NoraLite Data Processing Agreement
Nora Comply Limited · Last updated 12 October 2026
1. Parties and how this DPA applies
1.1 This Data Processing Agreement (DPA) is between Nora Comply Limited, registered in Ireland under number 822895 at 12 Liffey Street Lower, Dublin 1 D01 W9F2 (we, the Processor), and the business that accepts the NoraLite Terms of Service (you, the Controller).
1.2 It forms part of the Terms of Service and applies automatically when you accept them. It takes effect on 12 October 2026 or, if later, the start of your subscription.
1.3 Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the GDPR (Regulation (EU) 2016/679).
2. Roles
2.1 For the personal data you or your Authorised Users put into NoraLite (the Customer Personal Data), you are the controller and we are your processor.
2.2 For account, billing and website data, we act as an independent controller under our Privacy Policy. This DPA does not cover that data.
2.3 Annex 1 describes the processing: what data, whose, why and for how long.
3. Our obligations as processor
3.1 Instructions. We process Customer Personal Data only on your documented instructions, including as regards transfers outside the EEA (section 7). The Terms of Service, this DPA and your use of NoraLite's features are your instructions. We will tell you if we think an instruction breaks the GDPR or other data protection law.
3.2 Legal requirements. If EU or Member State law requires us to process the data in another way, we will tell you first, unless that law forbids it.
3.3 Your responsibilities. You are responsible for having a lawful basis for the processing, for the accuracy of the data, and for giving your staff the information the GDPR requires.
4. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only as needed for their role.
5. Security
We apply appropriate technical and organisational measures to protect Customer Personal Data, taking into account the nature of the data and the risks (GDPR Article 32). Annex 2 lists them. We may update these measures, but will not reduce the overall level of protection.
6. Sub-processors
6.1 You give us general authorisation to use sub-processors. Annex 3 lists the current ones.
6.2 We will tell you at least 30 days before adding or replacing a sub-processor, by email to the account owner.
6.3 You may object on reasonable data protection grounds within that 30 days. We will discuss your objection in good faith. If we cannot resolve it, you may cancel your subscription before the change takes effect and receive a pro-rata refund of fees for the unused period.
6.4 We impose data protection terms on each sub-processor that are at least as protective as this DPA. We remain responsible to you for their performance.
7. Transfers outside the EEA
We will transfer Customer Personal Data outside the European Economic Area only with a valid safeguard under Chapter V of the GDPR: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed. Annex 3 states the safeguard for each sub-processor.
8. Helping you meet your obligations
8.1 Data subject requests. If one of your staff contacts us directly to exercise a GDPR right, we will pass the request to you promptly and not respond ourselves unless you ask us to. NoraLite lets you access, correct, export and delete the data yourself, except a completed task's sign-off (who approved it, their role and when), which NoraLite keeps unchanged as your record of the approval; where it cannot, we will help you.
8.2 Other assistance. Taking into account the information available to us, we will reasonably help you with security, breach notification, data protection impact assessments and consultations with a supervisory authority (GDPR Articles 32 to 36). We may charge reasonable costs for help beyond what NoraLite's features provide.
9. Personal data breaches
9.1 We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
9.2 Our notice will describe, as far as we then know: what happened, the categories and approximate numbers of people and records affected, the likely consequences, and the steps taken or proposed. We will send further information as it becomes available.
9.3 Notifying you is not an admission of fault. You decide whether to notify the supervisory authority and affected individuals; we will reasonably help.
10. Deletion and return
10.1 You can export your Customer Personal Data at any time during your subscription. For 30 days after it ends, you can still sign in to view and download it, or ask us for an export. This is how we return the data to you.
10.2 After those 30 days we delete it from live systems. Copies in backups are overwritten within 35 days. We may keep data only where EU or Member State law requires.
11. Records and audits
11.1 We will make available the information reasonably needed to show we comply with this DPA, including summaries of our security measures and sub-processor terms.
11.2 If that information is not enough, or a supervisory authority requires it, you may audit our compliance once in any 12-month period, and also after a personal data breach affecting your data. You must give 30 days' notice, use an independent auditor bound by confidentiality, avoid disrupting our business, and pay your own costs.
12. Liability, term and precedence
12.1 Each party's liability under this DPA is subject to the limitations and exclusions in section 13 of the Terms of Service. This does not limit any liability a party has directly to data subjects under the GDPR.
