OnNuma - Volunteer Organisation Platform
Operated by The Media Lounge Ltd. OnNuma is a product of The Media Lounge. Find out more.
Last updated: 2 October 2026
This Data Processing Agreement ("DPA") is between:
It sets out how we process personal data on your behalf when you use OnNuma (the "Service"). It is the written contract required by Article 28 of the UK GDPR.
The person who creates the organisation account confirms that they are authorised to bind the organisation. Creating the account, or continuing to use the Service after this DPA is published, is acceptance of this DPA.
This DPA forms part of our Terms and Conditions. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA applies.
For Customer Personal Data, you are the controller and we are the processor. You decide why that data is collected and what it is used for. You are accountable for it under UK data protection law. We process it only to provide the Service on your instructions.
Customer Personal Data means personal data that you, your users, or people interacting with your organisation submit to the Service, or that the Service collects on your instructions. It includes records you keep about contacts, members, volunteers, children and young people, guardians, form respondents, and similar people, and the messages, rotas, registers, and notes you store about them.
We are a separate controller only for personal data we decide the purposes of ourselves. That includes our own customer accounts, subscription and billing records, our own support correspondence, our own marketing, and security of our business. That processing is described in our Privacy Policy. Our Privacy Policy does not cover the people in your records, and it is not a privacy policy for your organisation.
Where the same person is both your administrator and someone in your contact records, the contact record is Customer Personal Data. The account we hold for the commercial relationship with your organisation is our own controller data.
We process Customer Personal Data only on your documented instructions, unless UK law requires us to do otherwise. If the law requires us to process it, we will tell you first unless the law prohibits that.
Your instructions are:
We will tell you if, in our opinion, an instruction infringes UK data protection law. We may suspend the affected processing until the instruction is confirmed or changed.
You must have your own privacy policy in place before you store other people's personal data in the Service, and you must keep it in place for as long as you do. You are responsible for writing it, for keeping it accurate, and for making it available to the people it covers, including volunteers, members, parents, and guardians where their data is stored.
The Hub includes a starter privacy policy template. You must open it in Settings → Privacy, adapt it so that it describes what your organisation actually does, set a real contact for privacy enquiries, and save it. The published Hub and MyHub privacy pages show the policy you have saved. We do not review it for you, and we are not responsible for its contents.
Our Privacy Policy explains how we handle our own customers and our own business. People in your records should be directed to your policy, not to ours.
You will:
Subject matter. Hosting and operating the Service so your organisation can manage volunteers, members, events, rotas, communications, forms, and related records.
Duration. For as long as your organisation account is open, and afterwards only for the deletion, backup, and legal-retention periods in section 12.
Nature and purpose. Storing, organising, displaying, exporting, and deleting Customer Personal Data, and sending the communications you initiate or that the Service sends on your instructions (such as rota reminders, invitations, and form-related messages).
Types of personal data. Depending on the features you use, this may include:
Categories of data subject. Your contacts, members, volunteers, staff and administrators, children and young people, parents and guardians, form respondents, and other people whose details you store in the Service.
You will not ask us to process other types of personal data, or data about other categories of people, unless the Service is designed for that use.
We make sure that anyone we authorise to process Customer Personal Data is bound by confidentiality, whether by contract or by a statutory duty.
We put in place appropriate technical and organisational measures to protect Customer Personal Data, taking account of the nature of the data and the risk. The measures we use are described in Annex 2.
You are responsible for the security of credentials issued to your users, for who you give access to, and for the content you choose to store.
You give us general written authorisation to use sub-processors to help us provide the Service. The sub-processors we use at the date of this DPA are listed in Annex 3.
We will put a written contract with each sub-processor that requires it to protect Customer Personal Data to a standard no less protective than this DPA. We remain responsible to you for a sub-processor's performance of those obligations.
We will give you at least 30 days' notice before we add or replace a sub-processor, by updating Annex 3 and, for a material change, by email to an administrator of your organisation. You may object in writing during that period, on reasonable grounds relating to data protection.
If you object, we will work with you in good faith to address the objection. If we cannot do that within a reasonable time, you may stop using the affected part of the Service, or close your account, without penalty for the unused remainder of a prepaid period that relates only to that affected part.
