Jonas Club Software

What Jonas Club Software does

Jonas Club Software is a Constellation Software subsidiary headquartered in Markham, Ontario, with operations in the United States. It supplies an integrated suite for private member clubs covering membership management, accounting and billing, food and beverage point of sale, event and banquet planning, tee time and court booking, and member facing website portals. Most clubs deploy the member portal as the primary digital touchpoint, which means the platform sits at the center of member personal data, financial transactions, and engagement analytics.

How Jonas tracks member activity

Jonas embeds JavaScript modules in club websites and member portals to authenticate members, persist sessions, and track engagement. The platform uses first party cookies on the club domain (such as the session and authentication tokens) and optional third party analytics cookies served from jonasclub.com infrastructure. Tracking typically covers attendance, page visits, booking flows, and purchase behavior so club managers can produce member engagement and retention reports.

Where member data is stored

Member data is hosted in Constellation Software data centers in Canada (Toronto) and the United States. For EU and UK clubs this means international transfers occur by default. Canada benefits from a European Commission adequacy decision for commercial organizations subject to PIPEDA, while transfers to the US rely on the EU US Data Privacy Framework where Jonas or its US affiliate is self certified, or on Standard Contractual Clauses combined with a transfer impact assessment.

Legal basis under GDPR

For core club operations such as managing the membership contract, billing dues, processing food and beverage orders, and operating tee time bookings, the controller (the club) relies on Article 6(1)(b) GDPR (performance of a contract). Marketing communications, member newsletters, and non essential analytics cookies require Article 6(1)(a) consent. Article 6(1)(f) legitimate interests may cover security, fraud prevention, and basic service integrity logging.

Risk profile for clubs

Risk is medium. Jonas processes a broad personal data set including identification, contact details, payment card data, attendance, dietary preferences (which can hint at health or religious information), and behavioral patterns. The combination of financial and behavioral data, plus cross border transfers, justifies a documented DPIA, a signed Data Processing Agreement with Jonas, retention limits for inactive members, and a consent management platform for non essential cookies and marketing emails.

How clubs stay compliant

Clubs should publish a privacy notice describing Jonas processing, list the cookies set by the portal, document the legal basis matrix, restrict access to member records on a role basis, and provide easy mechanisms to exercise data subject rights including export and erasure when members resign. A consent banner is required to gate analytics cookies and to capture opt in for marketing emails sent through Jonas email modules.