Nory Standard Terms & Conditions

Last updated
August 05, 2025

1. Introduction

  • These standard terms and conditions ("General Terms") are entered into by and between Hospitality Growth Services Limited, incorporated and registered in Ireland with company number 650310 whose registered office is at 3rd Floor, The Boat House, Bishop Street, Dublin 8, D08 H01F, Ireland ("Nory") and the entity or person that purchases the services (the "Customer"). The order form constitutes an offer by the Customer to purchase a subscription to the software and/or professional services relating to implementation, integration and/or consulting which may be described in the order form (the "Services") in accordance with the General Terms and the order form shall only be accepted when Nory issues written acceptance of the order form. The order form and the General Terms (together the "Agreement") shall govern the provision of the Services, and the Customer agrees to be bound by this Agreement.
  • This Agreement applies to the exclusion of any other terms that the Customer seeks to impose or incorporate, or which are implied by law, trade custom, practice or course of dealing. The Customer waives any right it might otherwise have to rely on any term endorsed upon, delivered with or contained in any documents of the Customer that is inconsistent with this Agreement. Any terms and conditions included in any purchase order, acknowledgement or other document issued by the Customer shall be deemed rejected and not be binding on the parties unless explicitly agreed in writing by Nory.
  • Any quotation or proposal given by Nory shall not constitute an offer and is only valid for the period of time stated on the quotation or proposal. Any advertising, illustrations or descriptions contained in Nory's materials are issued or published for the sole purpose of giving an approximate idea of the Services described in them and shall not form part of this Agreement.

2. Services

  • The Customer is entitled to use the components and integrations purchased by the Customer as specified in the order form. If the Customer wishes to add further components or integrations at any time, the parties shall agree to an amended or new order form and it shall be subject to the terms and conditions of this Agreement unless otherwise specified.
  • The Customer is aware that the Services may be updated and/or enhanced during the term of this Agreement and as such the look, feel, usability, and features may change during the Term.
  • The Customer shall not:
    • (a) except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties and except to the extent expressly permitted under this Agreement (i) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services (as applicable) in any form or media or by any means or (ii) attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services;
    • (b) access all or any part of the Services in order to build or provide a product or service which competes with the Services;
    • (c) use the Services to provide services to third parties other than as provided under this Agreement;
    • (d) license, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Services available to any third party; or
    • (e) attempt to obtain, or assist third parties in obtaining, access to the Services, other than as provided under this Agreement.
  • Nory will maintain commercially reasonable administrative, physical, and technical safeguards for protection of the security, confidentiality, and integrity of Customer Data. Those safeguards will include, but will not be limited to, measures designed to prevent unauthorized access to or disclosure of Customer Data (other than by Customer or Users). The terms of the DPA set out in Schedule 2 form a part of this Agreement and shall apply to the extent Customer Data includes Personal Data.

3. Intellectual Property Rights

  • The Customer acknowledges that all intellectual property rights in the Services are owned by Nory and the Customer shall have no rights in the Services other than as provided for in this Agreement.
  • Nory grants to the Customer a non-exclusive, non-transferable, non-sublicensable license for the term of the Agreement to use the Services solely for its internal business purposes and in accordance with the terms of this Agreement.
  • In the course of this Agreement, Nory may create or use enhancements, discoveries, processes, methods, designs, software code and know-how, whether or not copyrightable or patentable, which Nory conceived or Customer suggested while working with the Customer during the course of its ongoing business activities. In addition, Nory may independently develop enhancements, processes, methods, designs or know-how during the term of this Agreement. The parties mutually acknowledge that Nory shall own all right, title and interest in and to such enhancements, processes, methods, designs, and know-how including without limitation the intellectual property rights relating thereto, and may use such enhancements, processes, methods, designs and know-how in their business operations with other customers, without limitation. Nory shall own all intellectual property developed or created during this Agreement, including but not limited to all code developed for the Customer.
  • The Customer owns the intellectual property rights in any data in any form submitted by, or on behalf of, Customer ("Customer Data") to Nory The Customer grants Nory a non-exclusive, worldwide, perpetual, irrevocable, royalty-free right to copy and publish de-identified data generated by the Services for Nory's internal business purposes (including training its proprietary AI models) and sales activities.
  • Customer grants Nory a worldwide, limited-term license to host, copy, use, transmit, and display Customer Data as required for Nory to provide and ensure proper operation of the Services and associated systems in accordance with this Agreement and the right to use their name, trademark, and logo for the purpose of co-marketing the Customer's success with the Services, subject to the Customer's trademark use guidelines. This includes allowing Nory to reference the Customer as a client in sales pitches, on the Nory website, and in other marketing materials.

