.3 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

2.4 Processor shall inform the Company without undue delay if, in its opinion, an instruction infringes Data Protection Laws.

3. Processor Personnel

3.1 Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Company Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Agreement, and to comply with Applicable Laws in the context of that individual’s duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

4.2 In assessing the appropriate level of security, Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

4.3 The measures in place at the date of this DPA are summarised in Annex 2. We may update these measures from time to time, provided that the updates do not materially reduce the overall level of security.

5. Subprocessing

5.1 You give us general authorisation to engage Sub-Processors to Process Personal Data on your behalf. The Sub-Processors engaged at the date of this DPA are set out in the Sub-Processor List.

5.2 Where we engage Sub-Processors, we will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Data as those in this DPA (including, where appropriate, the Standard Contractual Clauses), to the extent applicable to the nature of the services provided by such Sub-Processors. We will remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA.

5.3 We will give you at least 14 days’ notice before engaging a new Sub-Processor or replacing an existing one, by email to the primary administrators of your account and by updating the Sub-Processor List.

5.4 You may object to the change on reasonable data protection grounds by writing to info@pembee.app within that notice period. We will discuss your concerns with you in good faith. If we cannot resolve them, you may terminate the affected Subscription Service by written notice before the change takes effect.

6. Data Subject Rights

6.1 Taking into account the nature of the Processing, Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfillment of the Company obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

6.2 Processor shall:

6.2.1 promptly notify Company if it receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and

6.2.2 ensure that it does not respond to that request except on the documented instructions of Company or as required by Applicable Laws to which the Processor is subject, in which case Processor shall to the extent permitted by Applicable Laws inform Company of that legal requirement before the Contracted Processor responds to the request.

6.3 Clause 6.2 does not apply to a request that relates only to a Data Subject’s Pembee account (see clause 9.4), which we handle as Controller. Where a request also concerns Company Personal Data held in your Subscription Service, we will refer that part of it to you in accordance with clause 6.2.

7. Personal Data Breach

7.1 Processor shall notify Company without undue delay upon Processor becoming aware of a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

7.2 Processor shall co-operate with the Company and take reasonable commercial steps as are directed by Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8. Data Protection Impact Assessment

8.1 Processor shall provide reasonable assistance to the Company with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Company reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.

9. Retention, deletion and return of Company Personal Data

9.1 During the term of your Subscription Service, we retain Company Personal Data for as long as you keep it in the Subscription Service. As Controller, you decide how long that is. You can delete the records of your customers and attendees at any time, and you are responsible for configuring any data retention controls we make available in the Subscription Service.

9.2 On termination or expiry of your Subscription Service, we will make Company Personal Data available to you for retrieval for 30 days. After that period, we will delete Company Personal Data from our live systems, and in any event no later than 60 days after termination or expiry. Back-up copies are overwritten on a rolling cycle of 60 days, so all copies will be deleted within 120 days of termination or expiry. If a back-up containing deleted data is restored, we will delete that data again. On request, we will confirm deletion in writing. This clause does not apply where we are required by Applicable Laws to retain Company Personal Data, in which case we will protect it from any further Processing.

9.3 Clause 9.2 applies to Company Personal Data only. Our own records about you as our customer, being your organisation's name and contact details, the names and contact details of your administrators, and your account, billing and usage records, are not Company Personal Data. We retain them as Controller for 10 years after your Subscription Service ends, as set out in our Privacy Policy, so that we can deal with any later query from you, such as a request for a copy of an old receipt.

9.4 Pembee accounts. People sign in to your Subscription Service with a Pembee account: a single login that the same person may also use with other Pembee customers. The Pembee account itself, being the person’s name, email address, telephone number, login credentials and sign-in security settings, is held by us as Controller, is described in our Privacy Policy, and is not Company Personal Data. It is not deleted under clause 9.2 while the person uses it with another Pembee customer. We delete a Pembee account within 30 days of it ceasing to be linked to any Pembee customer. Where the person was one of your administrators, we keep their name, email address and telephone number in our own customer records under clause 9.3 after the Pembee account is deleted. The copy of the person’s name and contact details held in your Subscription Service, and everything they do there, is Company Personal Data and is deleted under clause 9.2.

10. Customer Responsibilities

10.1 Compliance with Laws. Within the scope of the Agreement and in its use of the services, you will be responsible for complying with all requirements that apply to it under applicable Data Protection Laws with respect to its Processing of Personal Data and the Instructions it issues to us.

10.2 In particular but without prejudice to the generality of the foregoing, you acknowledge and agree that you will be solely responsible for: (i) the accuracy, quality, and legality of Customer Data and the means by which you acquired Personal Data; (ii) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations (particularly for use by Customer for marketing purposes); (iii) ensuring you have the right to transfer, or provide access to, the Personal Data to us for Processing in accordance with the terms of the Agreement (including this DPA); (iv) ensuring that your Instructions to us regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws; and (v) complying with all laws (including Data Protection Laws) applicable to any emails or other content created, sent or managed through the Subscription Services, including those relating to obtaining consents (where required) to send emails, the content of the emails and its email deployment practices. You will inform us without undue delay if you are not able to comply with your responsibilities under this ‘Compliance with Laws’ section or applicable Data Protection Laws.

