MemBirds Privacy Statement

Effective date: August 13, 2025

Version: 1.1

1. Introduction

MemBirds places great importance on your privacy. We process only the personal data necessary to provide and improve our services, and we handle the information we collect with care. Your data is never sold to third parties for commercial purposes.

This statement applies to all processing of personal data through our website, application, and related services. It explains:

  • Which personal data we process.
  • The purposes and legal bases for processing.
  • Which subprocessors we engage.
  • Where your data is stored.
  • Your rights under the General Data Protection Regulation (GDPR).

If you have questions about this statement, please use the contact details at the end of this document.

2. Roles and responsibilities

In most cases, MemBirds is the data controller within the meaning of the GDPR. When we process personal data on behalf of our customers—for example, in their online learning environments—we act as a processor and only on that customer's instructions. We enter into a data processing agreement (DPA) with our customers in accordance with Article 28 of the GDPR.

3. Personal data we process

Depending on how you use our services, we may process the following data:

  • Name and contact details (email address, phone number, address)
  • Company details (company name, position, VAT number)
  • Payment details (bank account number, credit card details)
  • Usage data (IP address, browser information, login details, times of use)
  • Communication content (messages, support requests)

4. Purposes and legal bases

We process personal data for the following purposes:

  • Service delivery: performing our agreement with customers.
  • Customer service: answering questions and providing technical support.
  • Administration: invoicing and compliance with legal obligations, including accounting and statutory tax retention periods.
  • Security: protection, fraud prevention, and access control.
  • Marketing: only with prior consent or within existing customer relationships as permitted by law.

Legal bases: performance of a contract, compliance with a legal obligation, legitimate interests, or consent.

5. Subprocessors and processing locations

We use carefully selected subprocessors to deliver our services. These parties process personal data only on our behalf and under a data processing agreement.

  • Mailgun – Transactional email delivery (servers in the EU / US)
  • Mollie – Payment processing (servers in the EU)
  • ActiveCampaign – Marketing automation and email campaigns (servers in the US)
  • Amazon AWS – Hosting and data storage (servers in the EU / US)
  • Cloudflare – Security, CDN, and DDoS protection (servers worldwide)
  • Google Analytics (GA4) – Anonymized web analytics (servers in the EU / US)
  • Meta (Facebook Pixel) – Advertising optimization, with consent only (servers in the US)
  • Moneybird – Accounting and invoicing (servers in the EU)
  • Snelstart – Accounting and invoicing (servers in the EU)
  • Resend – Email delivery and notifications (servers in the EU / US)

Transfers outside the EEA

When personal data is transferred outside the European Economic Area (EEA), we use standard contractual clauses (SCCs) approved by the European Commission and additional security measures. This applies, among others, to Mailgun, ActiveCampaign, Cloudflare, Meta, Resend, and Google Analytics.

6. Retention periods

We do not retain personal data longer than necessary for the purpose for which it was collected, unless we are legally required to keep it longer—for example, the seven-year tax retention period for invoice data.

7. Security

We take appropriate technical and organizational measures to protect personal data, including:

  • SSL/TLS encryption for data transmission
  • Restricted employee access rights
  • Regular security updates and penetration tests

8. Your rights

Under the GDPR, you have the following rights:

  • Access to your data
  • Rectification of inaccurate data
  • Erasure of your data (the "right to be forgotten")
  • Restriction of processing
  • Data portability
  • Objection to processing, including direct marketing
  • Withdrawal of consent

You can submit a request by emailing [email protected]. We will respond within 30 days.

9. Cookies and tracking

We use functional, analytical, and—with consent—marketing cookies.

  • Google Analytics (GA4): anonymized statistics without cross-device tracking.
  • Facebook Pixel & Conversion API: advertising optimization, with consent only.

For more information and to adjust your preferences, see our cookie policy.

10. Data Protection Officer (DPO)

Based on our processing activities, we are not required to appoint a DPO. We reassess this periodically.

11. Changes

We may amend this privacy statement. The latest version is always available on our website. We will inform you by email of any material changes.