This Data Processing Addendum ("DPA") forms part of the agreement between NORJI Ltd ("NORJI", "we", "us", "our", the "Processor") and the customer ("Customer", "you", the "Controller") who subscribes to the NORJI Service (the "Service"). It governs the processing of personal data carried out by NORJI on the Customer's behalf in connection with the Service.
This DPA is issued to comply with Article 28 of the UK General Data Protection Regulation ("UK GDPR") and, where applicable, Article 28 of Regulation (EU) 2016/679 ("EU GDPR"). It supplements, and where it conflicts overrides, the NORJI Terms of Service and Privacy Policy with respect to the processing of Customer Personal Data.
Standalone signature not required.
By accepting the NORJI Terms of Service or by continuing to use the Service after the effective date above, the Customer is deemed to have accepted this DPA. Customers requiring a signed copy may request one at hello@norji.co.uk.
Capitalised terms used in this DPA have the meanings given below. Terms not defined here have the meanings given in the UK GDPR.
For the purposes of this DPA, the Customer is the Controller of Customer Personal Data and NORJI is the Processor. NORJI will process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers of Customer Personal Data outside the United Kingdom or the European Economic Area, unless otherwise required by applicable law.
Where NORJI processes personal data of its own users for its own purposes — for example, account creation, billing, or website analytics — NORJI acts as a Controller. Such processing is governed by the NORJI Privacy Policy and falls outside the scope of this DPA.
The subject matter, duration, nature, purpose, types of personal data, and categories of Data Subjects covered by this DPA are described in Annex A (Processing Details). The duration of processing is for the term of the Customer's subscription to the Service, plus any retention periods set out in the NORJI Privacy Policy or required by applicable law.
NORJI will process Customer Personal Data only on the Customer's documented instructions. The Customer's documented instructions are the NORJI Terms of Service, this DPA, the configuration and use of the Service by the Customer (including the commands the Customer or its authorised users send to the Service), and any further written instructions agreed between the parties.
NORJI will inform the Customer if, in its opinion, an instruction infringes the UK GDPR or other applicable data protection law.
NORJI will:
NORJI will treat Customer Personal Data as confidential and will not disclose it to any third party except (a) to Sub-processors engaged in accordance with Section 7, (b) where required by law (in which case NORJI will, where lawfully permitted, notify the Customer in advance), or (c) with the Customer's prior written authorisation.
The Customer authorises NORJI to engage Sub-processors to process Customer Personal Data, subject to the conditions set out in this Section.
NORJI currently engages the following Sub-processors. This list is also maintained in the NORJI Privacy Policy.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic, PBC | AI language model processing — command understanding, drafting, classification | USA | Standard Contractual Clauses (SCCs) and the UK Addendum. Anthropic Privacy Policy |
| OpenAI, L.L.C. | Supplemental AI language and embeddings processing where used | USA | Standard Contractual Clauses (SCCs) and the UK Addendum. OpenAI Privacy Policy |
| Stripe Payments Europe, Ltd. | Subscription billing, payment processing | Ireland (with parent operations in the USA) | UK adequacy decision / Standard Contractual Clauses. Stripe Privacy Policy |
| Vercel Inc. | Website and edge function hosting | USA / EEA | Standard Contractual Clauses (SCCs). Vercel Privacy Policy |
| Railway Corp. | Backend API hosting | USA | Standard Contractual Clauses (SCCs). Railway Privacy Policy |
| Telegram FZ-LLC | Message delivery interface between Customer's authorised users and the NORJI bot | UAE / distributed | Telegram's data processing terms. Telegram Privacy Policy |
No-training contracts. NORJI uses Anthropic's and OpenAI's enterprise APIs under contracts that prohibit the use of Customer Personal Data to train, retrain, or improve their general-purpose models. Customer Personal Data submitted via the Service is not added to any AI training dataset.
Before engaging any Sub-processor, NORJI will enter into a written contract with the Sub-processor that imposes data protection obligations no less protective than those set out in this DPA. NORJI remains liable to the Customer for any failure by a Sub-processor to fulfil its data protection obligations.
