Data Processing Agreement

Last updated: 22 September 2026

This Data Processing Agreement ("DPA") forms part of the agreement between an Artist ("Controller", "you") and [Noori Pro - US company registration pending incorporation] ("Processor", "we") governing our processing of personal data belonging to your Clients on your behalf. It applies automatically when you use noori pro and is incorporated into our Terms & Conditions by reference; no separate signature is required, though we will countersign a copy on request for your own compliance records.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Sub-processor" have the meanings given in UK GDPR. "Client Data" means personal data of your Clients that we process on your behalf, on your instructions, through the noori pro platform.

2. Roles & Scope

You are the Controller of Client Data. We are the Processor for the specific activities of storing an inquiry you receive, presenting it to you, enabling you to respond to it, and calendar/booking management built on that inquiry, and we act only on your documented instructions for those activities as set out in this DPA.

For a limited set of activities involving Client Data that we carry out for our own purposes - platform security logging, fraud and abuse detection, our own support correspondence with a Client who contacts us directly, and legal/compliance record-keeping - Noori Pro acts as an independent Controller rather than your Processor. Those activities are governed by our Privacy Policy, not this DPA, and are outside its scope.

3. Subject Matter, Duration & Nature of Processing

4. Our Obligations as Processor

We will:

• Process Client Data only on your documented instructions, as embodied in the Service's normal operation, unless required otherwise by law (in which case we will tell you, unless prohibited from doing so)
• Ensure people authorised to process Client Data are subject to confidentiality obligations
• Implement the technical and organisational security measures set out in Schedule 1 below
• Notify you without undue delay after becoming aware of a Client Data breach
• Assist you, at your reasonable cost, in responding to Data Subject requests concerning Client Data, and in meeting your own obligations relating to security, breach notification, and data protection impact assessments
• Delete or return Client Data at the end of our engagement, per our Data Retention & Deletion Policy, unless we are required by law to retain it
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits by you or your appointed auditor on reasonable notice, subject to confidentiality

5. Sub-processors

You authorise us to engage the sub-processors listed on our Subprocessors page, each bound by data protection terms no less protective than this DPA. We remain fully responsible to you for each sub-processor's performance of its data-protection obligations, to the same extent as if we performed those services ourselves. We will update that page before engaging a new sub-processor and, if you have told us you want advance notice, will notify you so you may object on reasonable data-protection grounds.

6. International Transfers

Where Client Data originating in the UK is transferred to a sub-processor outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another lawful UK transfer mechanism, under our contract with that sub-processor. Where EEA-originating data is involved, the underlying EU Standard Contractual Clauses apply.

7. Your Obligations as Controller

You are responsible for having a lawful basis to collect and process Client Data, for the accuracy of any instructions you give us, for your own Client-facing privacy notice where required by law, and for ensuring your use of the Service complies with applicable data protection law.

8. Liability

Liability under this DPA is subject to the limitations of liability in our Terms & Conditions.

9. Term

This DPA takes effect when you start using the Service and continues until your account is closed and Client Data is deleted or returned in accordance with Section 4.

10. Contact

Questions, or to request a countersigned copy of this DPA: hello@noori.pro.

Schedule 1 - Technical & Organisational Measures

We maintain measures across the following categories. Consistent with our Security & Breach Notification page, this schedule describes measures at a level appropriate for a public document; Artists may request further detail under confidentiality.

• Access control - role-based access to production systems, limited to personnel who need it; Row Level Security so an Artist can only access their own data
• Encryption - TLS/HTTPS in transit across the platform; encrypted storage at rest via our database infrastructure
• Authentication - hashed credentials, never stored or logged in plain text; bot/abuse protection (CAPTCHA) on authentication forms
• Backups - rolling backups retained up to 35 days for disaster recovery
• Vulnerability & dependency management - regular platform and dependency updates to address known vulnerabilities
• Incident response - a documented internal process for triaging, containing, and notifying affected parties of a security incident (see our Security page for the notification commitments this process is built to meet)
• Personnel - confidentiality obligations on anyone with access to Client Data; access limited to what a role requires
• Deletion - data deleted or anonymised per our Data Retention & Deletion Policy, including from backups within a bounded window
• Supplier security - subprocessors are engaged only under data processing terms requiring equivalent safeguards, per Section 5 above