Parties, roles and scope
The customer identified in the service agreement acts as controller, or as a processor authorised by its controller; the nonono operator acts as processor or subprocessor for customer personal data. Each party separately determines its own account, billing and legal-compliance processing. This addendum prevails over inconsistent service terms on processing customer personal data.
Processing covers hosting, organising, retrieving, communicating, scheduling, analysing instructed campaign results, exporting and deleting information for the service term and the return/deletion period. Data subjects are customer personnel, prospects, customers and appointment attendees. Data categories include contact details, form answers, permissions, correspondence, notes, uploaded assets, appointments and recorded outcomes. Special-category data and criminal-offence data are outside the ordinary service scope unless separately agreed with an appropriate lawful basis and safeguards.
Documented instructions and confidentiality
nonono processes customer personal data only on documented lawful instructions, including selected product settings and approved integrations, except where a binding legal obligation requires otherwise. We inform the customer of that obligation before processing unless the law prohibits notice. If an instruction appears to infringe applicable data-protection law, we inform the customer and may suspend the affected instruction pending clarification.
Access is limited to authorised persons subject to confidentiality duties and a need to perform their role. The customer is responsible for the lawfulness and accuracy of its instructions, required notices and permissions, and appropriate workspace roles. nonono does not acquire a right to use customer personal data for unrelated advertising or resale.
Technical and organisational measures
The measures include workspace access checks and database isolation, encryption of private records and provider credentials, TLS, revocable sessions, MFA capability, controlled service roles, input and webhook validation, logs that avoid secret payloads, encrypted backups and recovery checks. Measures are reviewed as risks and the service change. They do not constitute a certification or an absolute guarantee against incidents.
Subprocessors and transfers
The customer gives general authorisation for the applicable infrastructure providers listed in the provider register and specific authorisation for optional processors it selects. nonono requires equivalent data-protection obligations from subprocessors and remains responsible for their performance as required by applicable law. Customers will be informed in advance of intended additions or replacements and given an opportunity to raise a reasoned data-protection objection before the change, as required by applicable law and the relevant processing agreement. If an objection cannot be resolved, the parties will agree an alternative or end the affected processing.
We work with the customer to resolve a reasonable objection, including an alternative where practicable or ending the affected service. Transfers outside the EEA or UK require an applicable adequacy decision or appropriate safeguards, such as the applicable EU standard contractual clauses and UK addendum where required, completed for the actual parties and transfer. This addendum does not by itself claim that unsigned transfer documents have been executed.
Rights requests, incidents and assessments
Taking account of the nature of processing and information available, nonono assists the customer with rights requests, security obligations, impact assessments and prior consultation. A request received directly about customer data is referred to the customer unless otherwise legally required. We do not disclose an entire workspace to an individual requester.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, provide known details about scope, likely effects, contact and containment, and supply further information as it becomes available. The customer remains responsible for its regulatory and individual notifications, with our assistance. The GDPR's 72-hour regulatory deadline concerns the controller where notification is required; it is not permission for a processor to wait 72 hours.
Return, deletion and verification
At the customer's choice at the end of processing services, nonono returns or deletes customer personal data and deletes existing copies unless applicable law requires retention. The parties agree the practical export and deletion instructions, including backups and legally retained records. Retained information stays protected and is not used for new campaigns. Backup recovery must reapply erasure restrictions before normal operation.
nonono makes available information needed to demonstrate compliance with this addendum and allows and contributes to proportionate audits and inspections by the customer or its mandated auditor. Reasonable confidentiality, scheduling and security arrangements protect other customers without excluding required audit rights. Contact privacy@nonono.ai for the applicable processing and security information.