Data processing agreement

Noodell Flow: data processing agreement

Schedule 2 to the terms of service. Version 1.0, effective 13 October 2026.

This agreement is made between Noodell Ltd, a company registered in Scotland with company number SC898178, whose registered office is at 199 Clarkston Road, Glasgow, G44 3BS ("Noodell"), and the Customer as defined in the terms of service. It takes effect when the Customer accepts the terms of service and needs no separate signature. A countersigned copy is available on request from whatsup@noodell.com.

It sets out the terms required by Article 28 of the UK GDPR for Noodell's processing of personal data on the Customer's behalf.

1. Definitions

1.1Customer Personal Data means personal data contained in Your Content (as defined in the terms of service) that Noodell processes on the Customer's behalf in providing the Service.

1.2Sub-processor means a third party engaged by Noodell to process Customer Personal Data.

1.3Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the UK GDPR. Other capitalised words have the meanings given in the terms of service.

1.4UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018. IDTA means the Information Commissioner's International Data Transfer Agreement.

2. Roles

2.1For Customer Personal Data, the Customer is the controller and Noodell is the processor.

2.2Noodell is a separate controller, and this agreement does not apply, for:

(a) account details of the Customer's people (names, email addresses, sign-in records), billing information and support correspondence, which Noodell uses to run the Customer's Account and its own business;

(b) feedback given in answer to Noodell's questions (terms of service, clause 4.7); and

(c) service operation data containing no Customer Personal Data, such as usage counts and spend.

Noodell's Privacy Notice covers that processing.

2.3Annex 1 describes the processing. Annex 2 describes Noodell's security measures. Annex 3 lists the Sub-processors.

3. Noodell's obligations

3.1Instructions. Noodell will process Customer Personal Data only on the Customer's documented instructions, including about international transfers, unless the law requires otherwise; in that case Noodell will tell the Customer before processing unless the law forbids it. The terms of service, this agreement and the Customer's use and configuration of the Service are the Customer's complete instructions. They include instructions to:

(a) host and process Customer Personal Data to provide the Service;

(b) send the emails described in clause 9 of the terms of service to the people the Customer names;

(c) record, stream and transcribe conversations when a person using the Customer's Account chooses to;

(d) create aggregated, anonymised statistics as clause 12.4 of the terms of service describes, unless the Customer has opted out; and

(e) access Customer Personal Data as clause 3.2 below describes.

Noodell will tell the Customer if, in its opinion, an instruction breaks Data Protection Law.

3.2Access by the Noodell team. The Customer instructs and authorises Noodell to access the Customer's Account, and the Customer Personal Data in it, for the purposes of analysing the Customer's processes, preparing Reports, providing support and keeping the Service secure. Every such access:

(a) is limited to the Customer's Account alone and ends automatically no more than one hour after it begins;

(b) requires a reason to be entered, which is recorded;

(c) is recorded, together with each request made during it, in the Customer's own access log, which the Customer can read through the Service at any time; and

(d) is shown on screen by a banner to anyone using the Account while it is happening.

The parties agree that access in accordance with this clause is processing on the Customer's instructions and is not a personal data breach. Noodell will not access Customer Personal Data in any other way except where needed to comply with the law or to investigate and contain a security incident, and will tell the Customer of any such access unless the law forbids it.

3.3Confidentiality. Noodell will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.

3.4Security. Noodell will implement and maintain the measures in Annex 2, which are appropriate to the risk as Article 32 of the UK GDPR requires. Noodell may change them provided the overall level of protection is not reduced.

3.5Data subject requests. Noodell will tell the Customer without undue delay if it receives a request from a data subject about Customer Personal Data, and will not answer it except to refer the person to the Customer. Taking into account the nature of the processing, Noodell will help the Customer, by appropriate technical and organisational measures, to respond to such requests.

3.6Other assistance. Taking into account the nature of the processing and the information available to it, Noodell will give the Customer reasonable help with its obligations under Articles 32 to 36 of the UK GDPR, including security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner. Noodell may charge its reasonable costs for help that goes beyond providing information it already holds, except where the help is needed because of Noodell's own breach.

3.7Records. Noodell will keep the records required by Article 30(2) of the UK GDPR.

4. Personal data breaches

4.1Noodell will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will aim to do so within 48 hours.