10.3 Controller Instructions. The parties agree that the Agreement (including this DPA), together with your use of the Subscription Service in accordance with the Agreement, constitutes your complete Instructions to us in relation to the Processing of Personal Data, so long as you may provide additional instructions during the subscription term that are consistent with the Agreement, the nature and lawful use of the Subscription Service.

10.4 Security. You are responsible for independently determining whether the data security provided for in the Subscription Service adequately meets your obligations under applicable Data Protection Laws. You are also responsible for your secure use of the Subscription Service, including protecting the security of Personal Data in transit to and from the Subscription Service (including to securely backup or encrypt any such Personal Data).

11. Data Transfer

11.1 Our application hosting and primary database are located in the United Kingdom.

11.2 You authorise us to transfer Company Personal Data outside the United Kingdom and the European Economic Area to the Sub-Processors on the Sub-Processor List, to the extent needed to provide the Subscription Services, provided that each transfer complies with Data Protection Laws.

11.3 For each such transfer we will ensure that one of the following is in place:

11.3.1 the recipient, or the country in which it is located, is covered by adequacy regulations or an adequacy decision under Data Protection Laws, including the Data Privacy Framework where the recipient is certified under it;

11.3.2 the Standard Contractual Clauses, together with the UK Addendum where UK GDPR applies, or the UK IDTA; or

11.3.3 another transfer mechanism permitted by Data Protection Laws.

11.4 On request, we will tell you which transfer mechanism applies to a given Sub-Processor and provide the relevant documentation.

12. Audit Rights

12.1 We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA and with Article 28 of the GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you.

12.2 We will seek to satisfy an audit request in the first instance by providing documentation and information about our technical and organisational measures.

12.3 Where you reasonably require further audit activity, such as a bespoke questionnaire, a remote or on-site inspection, or significant assistance from our personnel, it will: (i) be subject to at least 30 days’ prior written notice; (ii) take place no more than once in any 12-month period, unless required by a supervisory authority or following a Personal Data Breach affecting Company Personal Data; (iii) be carried out during normal business hours without unreasonably disrupting our operations; and (iv) be subject to appropriate confidentiality undertakings. No audit will give access to data belonging to our other customers.

12.4 We may charge our reasonable costs for the assistance described in clause 12.3, agreed with you in advance, except where the audit is required as a result of our breach of this DPA or of Data Protection Laws.

13. General Terms

13.1 Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that: (a) disclosure is required by law; (b) the relevant information is already in the public domain.

13.2 Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by email to the email address set out in the Agreement or at such other address as notified from time to time by the Parties changing address.

13.3 Amendments. Notwithstanding anything else to the contrary in the Agreement and without prejudice to the ‘Compliance with Instructions’ or ‘Security’ sections of this DPA, we reserve the right to make any updates and changes to this DPA.

13.4 Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.

Annex 1: Details of Processing

Subject matter: the provision of the Pembee Subscription Services to you under the Agreement.

Duration: the term of the Agreement, plus the period until Company Personal Data is deleted or returned under clause 9.

Nature and purpose: hosting, storing, organising, transmitting and otherwise Processing Company Personal Data so that you can take bookings and payments, manage enrolments and subscriptions, record attendance and communicate with your customers, and keeping the name and contact details held in your Subscription Service in sync with each person’s Pembee account when they update them (see clause 9.4).

Categories of Data Subjects:

your customers who create accounts and make bookings
the attendees they book for, who may be children
emergency contacts and other individuals named in a booking
your staff and administrators

Types of Personal Data:

names and contact details (email address, telephone number, postal address)
dates of birth and other attendee details
booking, enrolment, subscription and attendance records
payment and invoice records (card details are handled by our payment Sub-Processor and are not stored by us)
answers to the registration and booking questions you configure
files and images uploaded to the Subscription Services
messages sent through the Subscription Services

Special categories of data: you decide which questions to ask your customers. Where you choose to collect health, medical, dietary or similar information about attendees, that information is Processed under this DPA.

Pembee accounts: the Pembee account a person signs in with is held by us as Controller and is not Company Personal Data (see clause 9.4).

Annex 2: Technical and Organisational Measures

Encryption of data in transit using TLS 1.2 or higher
Encryption of the database, its backups and uploaded files at rest using AES-256
Passwords stored only as salted hashes
Payment card details handled by a PCI DSS Level 1 payment Sub-Processor and not stored by us
Role-based access controls within the Subscription Services, with two-step verification available on every Pembee account
Access to production systems limited to personnel who need it, with two-factor authentication enabled
Database network access restricted to the application’s IP addresses
Database run as a replica set with automatic failover
Hourly database backups retained for 2 days and daily backups retained for 60 days
Automated dependency vulnerability alerts and automated application testing
A process for investigating security incidents and notifying affected customers of a Personal Data Breach

A fuller description of these measures is available on our Security page.