Data processing agreement

Last updated 4 November 2026

This agreement covers the personal data Nollby Service handles for your business: your clients and their bookings. You are the controller and we are your processor, under Article 28 of the GDPR. It is part of the terms, and you accept it when you create a business on Nollby Service.

The parties

The controller is the business that uses Nollby Service: you. The processor is:

Subject and duration

We process personal data so that clients can book your business and you can run your bookings in Nollby Service. The agreement applies as long as your business account exists, and after that until we have returned or deleted the data.

Nature and purpose

• Storing and showing your bookings, quote requests and client list.
• Sending confirmations, reminders, quotes and other booking emails to your clients for you.
• Creating payment pages and refunds on your own Stripe account.
• Keeping RUT and ROT details for your claim, and exporting them for you.
• Importing and exporting clients and bookings when you ask for it.
• Protecting the data: access control, logs and backups.

We use the data only for this, never for our own purposes. Reviews and a client's own Nollby Service account are ours to answer for, under our privacy policy.

Types of personal data

• Contact details: name, email and phone.
• Address, postcode and town, for jobs at the client's place.
• Bookings: service, time, staff member, price, deposit, payment status and language.
• Messages and notes, client notes and tags, and quote descriptions and photos.
• For RUT and ROT: personal identity number (encrypted), property designation, the housing association's organisation number and the flat number.
• Payment references from Stripe. Card details never reach us.

Clients can write anything in a message, for example about an allergy, which is health data. Ask clients only for what you need. We protect messages like all other booking data.

Whose data

• People who book you or ask you for a quote.
• Clients you add or import yourself.
• Your staff, as far as their names and calendars are in Nollby Service.

Your instructions

We process the data only on your documented instructions: the terms, this agreement and what you do in the app. If we think an instruction breaks data protection law, we tell you. If the law requires us to process data in another way, we tell you first, unless the law forbids it.

You also instruct us to do what Nollby Service does for every business: when a client deletes their Nollby Service account, we remove their name and contact details from their bookings with you, and we delete RUT and ROT details after 1 March the year after the booking.

Our obligations

• Confidentiality: only people who need access to run the service can reach the data, and they are bound to keep it confidential.
• Security: all traffic is encrypted. Personal identity numbers are also encrypted in the database, with the key kept apart. Each business reaches only its own data. Sign-in uses one-time codes, so there are no passwords to leak. Every view and export of personal identity numbers is logged. Forms are protected against bots and floods. The database and files are kept in the EU.
• Requests from clients: you can see, correct, export and erase a client yourself in the app. If a client asks us, we pass the request to you, and we help with anything the app can't do.
• Your other obligations: we help you with security, personal data breaches, impact assessments and consulting the supervisory authority, as far as our part of the processing goes.

Sub-processors

You give us general permission to use sub-processors. These are the ones we use now:

• Cloudflare Cloudflare, Inc. (United States)

  What for

  Runs the website, the app and the database, stores files and photos, checks that forms come from people (Turnstile), stops floods of requests and keeps logs.

  Data

  Everything stored in Nollby Service, and the IP address and browser details of each visit.

  Where

  The database and files are kept in the EU. Each visit passes the nearest Cloudflare data centre, and logs and bot checks can be handled outside the EU, including in the USA.

• Resend United States

  What for

  Sends our emails: sign-in codes, booking confirmations and reminders, quotes, and messages to businesses.

  Data

  The recipient's email address and what the email says, such as names, booking details and links.

  Where

  USA.

• Stripe Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States)

  What for

  Takes payment for businesses' plans, and takes online payments and makes refunds for bookings on the business's own Stripe account.

  Data

  For plans: the business's name, email and payment details. For bookings: the client's email, the service, the amount and a booking reference. Card details go straight to Stripe and never reach us.

  Where

  The EU (Ireland), with access from the USA.

Each one is bound by a data processing agreement with the same data protection obligations as ours, and we remain responsible to you for them. We email you at least 30 days before we add or replace a sub-processor. If you object and we can't solve it together, you can end the agreement before the change.

Transfers outside the EU and EEA rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses, as described in the privacy policy.

Personal data breaches

If we find a breach that affects your data, we tell you without undue delay: what happened, which data and clients are affected, the likely consequences and what we are doing about it. We send more as we learn more. You decide whether to report it to the authority and tell your clients, and we help.

When the agreement ends

You can export your bookings, your RUT and ROT details and each client's data in the app at any time. When the agreement ends, tell us at hej@nollby.com whether we should return the data or delete it, and we do it within 30 days. Deleted data then leaves the database's restore history within another 30 days. Until you tell us, the data stays in your account. We keep data only where the law requires us to.

Audits

We give you the information you need to show that we keep this agreement. You, or an auditor bound by confidentiality, may also inspect how we process your data. Ask us at hej@nollby.com and we agree on a time and scope.

Other

Where this agreement and the terms differ on personal data, this agreement applies. Questions: hej@nollby.com or +46 72 013 14 76.