Request a Demo

Data Processing Agreement

Last updated 3 September 2026 · Version dpa-2026-09

This agreement is between MemberAssistant Ltd, a company registered in Northern Ireland (company number NI733574) whose registered office is at 102 Northland Road, Londonderry, Northern Ireland, BT48 0AS, trading as Portava ("we", "us", the "Processor"), and the organisation that uses Portava under our Terms of Service ("you", the "Customer", the "Controller").

It applies automatically. It forms part of the Terms of Service and takes effect when you begin using Portava, so no signature is required for it to bind us. If your procurement process needs a signed counterpart, ask us at and we will provide one; signing changes nothing in the terms.

It is required by Article 28(3) of the UK GDPR, which says a controller may only use a processor under a written contract setting out the matters below.

1. Definitions

"UK GDPR" and "Data Protection Legislation" mean the UK General Data Protection Regulation and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003, each as amended or replaced.

"Customer Personal Data" means personal data contained in your portal that we process on your behalf, as described in Annex 1.

"Sub-processor" means any third party engaged by us to process Customer Personal Data.

"Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR.

2. Roles of the parties

You are the controller of Customer Personal Data and we are your processor. You decide what personal data to collect about your members, why, and on what lawful basis. We hold and process it on your instructions and for no purpose of our own.

You confirm that you have a lawful basis for the personal data you put into Portava, that you have given your members the information the UK GDPR requires, and that your instructions to us will not put us in breach of the Data Protection Legislation.

Separately from this agreement, we are a controller of our own customer-account and billing data — the details of the people who administer your portal and pay for the service. That processing is governed by our privacy policy, not by this agreement.

3. Our instructions

We will process Customer Personal Data only on your documented instructions, including in relation to transfers outside the UK, unless we are required to do otherwise by law. Where the law requires it, we will tell you before processing unless the law forbids us from telling you.

Your instructions are: this agreement, the Terms of Service, and the ordinary use of the features in the product by you and your users. If we consider an instruction to breach the Data Protection Legislation, we will tell you without delay.

We will not sell Customer Personal Data, use it for advertising, use it to train artificial-intelligence models, or use one organisation's data to benefit another.

4. Confidentiality

We ensure that anyone authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality, and that access is limited to those who need it to provide or support the service.

5. Security

We implement appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. The measures in force are described in Annex 3.

We may update those measures as the service develops, provided the level of protection is not reduced.

6. Sub-processors

You give general authorisation for us to engage Sub-processors. Those engaged at the date of this agreement are listed in Annex 2.

We will give you at least 30 days' notice before adding or replacing a Sub-processor. If you object on reasonable data-protection grounds within that period, we will work with you in good faith to find a resolution. If none can be found, you may terminate the affected part of the service, and we will refund any fees paid in advance for the period after termination.

We impose data-protection obligations on each Sub-processor that are no less protective than those in this agreement, and we remain fully liable to you for their performance.

7. Helping you meet your obligations

Requests from data subjects

Members exercise their rights with you, not with us, because you are their controller. If a member contacts us directly, we will not respond substantively — we will tell them to contact you and, where we can identify you, let you know.

We will help you respond to requests, taking into account the nature of the processing. Two things are already built into the product:

  • Self-serve export. Every member can download everything their portal holds about them, from their own privacy settings, without asking anyone. Where a category exists but is not reproduced in the download, it is still named and counted.
  • Erasure. Your administrators can erase a member. Identifying details are scrubbed rather than records destroyed, so that other people's discussion contributions survive and so that invoices and payment records — which you are required to keep under tax law, and which Article 17(3)(b) exempts from erasure — remain intact but unlinked from the person.

Other assistance

Taking into account the nature of the processing and the information available to us, we will help you with your obligations on security, breach notification, data protection impact assessments, and prior consultation with the Information Commissioner's Office.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours.

Our notification will describe, so far as we know at the time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide everything at once, we will provide it in phases as it becomes available.