12.2 This DPA lasts as long as we process Customer Personal Data for you.
12.3 If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.
12.4 This DPA is governed by the laws of Ireland, and the Irish courts have exclusive jurisdiction.
Annex 1: Description of the processing
| Item | Description |
|---|---|
| Subject matter | Providing NoraLite, an AI Act compliance tool for businesses that use AI, to the Controller |
| Duration | The subscription, plus the 30-day export period and backup cycle in section 10 |
| Nature and purpose | Storing, organising and displaying Customer Personal Data so the Controller can record AI literacy training and manage its AI compliance records; sending service emails; producing reports |
| Data subjects | The Controller's employees, contractors and other staff whose details are entered in NoraLite, for example for training records. (Account users' own sign-in details are covered by our Privacy Policy, see section 2.2.) |
| Categories of personal data | For the Controller's staff: name, role, the AI tools they use, the date they completed AI training and any training note (the AI literacy list); and the name and role of whoever signs off a compliance task. Free text the Controller's users type (notes, task steps, descriptions of how AI tools are used, questions to Ask Nora) may contain personal data if they include it. NoraLite does not store staff email addresses, quiz results or certificates, and does not accept file uploads. |
| Special category data | None intended. The Controller must not upload it (Terms of Service section 9). |
| Frequency | Continuous, for the duration of the subscription |
Annex 2: Security measures
| Area | Measure |
|---|---|
| Encryption | Data encrypted in transit (HTTPS, with HSTS) and at rest by our database provider; backups are also encrypted, with a key only we hold |
| Access control | Staff access to production data limited to named people who need it, with multi-factor authentication |
| Customer separation | Each customer can see only its own data, enforced in the database by row-level security on every customer table and tested automatically on every code change |
| Authentication | Passwords stored only as salted hashes by our sign-in provider; the session is re-checked on every request; bot protection on sign-up and sign-in. Multi-factor authentication for customers is not yet available |
| Backups | Automated encrypted backups every night, kept for 35 days, stored in the EU (Frankfurt) |
| Monitoring | Error and uptime monitoring (Sentry, EU region). Error reports carry internal ids only: names, email addresses, request contents, and AI prompts and answers are not collected, and any email address that slips through is masked |
| Network protection | DDoS protection by our hosting provider (Vercel); bot protection on sign-up and sign-in (Cloudflare Turnstile) |
| Incident response | A written process for detecting, containing and reporting breaches within the 48-hour window in section 9 |
| Staff | Confidentiality obligations and data protection awareness for everyone with access |
| Vendors | Sub-processors checked for appropriate security, with data processing terms in place |
Annex 3: Sub-processors
Current as of the date at the top.
| Sub-processor | Purpose | Customer data it handles | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database and sign-in | All Customer Personal Data | EU (Frankfurt) | Standard Contractual Clauses (Supabase DPA); data stored in the EU |
| Vercel | Hosting the application | Data passing through the app | EU (Frankfurt) for the application; global network for delivery | Standard Contractual Clauses (Vercel DPA) |
| Cloudflare | Bot protection on sign-up and sign-in (Turnstile) | IP address and browser signals of the person signing in; no Customer Personal Data | Global | EU-US Data Privacy Framework and Standard Contractual Clauses (Cloudflare DPA) |
| Anthropic | AI features | Questions typed into Ask Nora, with the Controller's company name, AI tools, uses, ratings and roadmap task titles. Staff names and emails are not sent, but anything a user types into a question is | United States by default | Standard Contractual Clauses, in Anthropic's DPA (part of its Commercial Terms) |
| Cohere | AI search and retrieval features | The text of Ask Nora questions and use searches; no other Customer Personal Data | Canada and the United States | EU adequacy decision for Canada; EU-US Data Privacy Framework for its US cloud (Cohere privacy policy and Trust Center) |
| Resend | Sending service emails | Recipient email addresses and email content | EU (Ireland) | EU-US Data Privacy Framework and Standard Contractual Clauses (Resend DPA) |
| Sentry | Error monitoring | Internal user and company ids and technical error data; names, emails and typed content are not collected | EU (Frankfurt) | Standard Contractual Clauses (Sentry DPA) |
| Inngest | Running background tasks | Email jobs: recipient email addresses, the company name and text the Controller's users typed (tool, use, description); other jobs carry ids only | [Confirm with Inngest] | [Confirm with Inngest] |
Revolut is not a sub-processor: it processes payment data for us as a separate controller and does not handle Customer Personal Data.