LEGAL
This Data Processing Agreement (“DPA”) forms part of the agreement between NoralIQ and a customer using NoralIQ services where NoralIQ processes personal data on behalf of that customer.
It sets out the parties’ respective obligations concerning the processing and protection of personal data in accordance with applicable data protection law.
Last updated: 29 August 2026
This DPA applies between:
Ryan Allen, a sole trader trading as NoralIQ (“NoralIQ”, “Processor”, “we”, “us” or “our”); and
the person, business or organisation that has entered into an agreement with NoralIQ for the use of services involving the processing of personal data on its behalf (“Customer” or “Controller”).
This DPA applies where NoralIQ processes personal data on behalf of the Customer in connection with the Customer’s use of NoralIQ services.
This DPA forms part of and is incorporated into the applicable agreement governing the Customer’s use of NoralIQ, including the NoralIQ Terms of Service.
Where there is a conflict between this DPA and the general Terms of Service concerning the processing of Customer Personal Data, this DPA will take precedence to the extent of that conflict.
For the purposes of this DPA:
“Applicable Data Protection Law” means data protection and privacy legislation applicable to processing under this DPA, including the UK GDPR and Data Protection Act 2018, as amended or replaced from time to time.
“Controller” means the person or organisation that determines the purposes and means of processing personal data.
“Customer Data” means information submitted to, stored within or otherwise processed through NoralIQ by or on behalf of the Customer.
“Customer Personal Data” means personal data contained within Customer Data that NoralIQ processes on behalf of the Customer.
“Data Subject” means an identified or identifiable individual to whom personal data relates.
“Personal Data”, “Processing”, “Processor” and other data protection terms have the meanings given to them under Applicable Data Protection Law.
“Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
“Subprocessor” means another processor engaged by NoralIQ to process Customer Personal Data on behalf of the Customer.
“Services” means the NoralIQ applications, software and related services supplied to the Customer.
For Customer Personal Data processed under this DPA:
The Customer acts as Controller and determines the purposes and lawful basis for processing the personal data.
NoralIQ acts as Processor and processes that personal data on behalf of and according to the documented instructions of the Customer.
Each party is responsible for complying with the obligations that apply to it under Applicable Data Protection Law.
Nothing in this DPA prevents NoralIQ from acting as an independent controller in respect of personal information that NoralIQ processes for its own legitimate purposes, such as customer account administration, billing, security, legal compliance and its own business records. Such processing is described in the NoralIQ Privacy Policy.
The Customer is responsible for:
The Customer warrants that its documented instructions will not knowingly require NoralIQ to breach Applicable Data Protection Law.
NoralIQ will process Customer Personal Data only on documented instructions from the Customer, unless processing is required by applicable law.
The Customer instructs NoralIQ to process Customer Personal Data as reasonably necessary to:
The Customer’s use and configuration of the Services, actions taken by authorised users, support requests and other written communications may constitute documented instructions.
Where NoralIQ is required by law to process Customer Personal Data other than on the Customer’s instructions, NoralIQ will inform the Customer before doing so unless applicable law prohibits such notification.
If NoralIQ reasonably believes that an instruction from the Customer infringes Applicable Data Protection Law, NoralIQ will inform the Customer.
NoralIQ may suspend the affected processing where reasonably necessary while the parties seek to resolve the issue.
Nothing in this DPA requires NoralIQ to carry out processing that would knowingly cause NoralIQ to breach applicable law.
NoralIQ will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.
Access to Customer Personal Data will be limited to persons who require access for legitimate purposes connected with providing, maintaining, securing or supporting the Services.
NoralIQ will take reasonable steps to ensure that persons authorised to process Customer Personal Data understand their data protection and confidentiality responsibilities.
NoralIQ will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Security measures will take account of the nature, scope, context and purposes of processing and the risks to the rights and freedoms of individuals.
NoralIQ may update its security measures as technology, risks and the Services develop, provided that changes do not materially reduce the overall level of protection provided to Customer Personal Data.
The Customer provides NoralIQ with general written authorisation to engage Subprocessors where reasonably necessary to provide, maintain, secure and support the Services.