Reporting a breach to the ICO, and telling affected members, is your responsibility as controller. We will give you the information you need to do it within the 72 hours the UK GDPR allows you.

9. Return and deletion

You can export your data at any time while the service is running.

On termination you keep the ability to export for 30 days. After that we delete Customer Personal Data from live systems, and from backups within a further 90 days as backup cycles expire, except where we are required by law to keep it. If you need longer, ask us before the 30 days expire.

We will confirm deletion in writing on request. We will not withhold your data over a dispute about fees.

10. Audit and information

We will make available the information reasonably necessary to demonstrate compliance with Article 28, and will respond to reasonable written security questionnaires, at no charge and no more than once a year unless there has been a breach affecting your data or the ICO requires otherwise.

You may audit us, or appoint an independent auditor who is not our competitor and who signs a confidentiality undertaking. Audits require 30 days' written notice, take place during business hours, must not disrupt the service or risk other customers' data, and are at your cost — except where an audit finds a material breach of this agreement, in which case we bear the reasonable cost.

An honest note on scale. We are a small company. We would rather tell you now that an on-site audit is a significant undertaking for us than write an unlimited audit right we could not honour. In practice, questionnaires and documentation answer almost every question, and we will engage with them properly.

11. International transfers

Our hosting and database infrastructure is located in the United Kingdom or the European Economic Area. Some Sub-processors in Annex 2 process personal data in the United States.

Where personal data is transferred outside the UK, we ensure an appropriate transfer mechanism is in place — an adequacy regulation, the International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum — together with any supplementary measures a transfer risk assessment identifies. You authorise us to enter into such mechanisms with Sub-processors on your behalf as your processor.

12. Liability

Each party's liability under this agreement is subject to the limitations and exclusions in the Terms of Service. Nothing in this agreement limits either party's obligations or liability directly to a data subject or to the ICO under the Data Protection Legislation.

13. Duration

This agreement applies for as long as we process Customer Personal Data on your behalf, and the obligations of confidentiality, deletion and international transfers survive its termination.

14. Changes

We may update this agreement where the law changes or the service changes. Every version carries a version marker, and we record which version applies. Where a change materially reduces your rights we will give reasonable notice, and you may terminate before it takes effect if you do not accept it.

15. Governing law

This agreement is governed by the law of Northern Ireland, and the courts of Northern Ireland have exclusive jurisdiction over any dispute arising from it.

Annex 1 — Details of the processing

Required by Article 28(3).

Subject matter — Providing the Portava membership platform to the Customer.

Duration — For as long as the Customer uses Portava, plus the retention periods in clause 9.

Nature and purpose — Hosting, storing, organising, retrieving, displaying, transmitting and deleting personal data so that the Customer can run its member portal — a directory, events, news, resources, discussions, direct messages, membership billing, email communications and an AI assistant that answers from the portal's own content.

Types of personal data — Name, email address, telephone number, postal and company address, job title, biography, photograph, company or organisation, skills and interests, custom fields defined by the Customer; sign-in credentials, two-factor settings, sessions and sign-in history; event registrations, waiting lists and attendance; discussion posts and reactions; direct messages and attachments; saved items and reading history; survey, feedback and custom question responses; notes recorded by the Customer's officers; invoices, subscriptions, payments, orders and refunds; assistant conversations; notification and email preferences; push-notification subscriptions.

Categories of data subject — The Customer's members and their contacts; the Customer's administrators, officers and staff; guests who register for the Customer's public events; and other individuals whose details the Customer records.

Special category data — Portava is not designed for special category data (Article 9) or criminal offence data (Article 10). The Customer should not enter it into free-text fields or custom fields. Where the Customer does so, it remains the Customer's responsibility to establish an Article 9 or 10 condition.

Annex 2 — Authorised Sub-processors

As at 2 September 2026. Changes are notified under clause 6.

