In short
- Nola processes your customers’ personal data only to run booking, payments, and notifications you configure.
- Sub-processors are listed below with primary-source DPA links where available.
- On account closure, customer data is deleted or anonymised per your retention settings (financial records kept 7 years under Estonian law).
1. Subject matter
Nola processes personal data of the provider’s customers (name, contact details, booking history, payment status, messages, consent records) solely to provide the Nola booking and quoting software: publishing services, taking bookings and payments, sending notifications, and running the provider’s day view and reports.
2. Duration & instructions
This DPA runs for as long as the provider has an active Nola account. Nola processes personal data only on the provider’s documented instructions, as configured through the product (services, policies, notification templates). We do not use provider customer data for our own marketing.
3. Confidentiality & security
Access to production data is limited to staff who need it to operate the service, under confidentiality obligations. Data is encrypted in transit (TLS) and at rest by our infrastructure sub-processors. Role-based permissions (Provider → Users) let a provider limit which of their own staff can see client contact details, money, or exports.
4. Sub-processors
The table below is generated from our shared configuration so it always reflects who currently processes data on our behalf. We will give providers reasonable notice of a new sub-processor via Notices. Primary-source DPAs are linked in the table where the vendor publishes one.
| Sub-processor | Purpose | Location |
|---|---|---|
| Convex | Application database, file storage, and backend functions | United States (Convex Inc.) |
| Clerk | Authentication and account identity | United States (Clerk Inc.) |
| Vercel | Application hosting, edge network, and analytics | United States / EU edge (Vercel Inc.) |
| Stripe | Card payment processing for bookings and subscriptions | United States / Ireland (Stripe Inc.) |
| Montonio | Bank-link and instalment payment processing (Baltic payment methods) | Estonia (Montonio Finance OÜ) |
| Messente / Twilio | SMS delivery for booking reminders and notifications | Estonia / United States |
| Resend | Transactional email delivery | United States (Resend Inc.) |
| PostHog | Product analytics and session recordings in the business app | EU, Frankfurt (PostHog Inc.) |
| Google Gemini | AI assistant features (support chat, content suggestions) | United States / EU (Google LLC) |
5. Sub-processing & international transfers
Where a sub-processor is located outside the EEA, transfer relies on Standard Contractual Clauses or an adequacy decision, per that sub-processor’s own DPA (linked above where available).
6. Assisting the controller
Nola gives providers direct tools to meet their own GDPR obligations to their customers: a data-request queue, a per-client consent overview, and configurable retention, all under Provider → Privacy & GDPR after sign-in (same topics as our public Privacy policy). We will assist with a data protection impact assessment or supervisory authority enquiry on reasonable request.
7. Breach notification
We notify affected providers without undue delay, and no later than 48 hours after becoming aware, of a personal data breach affecting their customers’ data, with the information needed for the provider to meet their own 72-hour notification duty to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
8. Deletion on termination
On account closure, provider customer data is deleted or anonymised per the provider’s retention policy, except financial records retained 7 years under Estonian accounting law. A provider can request an export of all their data before closing their account.