Lodge data processing agreement

What this agreement is

When your lodge uses Lodge Platform, it puts in personal information about its members and guests: names, offices, contact details, and dietary and accessibility needs. Your lodge decides what goes in and why, so under UK data protection law (the UK GDPR, Article 28) your lodge is the controller and we are its processor: we look after the information for your lodge and use it only to provide the service.

This agreement sets out how we do that. It is part of our terms of service, and it applies whenever a lodge uses Lodge Platform. The account holder accepts it on the lodge's behalf.

"We" means Glimmers Store Limited. "Your lodge" means the lodge (or other Masonic body) whose account it is. Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning they have in the UK GDPR.

What we process for your lodge

What we promise

We will:

1. Follow your lodge's instructions. We process the information only to provide Lodge Platform as these terms describe, and as your lodge's team directs through the service, unless the law requires otherwise (in which case we will tell you first, unless the law forbids that). If we think an instruction breaks data protection law, we will tell you.
2. Keep it confidential. Everyone who can reach the information for us is bound to keep it confidential.
3. Keep it secure, with the measures in the annex below, and review them as risks change.
4. Use other companies only as this agreement allows (see "Other companies we use").
5. Help with people's rights. If someone asks us to see, correct or delete their information in your lodge's plans, we will pass the request to your lodge, and help your lodge answer it. Your team can also correct, delete and export information themselves.
6. Help you meet your own obligations, for example with security, telling people about a breach, and data protection impact assessments, taking into account what we know as your processor.
7. Delete or return it at the end. When your lodge's account ends, your lodge can download its information first; then we delete it as our privacy notice explains, unless the law requires us to keep it.
8. Show we are keeping these promises. We will give your lodge the information it reasonably needs to check this, and answer reasonable questions. If more is needed, we will agree a reasonable way to allow an audit.

What your lodge promises

Your lodge will:

• make sure it has a lawful reason to hold each piece of information it puts in, and tell its members and guests how their information is used (a short note in the lodge's summons or dining form is usually enough);
• for dietary and accessibility needs, have each person's clear agreement (explicit consent) to record them, or another lawful reason that applies, and record only what is needed to cater for them;
• give access only to people who need it, and remove people from the lodge's team when they no longer need access;
• not put ritual, minutes or other private material into the service.

We can send your lodge a short template for assessing the dietary information it holds (a data protection impact assessment). Email web@lodgeofalliance.org.

If something goes wrong

If we become aware of a personal data breach affecting your lodge's information, we will tell your lodge's account holder without undue delay, and within 48 hours, with what we know: what happened, what information and how many people may be affected, what we are doing about it, and who to contact. We will keep your lodge updated and help it decide whether it must tell the ICO or the people affected.

Other companies we use

Your lodge gives its general permission for us to use other companies (sub-processors) to help provide the service. The current list is in our privacy notice.

• Each one is bound by a written contract giving your lodge's information the same protection as this agreement.
• We will tell account holders by email at least 30 days before we add or replace one. If your lodge objects for a good reason and we can't resolve it, your lodge can end its account and we will refund the unused part of any year paid for.
• We remain responsible to your lodge for what they do.

Seating plans are never sent to the AI service we use for the website tools.

Information outside the UK

We transfer your lodge's information outside the UK only when UK law allows it: to a country the UK has approved, to a company certified under the UK–US "data bridge", or under the UK's approved data transfer agreement (the International Data Transfer Addendum).

Responsibility and how long this lasts

Each side's responsibility under this agreement is as set out in our terms of service. This agreement lasts as long as we hold your lodge's information.

Annex: how we keep information secure

• Encryption. Every page and every request is sent over an encrypted connection (HTTPS). The contents of seating plans and their earlier versions are encrypted on our server.
• Access within your lodge. Only people your lodge has put on its team can see its plans, and only with the access the account holder or a team manager gave them.
• Access by us. Only a small number of support staff can open a lodge's plans, they are shown as "site support" when they do, and every time it is recorded.
• Accounts. Passwords are stored hashed; invitation links work once, expire and are stored hashed; repeated sign-in attempts are slowed down.
• The server. It runs in a UK data centre, receives security updates automatically, and a firewall lets in only the service itself and our administrators.
• Backups. Taken every night and kept for a limited time (see our privacy notice).
• Deletion. Deleted plans can be restored for 30 days and are then erased; old versions and unused images are removed automatically.
• People. Everyone who works on the service for us is bound to confidentiality and knows how to report a problem.