Terms & Conditions
The terms governing access to and use of the Itensity Online platform for customers in the United Kingdom and European Union, including our Article 28 Data Processing Agreement.
01About us and these terms
These terms and conditions govern your access to and use of the Itensity Online membership management platform (the “Platform” or “System”) and the related website at www.itensityonline.com (the “Website”), provided by KRS Club (Pty) Ltd, registered in South Africa under registration number 2016/438793/07, registered office 49 Bell Crescent, Westlake Business Park, Westlake, Cape Town 7945 (“KRS Club”, “we”, “us”, “our”).
By registering for, accessing or using the Platform, you (the “Customer”, “you”, “your”) agree to be bound by these terms, including the Data Processing Agreement set out in Annexure A. If you do not agree, you must not use the Platform.
02The service
KRS Club provides the Platform on a Software-as-a-Service (SaaS) basis. We grant you a non-exclusive, non-transferable, revocable licence to access and use the Platform for your internal business purposes for the duration of your subscription, subject to these terms.
- You may permit your employees and authorised contractors to use the Platform, but you remain responsible for their compliance with these terms.
- You must keep your account credentials secure and are responsible for all activity under your account.
- You must not copy, reverse-engineer, resell, sublicense or create derivative works from the Platform except as expressly permitted.
03Intellectual property
All intellectual property rights in and to the Platform, the System, the software, its source and object code, and any modifications, adaptations, configurations or derivative works — whether created by us or requested by you — remain the sole and exclusive property of KRS Club. Nothing in these terms transfers any ownership of the Platform to you.
04Fees and payment
Subscription fees are payable monthly in advance and are due before the 7th day of each month, unless a Work Order or price list states otherwise. Fees for UK/EU customers may be invoiced and collected in GBP or EUR via our United Kingdom payment facilities (including GoCardless and Wise), notwithstanding that KRS Club is incorporated in South Africa.
- Fees are exclusive of any applicable VAT or equivalent tax, which will be added where required.
- If payment is not received, we may suspend or revoke access to the Platform after a grace period of 14 business days.
- Fees are subject to annual review, with prior written notice before any increase takes effect.
05Data protection
Our collection and use of personal data is described in our Privacy Policy, which forms part of these terms. Where you upload personal data of your members or staff to the Platform, you act as the controller and we act as your processor. That processing relationship is governed by the Data Processing Agreement in Annexure A, which forms part of these terms and which you accept when you accept these terms.
For UK and EU customers, member personal data is hosted within the United Kingdom or the European Union. Certain limited business and billing information may be processed in South Africa, as set out in the Privacy Policy and Annexure A. We maintain appropriate safeguards for any such transfer.
06Availability and support
We aim to keep the Platform available and to provide support in accordance with the applicable Service Level Agreement. Scheduled maintenance, events beyond our reasonable control, and issues arising from your own infrastructure or third-party services are excluded from availability commitments.
07Liability
Nothing in these terms limits or excludes liability that cannot lawfully be limited or excluded, including liability for death or personal injury caused by negligence, or for fraud.
Subject to the above, our total aggregate liability in any twelve-month period is limited to the fees paid by you in the twelve months preceding the event giving rise to the claim. We are not liable for any indirect or consequential loss, or for loss of profits, revenue, data or goodwill.
08Term and termination
- You may terminate on three (3) months’ written notice without cause.
- We may terminate on twelve (12) months’ written notice without cause.
- Either party may terminate for material breach not remedied within thirty (30) days of written notice.
- On termination, you may request export of your data at your cost and at our standard rates.
09Changes to these terms
We may amend these terms from time to time. We will notify you of material changes at least five (5) business days before they take effect, and the updated terms will be posted on the Website. Continued use after the effective date constitutes acceptance.
10Governing law and jurisdiction
These terms are governed by the laws of the Republic of South Africa. The parties submit to the non-exclusive jurisdiction of the South African courts. For customers established in the United Kingdom, the courts of England and Wales shall additionally have non-exclusive jurisdiction.
11Contact
KRS Club (Pty) Ltd
support@itensityonline.com · +27 (0)10 110 7011
49 Bell Crescent, Westlake Business Park, Westlake, Cape Town 7945, South Africa
UK Representative (Article 27): Prighter (powered by iuro Attorneys at Law) — Vishal Gera, vishal.gera@prighter.com.
Data Processing Agreement
A1. Scope and roles
This Data Processing Agreement (“DPA”) forms part of these Terms & Conditions between KRS Club (Pty) Ltd (“Processor”) and the Customer (“Controller”). If a separate DPA is signed by both parties, that signed DPA takes priority over this Annexure to the extent of any conflict.
- You are the controller of the member and staff personal data you upload to or generate within the Platform.
- We are the processor of that data and process it only on your documented instructions and to provide the service.
- Where we process your own business and billing contact data for our own invoicing purposes, we act as an independent controller for that limited data, as described in the Privacy Policy.
A2. Our obligations as processor
- Process personal data only on your documented instructions, including as to international transfers, unless required otherwise by law.
- Ensure persons authorised to process the data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures (Schedule 2).
- Respect the conditions for engaging sub-processors (clause A4).
- Assist you in responding to data-subject rights requests.
- Assist you with security, breach-notification and impact-assessment obligations.
- At your choice, delete or return all personal data at the end of the service unless law requires retention.
- Make available information necessary to demonstrate Article 28 compliance and contribute to audits, subject to clause A5.
A3. Breach notification
We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, providing the information you reasonably require to meet your own notification obligations.
A4. Sub-processors
You provide general authorisation for us to engage sub-processors. We maintain an up-to-date list (published as our Sub-processor List) and give prior notice of any addition or replacement, allowing you to object on reasonable data-protection grounds. We impose equivalent obligations on each sub-processor and remain fully liable for their performance.
A5. Audit rights
You may audit our compliance no more than once in any twelve-month period, on at least thirty (30) days’ written notice, during business hours and without unreasonable disruption. We may satisfy a request via third-party certifications, may withhold commercially sensitive information, and may charge reasonable costs beyond the annual allowance.
A6. International transfers
Member and staff personal data is hosted within the UK or EU. Limited business and billing data is processed in South Africa. For that transfer we rely on the ICO IDTA for UK-origin data and the EU Standard Contractual Clauses for EU data, incorporated by reference.
Schedule 1 — Details of processing
| Subject matter | Provision of the Itensity Online membership management platform |
| Duration | For the term of the Agreement plus any deletion/return period |
| Nature and purpose | Hosting, storage, administration and support of membership data |
| Types of data | Name, date of birth, contact details, address, membership details, attendance, payment-related data, and any other data the Controller enters |
| Categories of data subject | The Controller’s members, prospective members, and staff |
Schedule 2 — Security measures
- Logical access control on a least-privilege basis, with logging and periodic review.
- Encryption of data in transit and at rest where appropriate.
- Regular backups stored separately from primary systems.
- Physical and environmental security at hosting facilities.
- Breach detection, logging and a documented incident-response process.
Schedule 3 — Approved sub-processors
See our Sub-processor List, which forms part of this DPA.