4. Co-Marketing

  • The Customer agrees to collaborate with Nory on co-marketing initiatives designed to promote the successful use of the Services. Such co-marketing activities may include, but are not limited to, the development of case studies, press releases, testimonials, joint presentations, webinars and collaborative content such as blog posts and white papers.
  • Within a reasonable timeframe (three (3) months from go-live) after the effective start date of the use of the Services, both parties agree to participate in a case study showing the Customer's use of the Services, the benefits received and any quantifiable results related to performance improvement, efficiency gains and other relevant metrics. The specific details of the case study will include:
    • (a) a summary of the Customer's business needs and challenges prior to using the Services;
    • (b) a description of the solution provided by Nory and how it was implemented;
    • (c) discussion of any tangible benefits the Customer has experienced as a result of using the Services, including relevant data and metrics;
    • (d) a testimonial from the Customer regarding their experience with the Software and services provided by Nory; and
    • (e) high-resolution images or logos from the Customer for use in the case study (subject to the Customer's branding guidelines).
  • Both parties agree to review and approve the content of the case study before its publication. The Customer grants Nory the right to use the case study in its marketing efforts, including but not limited to distribution on Nory's website, social media channels, and sales collateral. Nory agrees to provide the Customer with a copy of the finalised case study for their own use in marketing and promotional efforts.

5. Term and Termination

  • This Agreement takes effect on the date of the last signature of the applicable order form and shall continue from the initial subscription date set out in the applicable order form for a minimum of twelve (12) months and shall be subject to successive automatic renewals unless notice is received ninety (90) days in advance of the renewal date (the "Term").
  • Either party may terminate this Agreement if:
    • (a) the other party commits a material breach of this Agreement and fails to cure such breach within thirty (30) days of being notified of such breach; or
    • (b) the other party becomes, is declared to be, or is taken under any applicable law to be insolvent, an insolvent under administration, bankrupt, unable to pay its debts, unable to proceed with this Agreement for financial reasons, or anything analogous to the foregoing in any jurisdiction. Nory may terminate this Agreement if the Customer fails to make any payment due under this Agreement within fifteen (15) days of the due date for such payment, provided that Nory has given the Customer written notice of such non-payment and the Customer has failed to make the required payment within ten (10) days of receiving such notice.
  • Upon termination of the Agreement, Nory will terminate the Customer's access to the Service and all rights to use the Services terminate immediately. Save where Nory terminates this Agreement in accordance with Section 5.2 above, Nory will, at the Customer's cost, provide the Customer an export of the Customer's Data in a commonly used format.
  • If this Agreement is terminated by Customer in accordance with Section 5.2 above, Nory will refund Customer any prepaid fees covering the remainder of the term of all order forms after the effective date of termination. If this Agreement is terminated by Nory in accordance with Section 5.2 above, Customer will pay any unpaid fees covering the remainder of the term of all order forms to the extent permitted by applicable law. In no event will termination relieve Customer of its obligation to pay any fees payable to Nory for the period prior to the effective date of termination.

6. Implementation

  • Nory shall provide the Customer with an implementation plan, including estimated timelines, key milestones and a list of information or resources required from the Customer.
  • If implementation does not commence on the implementation start date or is materially delayed due to the Customer's failure to provide the required information, fulfil its responsibilities or as a result of changes requested by the Customer, the Customer shall be obliged to pay the subscription fees from the implementation start date, regardless of whether implementation has commenced and Nory may, at its discretion, charge additional fees on a pro rata basis from the scheduled implementation start date for the period of delay and/or for the preparation of a revised implementation plan.
  • Where any professional services relating to implementation are specified in an order form, the implementation start date for such services shall be as set out in the relevant order form.
  • Each time a new location or integration is added, the fees payable by the Customer under the applicable order form shall increase. The scope of work included with the implementation shall be set out in the applicable order form.
  • If a component or integration is cancelled and then subsequently reactivated, the implementation fee shall be due at the time of reactivation.

