Data Processing Agreement

Subject matter & duration

Noli processes Personal Data on behalf of the Controller solely to provide the loyalty and AI-agent services described in the Agreement. Processing continues for the term of the Agreement, plus any short period required to delete or return data on termination (see Return & deletion).

Definitions

Capitalised terms not defined here have the meaning given in the GDPR. "Customer Data" includes "Personal Data" as defined under GDPR Art. 4(1).

Processing on your instructions

Noli processes Personal Data only on documented instructions from the Controller, including those embedded in the Agreement, the configuration of the Service, and the use of supported features. Noli will inform the Controller if, in its opinion, an instruction infringes the GDPR or other EU/Member State data protection law.

Confidentiality of personnel

Noli ensures that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and have received GDPR awareness training.

Security measures

Noli implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art. Measures are detailed in Annex A below and include:

• Encryption of Personal Data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls; least-privilege provisioning; mandatory MFA on production access
• Network segmentation between production, staging and development environments
• Centralised logging, intrusion detection, and quarterly security reviews
• Regular backups and tested disaster-recovery procedures
• Vulnerability scanning and timely patching of supported components

Sub-processors

The Controller authorises noli to engage sub-processors to process Personal Data, subject to: (a) noli imposing data-protection obligations no less protective than this DPA; and (b) noli remaining liable for sub-processor performance.

The current list of sub-processors is in Annex B. Noli will give the Controller at least 30 days' prior notice of any addition or replacement of a sub-processor (via dashboard notice or email). The Controller may object on reasonable data protection grounds; if the parties cannot resolve the objection in good faith, the Controller may terminate the affected portion of the Service without penalty.

Data subject rights assistance

Noli provides functionality (export, deletion, restriction) within the Service that enables the Controller to fulfil its obligations to respond to data subject requests. Where additional assistance is reasonably required, noli will provide it without undue delay, taking into account the nature of the processing. Costs of substantial bespoke assistance may be charged at noli's standard rates.

Personal data breaches

Noli notifies the Controller without undue delay - and in any event within 72 hours of becoming aware - of a Personal Data breach affecting the Controller's data. The notification includes, to the extent known: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed.

International transfers

Noli does not transfer Personal Data outside the European Economic Area (EEA). All processing, storage and backups occur in EU regions (primarily Frankfurt, Germany and Sofia, Bulgaria). If a future change requires a transfer, noli will rely on appropriate safeguards (Standard Contractual Clauses or equivalent) and notify the Controller in advance.

Audits & inspections

The Controller may, at its expense and no more than once per year (or more frequently in case of a confirmed breach), audit noli's compliance with this DPA. Noli will reasonably cooperate, including by providing a current independent audit report (e.g. SOC 2, ISO 27001) where available, in lieu of an on-site audit.

Return & deletion of data

On termination of the Agreement, noli will, at the Controller's choice, return or delete all Personal Data within 30 days, unless EU/Member State law requires storage for longer. Backups containing Personal Data are deleted on the next regular cycle, not exceeding 90 days.

Annexes

Annex A - Technical & organisational measures (summary)

Annex B - Sub-processors (current list)

The current list is also available on request from support@heynoli.ai. If a sub-processor is added or replaced, noli will provide 30 days' advance notice.

Annex C - Categories of data subjects & data

Categories of data subjects: end-customers of the Controller (individuals who hold loyalty accounts or interact with the AI agent on the Controller's storefront).

Categories of Personal Data: identifiers (name, email, phone where collected), commercial information (orders, points, tiers), communication records (chat, email, push messages), preference and consent flags. We do not process special categories of data unless explicitly configured by the Controller.