Partner Data Processing Addendum
Last Updated: December 9, 2024
Effective Date: December 9, 2024
1. Introduction
This Data Processing Addendum ("DPA") forms part of the Partner Agreement between you ("Partner") and Meirra and governs the processing of personal data in connection with the Partner Program.
This DPA ensures compliance with applicable data protection laws including the UK GDPR, EU GDPR, and other relevant data protection legislation.
By participating in the Partner Program, you agree to the terms of this DPA in addition to the Partner Agreement.
2. Data Protection Roles
Meirra as Controller
Meirra acts as the data controller for personal data relating to referred customers. We determine the purposes and means of processing customer data collected through the Partner Program.
Partner as Controller
You act as an independent data controller for your own audience data. You are responsible for obtaining proper consent before sharing referral information with Meirra.
Independent Controllers
Meirra and Partner operate as independent controllers. Neither party is a processor for the other. Each party is responsible for its own compliance with data protection laws.
3. Data Minimization
What Partners Can See
- Referral ID (anonymized identifier)
- Signup date (date only, not time)
- Subscription tier selected
- Commission amount earned
- Payment status
What Partners Cannot See
- Customer name or email address
- Customer payment details
- Customer usage data
- Customer support interactions
- Any data beyond what is necessary for commission calculation
4. Data Retention
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Partner account information | Duration of partnership + 3 years | Contract & legal obligation |
| Commission records | 7 years from payment | Tax and legal requirements |
| Referral tracking data | Duration of customer subscription | Contract performance |
| Communication records | 3 years from last contact | Legitimate interest |
5. Data Subject Rights
As a Partner, you have the following rights regarding your personal data:
- Right to access your personal data we hold
- Right to rectification of inaccurate data
- Right to erasure (with some exceptions for legal requirements)
- Right to restrict processing in certain circumstances
- Right to data portability
- Right to object to processing based on legitimate interests
- Right to withdraw consent where processing is based on consent
To exercise any of these rights, please contact support@meirra.com. We will respond within 30 days.
6. International Transfers
Where we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses, adequacy decisions, or other approved mechanisms.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting | EU (Frankfurt) |
| Vercel | Application hosting | EU |
| Stripe | Payment processing | EU with US processing |
| Resend | Email delivery | US (SCCs in place) |
7. Security Measures
Technical Measures
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Role-based access controls with principle of least privilege
- Multi-factor authentication for all administrative access
- Regular security assessments and penetration testing
- Automated security monitoring and alerting
- Regular backups with tested recovery procedures
Partner Obligations
- Use strong, unique passwords for your Partner account
- Enable two-factor authentication when available
- Do not share your Partner dashboard credentials
- Report any suspected security incidents immediately
- Keep your contact information up to date
8. Breach Notification
Meirra Obligations
In the event of a personal data breach affecting Partner data, we will notify affected Partners without undue delay (and within 72 hours where required by law) and provide information about the breach and remedial actions taken.
Partner Obligations
If you become aware of any security incident affecting your Partner account or referral activities, you must notify us immediately at support@meirra.com with details of the incident.
9. Contact Information
For data protection inquiries or to exercise your rights, please contact:
Meirra Data Protection Team
- Email:support@meirra.com
You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.