NoralIQ will maintain information about its relevant Subprocessors on the NoralIQ Subprocessors page.
Where NoralIQ appoints a Subprocessor to process Customer Personal Data, NoralIQ will ensure that appropriate contractual data protection obligations are imposed on that Subprocessor as required by Applicable Data Protection Law.
Those obligations will provide an appropriate level of protection for Customer Personal Data having regard to the processing performed by the Subprocessor.
NoralIQ remains responsible to the Customer for the performance of its Subprocessors’ applicable data protection obligations to the extent required by Applicable Data Protection Law.
NoralIQ may add, replace or remove Subprocessors as the Services develop.
Where required, NoralIQ will provide appropriate notice of a new Subprocessor before that provider begins materially processing Customer Personal Data.
The Customer may raise a reasonable written objection to a new Subprocessor on genuine data protection grounds.
The parties will work in good faith to consider reasonable steps available to address the Customer’s concerns.
If the parties cannot reasonably resolve a legitimate data protection objection, NoralIQ may, where practicable, offer an alternative means of providing the affected functionality or allow the Customer to discontinue the affected Service in accordance with the applicable contractual arrangements.
NoralIQ will not make a restricted international transfer of Customer Personal Data except in accordance with Applicable Data Protection Law.
Where Customer Personal Data is transferred outside the United Kingdom and the transfer is subject to UK restricted-transfer requirements, NoralIQ will ensure that an appropriate lawful transfer mechanism is used where required.
Depending on the circumstances, this may include:
NoralIQ will take reasonable steps to assess and implement additional safeguards where required.
Taking into account the nature of the processing, NoralIQ will provide reasonable assistance to the Customer through appropriate technical and organisational measures to enable the Customer to respond to requests by Data Subjects exercising their rights under Applicable Data Protection Law.
Where NoralIQ receives a request directly from a Data Subject relating primarily to Customer Personal Data controlled by the Customer, NoralIQ will ordinarily direct the individual to the Customer or notify the Customer as appropriate.
NoralIQ will not independently respond to such a request on the Customer’s behalf unless instructed or legally required to do so.
Taking into account the nature of the processing and information available to NoralIQ, NoralIQ will provide reasonable assistance to the Customer with its applicable obligations concerning:
The extent of assistance will depend on the nature of the Services and processing concerned.
NoralIQ will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
Where information is reasonably available, the notification may include:
Information may be provided in stages where complete information is not immediately available.
NoralIQ will take reasonable steps to investigate, contain and remediate Personal Data Breaches affecting its Services.
Notification of an incident does not constitute an admission of fault or liability.
Where processing through NoralIQ is likely to require a Data Protection Impact Assessment (“DPIA”), NoralIQ will provide reasonable information and assistance available to it to support the Customer in completing that assessment.
The Customer remains responsible for determining whether a DPIA is required for its use of the Services and for completing any assessment required of it as Controller.
NoralIQ will provide reasonable assistance to the Customer where cooperation with the Information Commissioner’s Office or another competent supervisory authority is required in connection with Customer Personal Data processed under this DPA.
Nothing in this DPA prevents NoralIQ from communicating directly with a supervisory authority where NoralIQ is legally required or entitled to do so.
NoralIQ provides functionality that enables Customers to manage information through the Services.
The Customer is responsible for determining what Customer Personal Data is appropriate to collect and process.
NoralIQ will not intentionally require Customer Personal Data beyond what is reasonably necessary to provide the relevant functionality, except where information is required by law or for legitimate security or operational purposes for which NoralIQ acts independently as Controller.
Upon termination of the applicable Services, the Customer may request the return or deletion of Customer Personal Data, subject to functionality available within the Services and applicable legal requirements.
Customer Personal Data will ordinarily remain recoverable for up to 30 days following termination of the applicable Service.
During this period, the Customer may request assistance with the return or deletion of available Customer Personal Data.
Following the recovery period, NoralIQ will schedule Customer Personal Data in the live service for deletion unless:
Where the Customer requests deletion, NoralIQ will delete Customer Personal Data in accordance with its normal secure deletion processes, subject to backup limitations described below.