  • Vercel Inc. — Application hosting and file storage
    Location: UK / EEA, US
    Data accessed: Data in transit through the application; uploaded files
  • Neon Inc. — Database hosting
    Location: UK / EEA
    Data accessed: All portal data at rest
  • Stripe, Inc. — Payment processing
    Location: UK / EEA, US
    Data accessed: Payer name, email and payment details. Card numbers go directly to Stripe and do not touch our systems
  • Resend (Plus Five Five, Inc.) — Transactional and campaign email delivery
    Location: US
    Data accessed: Recipient addresses and message content
  • Functional Software, Inc. (Sentry) — Error monitoring
    Location: US
    Data accessed: Technical diagnostics, which may incidentally include a user identifier
  • OpenAI, L.L.C. — AI assistant and text embeddings
    Location: US
    Data accessed: Only the portal content and question involved in answering one query
  • Anthropic PBC — AI assistant
    Location: US
    Data accessed: Only the portal content and question involved in answering one query
  • Google LLC — AI assistant; optional Google sign-in; address autocomplete
    Location: US / EEA
    Data accessed: As above; sign-in identity; the partial address being typed
  • HubSpot, Inc. — CRM synchronisation — only where the Customer connects its own HubSpot account
    Location: US / EEA
    Data accessed: The member and company records the Customer chooses to sync

Not Sub-processors. The analytics and advertising providers on our marketing website process visitor data from portava.ai only, with consent, and never receive Customer Personal Data. They are described in our cookie policy and are outside this agreement.

AI providers. We use business terms under which submitted content is not used to train models. There is no public assistant surface: both assistant endpoints require a signed-in account with membership of that portal.

Annex 3 — Technical and organisational measures

The measures in force, as required by Article 32. These describe what the software actually does.

Separation between organisations

  • Every portal's data is isolated in the database itself, by PostgreSQL row-level security, rather than by application code that a developer has to remember to write. A missing filter in a query cannot expose another organisation's data because the database refuses the rows.
  • Tenant isolation is covered by an automated test suite that runs on every change.

Access control

  • Role-based access within each portal: member, content manager, administrator.
  • Two-factor authentication and single sign-on (SAML) are available and recommended.
  • Sessions expire after seven days.
  • Passwords are stored hashed using bcrypt and are never recoverable in readable form.
  • Credentials for connected third-party services are encrypted at rest with AES-256-GCM.

Support access to a portal

Stated precisely, because it is the measure most often overstated:

  • The capability is restricted to our platform administrators. It is not available to the Customer's users or to our staff generally.
  • It expires automatically after one hour.
  • Administrative changes are refused while it is in use; the access is effectively read-only for administrative functions.
  • Starting and ending it is logged.
  • It does not currently require the Customer's prior authorisation, and the log is written to our monitoring system rather than to a queryable audit table. We state this rather than imply a control we have not built. Both are on our roadmap, and a Customer who needs support access gated on its own approval should raise it with us.

Encryption and transmission

  • All traffic is served over HTTPS with HTTP Strict Transport Security.
  • Data is encrypted at rest by our hosting and database providers.

The AI assistant

  • Permissions are enforced before anything reaches an AI model, by controlling what is indexed rather than by filtering results afterwards. Content with restricted visibility is never indexed, so there is nothing to retrieve even in error.
  • Content that is unpublished, hidden or deleted is removed from the index.
  • The assistant cannot reach across portals, and cannot answer about anyone other than the person asking: the asker's identity is fixed by the system when the conversation begins.

Resilience and testing

  • Database backups are maintained by our database provider with point-in-time recovery.
  • Automated tests, type checking and linting run on every change before it can be merged.
  • Application errors are monitored continuously.

Organisational

  • Access on a least-privilege basis, limited to staff who need it.
  • Confidentiality obligations on everyone with access.
  • Sub-processors are bound by written terms no less protective than this agreement.

Questions

Write to , or to MemberAssistant Ltd, 102 Northland Road, Londonderry, Northern Ireland, BT48 0AS.

A signature copy is available on request for procurement teams that require one. This document was prepared to reflect what the Portava platform actually does and is grounded in its source code. It is not legal advice.