NORJI will give the Customer prior written notice (by email to the account holder, or by a notice on this page) of the addition or replacement of any Sub-processor, including details of the processing to be undertaken. The Customer may object to the change on reasonable data protection grounds within 14 days of the notice. If the Customer reasonably objects and the parties cannot agree a resolution, the Customer may terminate the affected portion of the Service without penalty.
Taking into account the nature of the processing, NORJI will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for the exercise of Data Subject rights under the UK GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).
If a Data Subject contacts NORJI directly with a request relating to Customer Personal Data, NORJI will (unless legally required to respond) refer the Data Subject to the Customer and notify the Customer of the request without undue delay.
The Customer is responsible for verifying the identity of the Data Subject and for the substantive response. NORJI may charge for assistance that is excessive or repetitive, on a time-and-materials basis at standard rates.
NORJI implements and maintains appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. The current measures are described in Annex B. NORJI may update these measures from time to time, provided the level of security is not materially decreased.
NORJI will, on the Customer's written request and no more than once in any 12-month period (except where required following a Personal Data Breach or by a competent supervisory authority), make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. This may include responses to a written security questionnaire, copies of relevant third-party audit reports (where available under confidentiality), and a written description of the technical and organisational measures.
Where the information made available is not reasonably sufficient and the Customer wishes to conduct an on-site audit, the Customer may do so with at least 30 days' written notice, at a mutually agreed time, during normal business hours, subject to NORJI's reasonable confidentiality and security requirements, and at the Customer's cost. The audit will not unreasonably interfere with NORJI's operations.
NORJI will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent then known:
Where complete information is not available at the time of initial notification, NORJI will provide updates as soon as reasonably possible. Notification of a Personal Data Breach is not in itself an admission of fault or liability by NORJI.
To the extent that NORJI or any Sub-processor transfers Customer Personal Data outside the United Kingdom or the European Economic Area, NORJI will ensure that such transfers are made subject to an appropriate transfer mechanism under the UK GDPR or the EU GDPR, including:
The transfer safeguards for each Sub-processor are listed in Section 7.1.
On termination or expiry of the Customer's subscription to the Service, NORJI will, at the Customer's choice and as set out in the NORJI Privacy Policy:
NORJI may retain Customer Personal Data to the extent and for the period required by applicable law (for example, financial and tax records). Any such retained data will continue to be protected by the security measures described in this DPA and will be deleted as soon as the legal basis for retention ends.
The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the NORJI Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable law.
In the event of a conflict between this DPA and the NORJI Terms of Service, this DPA prevails in respect of the processing of Customer Personal Data. In the event of a conflict between this DPA and any Standard Contractual Clauses incorporated by reference, the Standard Contractual Clauses prevail.
NORJI may update this DPA from time to time. Where a change materially reduces the protection afforded to Customer Personal Data, NORJI will give the Customer at least 30 days' prior written notice. The current version will always be available at norji.co.uk/dpa.
Data Protection contact
NORJI Ltd
Email: hello@norji.co.uk
Subject line: "DPA enquiry"
NORJI has not appointed a statutory Data Protection Officer at present, as it is not required to do so under Article 37 UK GDPR. The contact above is the designated point of contact for data protection matters.
The provision of the NORJI Service to the Customer, including the receipt and processing of commands, the drafting and surfacing of communications, the analysis of pipeline and compliance signals, and the integration with the Customer's connected accounts (e.g. Gmail, Google Calendar, Microsoft 365, where applicable).
The term of the Customer's subscription to the Service, plus any retention periods set out in the NORJI Privacy Policy or required by applicable law.
Hosted software-as-a-service for property professionals — the receipt of natural-language commands via Telegram (and additional channels as released), processing those commands using AI language model providers under no-training contracts, drafting communications and surfacing operational signals, and storing the resulting outputs in the Customer's isolated account.
The Service is not intended to process special category personal data (Article 9 UK GDPR) or personal data relating to criminal convictions and offences (Article 10 UK GDPR). The Customer agrees not to submit such data to the Service except where strictly necessary, lawful, and on the Customer's own established lawful basis.
NORJI implements the following technical and organisational measures, which it may update from time to time provided the level of security is not materially decreased.
— End of DPA —