Customer Personal Data may remain temporarily within backups after deletion from the live Services.
Where immediate deletion from a backup is not technically practicable, the affected information will remain protected and will not ordinarily be restored or otherwise processed except where required for legitimate disaster recovery, security or legal purposes.
Such information will be removed when the relevant backup expires, is overwritten or reaches its applicable deletion cycle.
If a backup containing previously deleted Customer Personal Data must be restored, NoralIQ will take reasonable steps to reapply applicable deletions where appropriate.
NoralIQ will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the UK GDPR.
The Customer may request reasonable information concerning NoralIQ’s processing and security measures.
Where reasonably necessary to demonstrate compliance and where information supplied through documentation is insufficient, NoralIQ will allow for and contribute to an appropriate audit or inspection by the Customer or an independent auditor appointed by the Customer.
Audits must:
The parties will cooperate in good faith to agree appropriate arrangements for an audit.
NoralIQ will provide reasonable assistance required by Applicable Data Protection Law as part of its obligations under this DPA.
Where a Customer requests substantial assistance, bespoke work or an audit beyond the assistance reasonably required for ordinary compliance, NoralIQ may charge reasonable costs associated with that work where permitted by law and agreed with the Customer in advance.
NoralIQ will not charge for assistance where doing so would improperly prevent the Customer from exercising rights or meeting obligations that NoralIQ is legally required to support.
NoralIQ will maintain records and information concerning its processing activities where required by Applicable Data Protection Law.
NoralIQ will periodically review its processing arrangements, relevant Subprocessors and technical and organisational measures as its Services develop.
Liability arising under or in connection with this DPA will be subject to the applicable limitations and exclusions contained within the agreement between NoralIQ and the Customer, except to the extent that such liability cannot lawfully be limited or excluded.
Nothing in this DPA limits either party’s liability where doing so would be prohibited by Applicable Data Protection Law.
This DPA becomes effective when the Customer begins using a NoralIQ Service in circumstances where NoralIQ processes Customer Personal Data on the Customer’s behalf.
It remains in effect for as long as NoralIQ processes Customer Personal Data on behalf of the Customer.
Obligations concerning confidentiality, security, deletion and other provisions that by their nature should continue will survive termination for as long as relevant Customer Personal Data remains in NoralIQ’s possession or control.
NoralIQ may update this DPA where reasonably necessary to reflect changes to Applicable Data Protection Law, regulatory guidance, the Services, Subprocessors or processing arrangements.
The latest version will be published on this page with an updated revision date.
Where a change materially affects the protection or processing of Customer Personal Data, NoralIQ will provide appropriate notice where required by law or the applicable agreement.
This DPA is governed by the laws of England and Wales, subject to any mandatory requirements of Applicable Data Protection Law.
Disputes concerning this DPA will be dealt with in accordance with the dispute and jurisdiction provisions of the applicable agreement between NoralIQ and the Customer.
Questions concerning this DPA or NoralIQ’s processing of Customer Personal Data can be sent to:
NoralIQ
A trading name of Ryan Allen, sole trader
Privacy email: privacy@noraliq.com
Correspondence and legal notices: 124 City Road, London, EC1V 2NX
Information about NoralIQ’s current service providers is available on our Subprocessors page.
Processing of Customer Personal Data as necessary to provide, host, maintain, secure and support the NoralIQ Services subscribed to or used by the Customer.
Processing takes place for the duration of the Customer’s use of the applicable Services and for the limited retention and backup periods described in this DPA following termination.
Processing activities may include:
To provide the functionality of the NoralIQ Services requested by the Customer, including business and operational management, customer and job management, task management, documents and media, AI-assisted functionality, mapping functionality, support, security, backup and related application functionality.
Depending on how the Customer uses NoralIQ, Customer Personal Data may relate to:
Depending on the Customer’s use of NoralIQ, Customer Personal Data may include:
NoralIQ is not designed specifically for the routine processing of special category personal data or criminal offence data unless particular functionality expressly supports such processing.
Customers should avoid entering special category, criminal offence or other unusually sensitive personal data unless it is necessary, lawful and appropriate for their use of the Services.
