Data Processing Agreement

Version 1, October 2026

For business customers who use Nolario for their company and need a contract under Art. 28 GDPR. Print it or save it as PDF, fill in your details, sign it and send it to support@nolario.com. We countersign and send it back.

Print or save as PDF

Parties

Controller (“Customer”):  , address  

Processor (“Nolario”): Matteo Cacic, Dr.-Ambros-Giner-Weg 13a, 6065 Thaur, Austria, support@nolario.com

1. Subject and duration

Nolario processes personal data on behalf of the Customer in order to provide the Nolario service under the Terms of Service (the “Main Contract”). This agreement runs as long as the Main Contract. Annex 1 describes the processing.

2. Instructions

Nolario processes the data only on the Customer’s documented instructions, which are the Main Contract, this agreement and the settings the Customer makes in the app, unless Union or Member State law requires otherwise; in that case Nolario informs the Customer beforehand unless that law forbids it. Nolario tells the Customer without delay if it believes an instruction infringes data protection law.

3. Confidentiality

Everyone authorised by Nolario to process the data is bound to confidentiality. Nobody at Nolario reads the Customer’s messages unless the Customer asks for it (for example in support), it is necessary for security, or the law requires it.

4. Security

Nolario takes the technical and organisational measures in Annex 2 (Art. 32 GDPR) and may improve them; it will not lower their overall level.

5. Sub-processors

The Customer gives general authorisation to the sub-processors listed at nolario.com/privacy/subprocessors (Annex 3). Nolario informs the Customer at least 30 days before adding or replacing one; the Customer may object on reasonable data protection grounds and, if no solution is found, terminate the Main Contract. Nolario imposes the same data protection obligations on every sub-processor and remains responsible for it.

6. Transfers outside the EU

Several sub-processors process data in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses, as set out in section C of the privacy policy.

7. Assistance

Nolario helps the Customer, as far as it can, to answer requests from data subjects (Art. 12 to 22 GDPR) and to meet its obligations under Art. 32 to 36 GDPR. The app already offers export and deletion of all data (Settings → Data & privacy). Requests a data subject sends to Nolario directly are forwarded to the Customer.

8. Personal data breaches

Nolario notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data, with the information the Customer needs for its own notification.

9. End of processing

When the Main Contract ends, the Customer can export its data in the app. Nolario deletes the data within 30 days after the account is deleted, unless law requires it to be kept (for example invoices, which Stripe holds for 7 years).

10. Information and audits

Nolario makes available the information needed to demonstrate compliance with Art. 28 GDPR. It allows audits by the Customer or an auditor bound to confidentiality, with at least 30 days’ notice, during business hours and at most once a year, unless a breach gives cause for more. Each party bears its own costs.

11. Final provisions

In data protection matters this agreement takes precedence over the Main Contract. Liability follows Art. 82 GDPR and the Main Contract. Austrian law applies. Changes need text form.

Annex 1: Description of the processing

• Purpose and nature: receiving, storing, ranking, summarising and searching messages, calendar entries, tasks and files from the accounts the Customer connects; drafting replies on request; the Customer’s memory (facts Nolario learns, visible and editable in the app).
• Types of data: names, email addresses and other contact details, message content and metadata, calendar entries, files, and any personal data contained in them, which may include special categories if they appear in the Customer’s messages.
• Data subjects: the Customer’s users, and the people they correspond with (employees, customers, suppliers, other contacts).

Annex 2: Technical and organisational measures

• All connections encrypted with HTTPS/TLS.
• Access keys to connected accounts, IMAP passwords, search excerpts and the input of background AI tasks encrypted in the database (AES-256-GCM).
• Data only the server may read (two-factor secret, usage counters, memory) kept where no browser can reach it; data the browser writes is limited by database rules to the user’s own records.
• Two-factor sign-in available; passwords stored only as a hash by Google Firebase.
• Before message content goes to an AI provider, a filter chain removes secrets and replaces names and contact details with placeholders; if the filter fails, the request is not sent. Its limits are listed in section B4 of the privacy policy.
• AI providers process data under their API terms, which exclude training on it.
• Error logs record warnings and errors only; deletion and export of all data available in the app.
• Sub-processors bound by data processing agreements (Annex 3).

Annex 3: Sub-processors

The current list, with purpose, data, location and retention: nolario.com/privacy/subprocessors.

Signatures

Customer: place, date  
Name, signature  

Nolario: place, date  
Matteo Cacic, signature