A provider that processes only our own controller data (for example our payment provider, for your subscription fees) is not a sub-processor under this DPA. Those providers are described in the Privacy Policy.
Customer Personal Data is hosted in the European Union. Email that contains it is sent from the European Union. Text messages, where you use that feature, are sent from the United Kingdom. The sub-processors and locations are listed in Annex 3.
The European Economic Area is covered by UK adequacy regulations, so storage and sending in the European Union does not need a separate transfer tool. We do not transfer Customer Personal Data outside the United Kingdom and the European Economic Area. If that changes, we will update Annex 3 under section 7 and we will put a lawful transfer tool in place before the transfer. That tool will be the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another mechanism the UK GDPR allows.
Responding to requests from people about their data is your responsibility. We will assist you, taking account of the nature of the processing, so that you can respond to requests to exercise their rights (access, correction, deletion, restriction, portability, and objection). Your privacy policy must tell people how to contact your organisation to make those requests.
The Hub includes tools to view, correct, export, and delete contact records. Use those tools where they do what the request requires. If they do not, contact us and we will provide reasonable assistance.
If we receive a request that relates to Customer Personal Data and we can tell which organisation it concerns, we will pass it to you promptly and will not answer it ourselves, unless the law requires us to.
Deciding whether to tell the ICO or the people affected is your responsibility as controller. We will tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data. Where we can, we will tell you within 48 hours, so that you can meet your own duty to notify the ICO within 72 hours where that duty applies.
Our notice will include, as far as we know it at the time:
We will update you as we learn more. We will not notify the ICO or the affected people on your behalf unless you ask us to, or the law requires us to.
We will provide reasonable information you need to carry out a data protection impact assessment or to consult the ICO, where the processing we do for you makes that necessary and you do not already have the information.
You can correct and delete Customer Personal Data, and export contact data, using the tools in the Hub while your account is open. If you ask before the account ends, we will also provide a copy of Customer Personal Data we hold, in a commonly used electronic format, where it is reasonable to do so.
When your account ends, we will delete Customer Personal Data from live systems within 90 days, unless UK law requires us to keep it for longer. Copies in backups are removed when those backups are overwritten in the ordinary course. We do not restore backups except for disaster recovery, security, or where the law requires it.
We may keep records that we hold as controller (such as invoices and correspondence about the account) under the Privacy Policy.
We will make available the information reasonably needed to show that we comply with this DPA.
You may ask for that information once in any 12-month period, and also after a personal data breach affecting your Customer Personal Data. We may answer by a written summary of our measures, rather than by giving access to systems that also hold other customers' data.
If a summary is not enough, you may audit us on at least 30 days' written notice, during normal business hours, in a way that does not disrupt the Service or put other customers' data at risk. You will keep what you see confidential and you will pay your own costs, unless the audit finds a material breach of this DPA. We may require the auditor to sign a reasonable confidentiality agreement.
Liability arising out of this DPA is subject to the limitation of liability in the Terms and Conditions. Nothing in this DPA limits liability that the law does not allow us to limit, including liability under UK data protection law that cannot lawfully be capped or excluded.
This DPA starts when your organisation account is created (or, for an account that already existed, when this DPA is published) and continues until we have deleted or returned Customer Personal Data as described in section 12.
We may update this DPA. We will change the "Last updated" date and, for a material change, notify an administrator by email or through the Service. Continued use after the change takes effect is acceptance. If you do not agree, stop using the Service and close the account. A change to sub-processors is handled under section 7.
This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that you may also bring a claim in the courts of Scotland or Northern Ireland if your organisation is established there.
The Media Lounge Ltd, 17 Arbroath Road, London SE9 6RR.
For questions about this DPA, use the contact details published on the OnNuma website.
This annex repeats the details required by Article 28, for ease of reference.
We maintain measures appropriate to the Service, including:
We review these measures as the Service changes. This annex describes the kind of measures in place. It is not a promise that a particular product setting or supplier configuration will never change, provided the overall standard remains appropriate.
These sub-processors process Customer Personal Data only to the extent needed for the purpose below. A sub-processor used only when you turn on a feature does not receive Customer Personal Data for that feature until you use it.
We do not sell Customer Personal Data, and we do not allow sub-processors to use it for their own marketing.