Where a Customer chooses to process such information through generally available functionality, the Customer is responsible for identifying and satisfying the additional legal requirements applicable to that processing.
Selected sensitive stored values within NoralIQ Field, including sensitive credentials and original filenames, are protected using 256-bit authenticated encryption implemented using PHP Libsodium secretbox, which uses XSalsa20 encryption with Poly1305 authentication.
A unique random nonce is generated for each encrypted value.
The application encryption key is a 256-bit key maintained separately from the application database within the server environment.
Not every database field is individually application-encrypted. General operational information such as customer, job and task information may be stored as ordinary database content and is protected through the wider technical and organisational security measures described in this Schedule.
User passwords are stored using one-way cryptographic password hashing and are not stored in decryptable form.
NoralIQ Field uses Argon2id where available, configured with appropriate memory and computational parameters.
Bcrypt with an appropriate work factor is used as a compatibility fallback where necessary.
HMAC-SHA-256 is used for appropriate keyed signing functions within NoralIQ Field, including signed asset URLs and other security-sensitive identifiers.
Application-level controls are used to help protect against unauthorised manipulation of security-sensitive requests and values.
NoralIQ is configured to use HTTPS to protect information transmitted between users and the Services.
TLS configuration is provided through the underlying hosting infrastructure and is maintained according to the capabilities and configuration of the hosting provider.
NoralIQ does not claim a specific TLS version unless verified against the active infrastructure configuration.
Browser session cookies are configured with appropriate security attributes including:
Session and authentication controls are designed to reduce the risk of unauthorised access to authenticated accounts.
Access to NoralIQ systems and Customer Data is restricted according to operational requirements.
NoralIQ uses account authentication, organisation-level access controls and user permissions to help restrict access to Customer Data.
Customers are responsible for managing authorised users within their own organisation and removing access when it is no longer required.
NoralIQ is designed as a multi-tenant platform with logical separation between customer organisations.
Application controls and tenant-specific data structures are used to restrict one customer organisation from accessing another customer’s application data.
Administrative connection information used to locate and manage tenant environments is subject to appropriate application security controls.
Uploaded files are stored within server storage rather than within application database fields.
Original filenames may be protected using application-level encryption.
Uploaded file contents themselves are not currently individually encrypted by the NoralIQ application before being written to server storage.
Uploaded files are protected through applicable access controls, server security and hosting infrastructure safeguards.
NoralIQ currently uses 20i infrastructure to host the NoralIQ website, applications and associated databases.
Infrastructure-level physical, network, storage and data-centre security measures are provided by the relevant hosting provider.
NoralIQ maintains application-level security responsibilities in addition to those infrastructure protections.
NoralIQ uses security controls including Wordfence to help identify and respond to malicious traffic, unauthorised access attempts and other website security threats.
Security events and technical information may be monitored where reasonably necessary to protect the Services.
NoralIQ maintains backups for recovery and business-continuity purposes.
Backup copies are protected against unauthorised access through appropriate storage and access controls.
Certain backups may be maintained separately from the live production environment.
Backup arrangements will be reviewed as NoralIQ’s infrastructure develops.
Where authorised users invoke AI-assisted functionality within NoralIQ Field, relevant Customer Data may be transmitted to an approved AI service provider for the purpose of performing the requested analysis.
Depending on the feature, this may include text, images, video, audio, speech and related contextual information.
NoralIQ currently uses OpenAI technology for certain AI-assisted functionality.
AI processing is limited to functionality requested through the Services and is subject to applicable contractual and data protection arrangements with the relevant provider.
Where mapping or location functionality is used, relevant requests may be transmitted to the applicable mapping provider.
NoralIQ currently uses Google Maps Platform for certain mapping functionality within NoralIQ Field.
Data transmitted is limited according to the functionality requested and applicable technical implementation.
NoralIQ takes reasonable measures to:
Technical and organisational measures are reviewed periodically and may be updated to respond to changes in technology, identified risks, service architecture and applicable legal requirements.
NoralIQ may replace a particular security mechanism with another mechanism that provides an equivalent or improved level of protection.
