OnNuma – Volunteer Organisation Platform
Operated by The Media Lounge Ltd. OnNuma is a product of The Media Lounge. Find out more.
Last updated: 2 October 2026
This Privacy Policy explains how The Media Lounge Ltd ("we", "us", "our"), operator of OnNuma, collects, uses, stores, and protects personal information when you use our volunteer organisation platform and related services (the "Service"). It applies to visitors to our websites, organisations that subscribe to the Service, and the administrators who manage those accounts.
Your organisation is the controller of personal data it stores in the Service about its members, volunteers, contacts, children and young people, and other people. It must have its own privacy policy in place for that processing and make that policy available to those people. The Hub includes a starter privacy policy that the organisation must adapt and publish in Settings → Privacy. This policy does not replace that privacy policy, and it does not make us the controller of those records. Where we process them, we do so as processor under our Data Processing Agreement.
This Privacy Policy covers processing for which we are the controller. That includes our own customer accounts, subscription and billing records, our own support correspondence, our own marketing, and security of our business. It does not cover the people in your organisation's records. People in those records should be directed to your organisation's privacy policy, not to this one.
The Media Lounge Ltd, 17 Arbroath Road, London SE9 6RR, operates OnNuma. For the purposes of data protection law, we are the data controller for the processing described in this policy.
Contact: For privacy enquiries, contact us using the details published on the OnNuma website, or write to The Media Lounge Ltd, 17 Arbroath Road, London SE9 6RR.
Your organisation may upload or create content in the Service (contacts, members, events, rotas, forms, children's records, and similar). That content may include personal data of your members, volunteers, children and young people, and other individuals. That is Customer Personal Data under the DPA. Your organisation is the controller. We process it only on your instructions to provide the Service, as set out in the Data Processing Agreement.
We may receive information from our payment provider (Paddle) and from other service providers we use to run our own business (for example hosting and email), in line with their privacy policies and our agreements with them.
We use personal data we control to:
We do not sell your personal data to third parties for their marketing.
We process Customer Personal Data only as described in the Data Processing Agreement: to host and operate the Service so your organisation can manage volunteers, members, events, rotas, communications, forms, and related records, and to send the communications you initiate or that the Service sends on your instructions.
Where UK GDPR or equivalent law applies to processing for which we are the controller, we rely on:
Processing of Customer Personal Data is governed by the DPA. Your organisation is responsible for its lawful basis for that processing.
We may share personal data we control with:
Paddle processes payment data for your subscription. That is our own controller processing (or Paddle's), not Customer Personal Data under the DPA.
When we process Customer Personal Data, we use the sub-processors listed in Annex 3 of the Data Processing Agreement. At the date of this policy those include Railway (hosting), Mailgun (email), The SMS Works (text messages, where enabled), and Meta Platforms (WhatsApp messages, where enabled). We do not sell Customer Personal Data, and we do not allow those sub-processors to use it for their own marketing.
Customer Personal Data is hosted in the European Union. Email that contains it is sent from the European Union. Text messages, where you use that feature, are sent from the United Kingdom. The European Economic Area is covered by UK adequacy regulations, so storage and sending in the European Union does not need a separate transfer tool.
Where you use WhatsApp notifications, message delivery involves Meta Platforms. That may mean Customer Personal Data is processed outside the United Kingdom and the European Economic Area. In that case we put a lawful transfer tool in place (for example the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another mechanism the UK GDPR allows), as described in the DPA.
Personal data we control (accounts, billing, support) may be processed in the United Kingdom, the European Economic Area, and in other countries where our providers operate (for example our payment provider). We ensure appropriate safeguards where required by data protection law.
We retain personal data only as long as necessary for the purposes in this policy, including:
While your organisation account is open, Customer Personal Data is retained as you store it. You can correct, export, and delete it using the Hub tools.
When your account ends, we delete Customer Personal Data from live systems within 90 days, unless UK law requires us to keep it for longer. Copies in backups are removed when those backups are overwritten in the ordinary course, as set out in the DPA. We may keep records that we hold as controller (such as invoices and correspondence about the account) under this Privacy Policy.
Under UK GDPR and similar laws, you may have the right to:
These rights apply to personal data for which we are the controller. For Customer Personal Data, contact your organisation. Your organisation's privacy policy must tell people how to make those requests. If we receive a request that relates to Customer Personal Data and we can tell which organisation it concerns, we will pass it to that organisation promptly and will not answer it ourselves, unless the law requires us to.
To exercise rights against us as controller, contact us using the details in section 2. We will respond within the time required by law (e.g. one month under UK GDPR).
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, hashed passwords, session and CSRF protections, and secure storage. The measures we use for Customer Personal Data are described in Annex 2 of the Data Processing Agreement.
You are responsible for keeping your login credentials safe and for the security of data within your organisation's account, including who you give access to and the content you choose to store.
Our marketing websites and organisation signup are not directed at children. We do not knowingly collect personal data from children under 16 for our own marketing or account purposes. If you believe we have collected such data as controller, please contact us so we can delete it.
Separately, organisations may use the Service (including Children & Youth features and YouthHub) to store information about children and young people. That is Customer Personal Data. The organisation is the controller and must have a lawful basis and any other conditions the law requires. We process that data only as processor under the DPA.
We use cookies and similar technologies as described in our Cookie Policy. Essential cookies are required for the Service to work (for example sign-in and security). We do not use advertising or analytics cookies on the Service.
We may update this Privacy Policy from time to time. We will post the updated version and change the "Last updated" date. Significant changes may be communicated by email or through the Service. We encourage you to review this policy periodically.
For privacy questions, to exercise your rights against us as controller, or to make a complaint, please contact us using the details in section 2. You may also have the right to complain to your local data protection supervisory authority (in the UK, the ICO at ico.org.uk).