4.2The notice will describe, as far as known at the time: what happened; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact for more information. Where not everything is known at once, Noodell will provide the rest in stages without further undue delay.

4.3Noodell will take reasonable steps to contain the breach and limit its effects, and will cooperate with the Customer's investigation. Notifying a breach is not an admission of fault.

5. Sub-processors

5.1The Customer gives Noodell general authorisation to engage Sub-processors. Those listed in Annex 3 are authorised at the date of this agreement.

5.2Noodell will give the Customer at least 30 days' notice by email before adding or replacing a Sub-processor, saying who it is, what it will do and where.

5.3The Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may end the terms of service by written notice before the change takes effect, and Noodell will refund any fees paid for the period after the end date.

5.4Where a Sub-processor must be replaced urgently to keep the Service secure or available, Noodell may give shorter notice, will say why, and the Customer's right in clause 5.3 still applies.

5.5Noodell will put a written contract in place with each Sub-processor that imposes data protection obligations giving at least the same protection as this agreement, and remains liable to the Customer for each Sub-processor's performance.

6. International transfers

6.1Customer Personal Data is stored and processed in the United Kingdom, in Amazon Web Services' Europe (London) region, except as stated in Annex 1 and Annex 3.

6.2Customer Personal Data is transferred outside the UK only to the Sub-processors identified in Annex 3 as processing outside the UK, and only when the features named in Annex 1 are used. Each such transfer is made under a transfer mechanism valid under Data Protection Law, as stated in Annex 3, and Noodell will tell the Customer if that mechanism changes.

6.3The Customer can avoid any transfer outside the UK by not using the features named in Annex 1, except that the Noodell team's analysis (Annex 1) is part of the Service.

7. Audits and information

7.1Noodell will make available to the Customer the information reasonably needed to demonstrate compliance with Article 28 of the UK GDPR.

7.2Documentation first. The parties agree that Noodell meets its obligation to allow for and contribute to audits by:

(a) answering a reasonable written security and data protection questionnaire, once in any 12 months, within 30 days;

(b) the Customer's own access, through the Service, to its access log of every visit by the Noodell team; and

(c) providing copies of Sub-processors' current data processing terms and of any security certification or test report Noodell holds.

7.3If, after that, the Customer reasonably needs more, or a supervisory authority requires it, or there has been a personal data breach affecting the Customer, Noodell will allow an audit by the Customer or an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, no more than once in any 12 months (except after a breach or where a regulator requires it), and without access to other customers' data. The Customer pays its own costs and Noodell's reasonable costs of an audit under this clause, unless it shows a material breach by Noodell.

8. Return and deletion

8.1While the Customer has full or read-only access, it can export its maps and Reports through the Service. On request at any time until deletion, Noodell will provide a complete copy of Your Content in a machine-readable format within 14 days, free of charge.

8.2When the subscription ends the Account is read only for 30 days and then locked. Customer Personal Data is kept, not deleted, so the Customer can come back to it.

8.3Noodell will delete Customer Personal Data:

(a) within 30 days of a written request from the Customer's Admin, at any time; or

(b) otherwise, within 30 days after the end of the 12 months following the end of the Customer's last paid month (or the closure of a free Account),

and will confirm deletion in writing on request, unless the law requires Noodell to keep it, in which case Noodell will tell the Customer and keep it only as long and as far as required.

8.4Some data is deleted sooner whatever the state of the Account: audio recordings and raw transcription output after 30 days, and service logs after 30 days. Database backups are kept for 35 days and are deleted on that cycle; until then they are isolated from active use.

9. Liability and general

9.1Each party's liability under this agreement is subject to the limits and exclusions in clause 22 of the terms of service.

9.2This agreement continues for as long as Noodell processes Customer Personal Data. Clauses 4, 8 and this clause continue after it ends.

9.3If this agreement and the terms of service conflict on a data protection matter, this agreement wins.

9.4This agreement is governed by the law of Scotland, and the courts of Scotland have exclusive jurisdiction.

Annex 1: description of the processing

Subject matter. Providing Noodell Flow to the Customer: mapping, costing and analysing the Customer's business processes, the Noodell team's analysis and Reports, and the jobs and chasing emails that follow.

Duration. For as long as the Customer's Account is open, and afterwards until deletion under clause 8.

Nature and purpose. Collecting, recording, organising, structuring, storing, retrieving, analysing, transcribing, transmitting by email, and deleting Customer Personal Data so that the Customer can map how its processes run, the Noodell team can analyse them and report back, and the people the Customer names can be reminded of jobs agreed from them.

Categories of data subject.

• The Customer's employees, workers and contractors who use Flow, take part in a mapping session or are named in a process map.
• People outside the Customer whom the Customer names: subcontractors, IT contractors, suppliers, clients and other business contacts given jobs through Job Links or mentioned in a map, note or Recording.
• Anyone who speaks in a recorded, streamed or transcribed conversation.

Types of personal data.

Times and rework attributed to a named person can amount to information about that person's performance at work. The Customer decides whether to name people or use roles, and is responsible for telling them.

Special category data. None is intended. The Customer must not enter special category data or criminal offence data (Acceptable Use Policy, clause 2). Flow does not identify people by voice.

Features that send Customer Personal Data outside the UK.

Recording a room or a call, live call transcription, and imported transcripts are processed by Amazon Transcribe in London and do not leave the UK.

Browser speech recognition. The "Chat away" feature uses the speech recognition built into the user's own browser. Noodell does not engage or control the browser provider, which may process the audio under its own terms; it is not a Sub-processor. The Customer can choose not to use it.

What Noodell sees outside the Account. When a map is saved, a summary containing the process name and its headline figures (no names of people, no notes) is copied to Noodell's own operations table so the Noodell team knows a map is ready to analyse. When the Noodell team sends a report, and when the Customer decides yes, not now or no on one of its fixes, the report's dates, each fix's name and yearly figure, each decision and any reason given for it are copied to the same table (no names of people), so the Noodell team can see what was agreed.

Ask Flow. The questions people ask, and the answers, are kept in the Customer's own table with the rest of its data, for the same period, and each person sees only their own. The access record notes that a question was asked, by whom and what it cost, never what it said.

Version history. Every saved version of the Customer's workspace is kept for as long as the Account, so that an earlier version can be read and put back. Putting one back saves a new version and deletes nothing.

Annex 2: technical and organisational measures

Stated as designed and built. Where something is not in place, it says so.

Isolation. Each customer has its own database table, file storage, compute function and access role on AWS. There is no shared customer database, so a fault in one customer's query has no route to another's data.

Location. All storage and processing is in AWS Europe (London), except as stated in Annex 1.

Encryption. TLS 1.2 or higher in transit, HTTPS only. Encrypted at rest in the database and file storage.

Sign-in. Each person with a Seat signs in with a single-use link sent to their own email address, valid for 15 minutes (invitations: 7 days). Sessions are HttpOnly, Secure cookies signed with a secret unique to the customer, last up to 12 hours, and can be revoked. Requests for sign-in links are rate-limited. Passwords, where used, are compared in constant time.

Job Links. Signed with a separate secret, limited to one job, expire after 30 days and stop working when the job is finished, dropped or reassigned. Every action through one is logged.

Least privilege. The compute function serving a customer can reach only that customer's table, storage and named secrets.

Noodell team access. Noodell's administrative console needs a password and an authenticator code, and locks after five failed attempts in fifteen minutes. The console itself cannot read customer data. Access to a customer's Account is by a pass signed with a key only Noodell's platform holds, limited to one customer and one hour, with a reason, logged in the customer's own access log (clause 3.2).

Logging. Significant actions are written to an append-only audit log in the customer's own table. Service logs are kept for 30 days.

Recordings. Uploading or streaming requires a confirmation that everyone has been told, recorded with who and when. Audio is deleted after 30 days.

Backups. Point-in-time recovery on the database, 35 days.

Secrets. Held encrypted in a managed parameter store, per customer, never in source code. Noodell's Anthropic credentials are held server side and are never sent to a browser.

AI services. Noodell has opted out of AWS using customer content to improve its AI services, and Anthropic does not train models on API inputs or outputs.

Not in place at the date of this agreement:

• No SOC 2 report, ISO 27001 certification or Cyber Essentials certification.
• No independent penetration test.
• No multi-factor authentication on customers' own sign-in (it is in place on Noodell's console).

Annex 3: authorised Sub-processors

Checked against each provider's published terms on 13 October 2026.

Copies of each Sub-processor's data processing terms are available on request.