7. Training and Support

  • Customer shall receive unlimited access to the on-line training videos for each component and feature of the Services. Additional live training via web-conferencing will be scheduled for select components/features after the Customer has completed viewing all applicable on-line training videos.
  • If the Customer has additional questions or clarifications regarding the Services after watching the training videos, and attending live training, they may request additional remote (i.e. online) training services and there may be an additional cost for such training. It is not the responsibility of Nory to train all new users of the system when they are added to the system nor to respond to all training requests.
  • Nory will, as part of the Services and at no additional cost to the Customer, provide Nory's standard support services as set out in Nory's service level agreement (the "SLA") in Schedule 1 below and Nory may amend the SLA in its sole and absolute discretion from time to time.

8. Customer Responsibilities

  • The Customer is responsible for:
    • determining whether the Services will achieve the results the Customer desires
    • procuring, installing, and operating the user computers, hardware, printers, communications lines, and operating systems required for its use of the Services
    • providing a proper environment and proper utilities for the Customer's computers on which the Services operates
    • adopting procedures to ensure the accuracy of input data
    • examining and confirming results prior to use
    • providing a project manager who will coordinate communication and activities, make or facilitate making decisions during the implementation process, and post-implementation
    • providing Nory with all necessary co-operation and access to such information, materials and assistance as may be reasonably required by Nory in order to provide the Services, including but not limited to Customer data, security information, source files and the timely completion of assigned tasks in connection with implementation
  • The Customer shall carry out all other Customer responsibilities set out in this Agreement in a timely and efficient manner. In the event of any delays in the Customer's provision of such assistance as agreed by the parties, Nory may adjust any agreed timetable or delivery schedule as reasonably necessary and Nory shall not be liable for any failure to deliver any or all of the Services to the extent caused by the Customer's delay.
  • The Customer is responsible for ensuring that the operating software on each workstation is on a currently supported version from the maker. No support will be given to troubleshoot errors on workstations that are not on a currently supported version of software.

9. Payment

  • Customer will pay all fees, and Nory will invoice Customer, in accordance with the relevant order form. Except as otherwise specified herein or in an order form, payment obligations are non-cancellable and fees paid are non-refundable.
  • If an order form provides for payment of professional services fees on:
    • (i) a fixed price basis, Nory will invoice Customer for work performed as set forth in such order form or
    • (ii) a time and materials ("T&M") basis, the professional services shall be provided at the T&M rates as specified in such order form. On a T&M engagement, if an estimated total amount is stated in the applicable order form, that amount is solely a good faith estimate and not a guarantee that the professional services will be completed for that amount; the actual amount may be higher or lower. If the estimated amount is expended, Nory will notify Customer and Customer shall provide prior written consent before Nory shall continue to provide professional services on a T&M basis under the same rates and terms.
  • The Customer will begin paying the subscription fees as outlined in the order form at the point of contract signing. Nory will not commence providing any Services unless the Customer has paid the fees due as set out in the order form. If during the term the Customer fails to pay any fees when due (except with respect to charges then under reasonable and good faith dispute), Nory may, without limiting its other rights and remedies, immediately suspend the Services to the Customer until such amounts are paid in full. If such failure to pay has not been cured within thirty(30) days of the due date, then upon written notice Nory may terminate this Agreement and all outstanding order forms.
  • Nory's fees exclude any taxes, levies, duties, or similar governmental charges (collectively, "Taxes"). The designated taxpayer, as per applicable laws, shall bear and pay these Taxes. If Nory is legally required to pay or collect Taxes for which the Customer is responsible, Nory will invoice the Customer, who must then pay the amount unless a valid tax exemption certificate is provided.

10. Confidentiality

  • Confidential Information refers to non-public information that the disclosing party marks as confidential or which, given the context of its disclosure, should reasonably be considered confidential ("Confidential Information"). This includes, but is not limited to:
    • details about the disclosing party's software or hardware products, such as source code, API data files, documentation, specifications, databases, networks, system designs, file layouts, tool combinations, and development methods
    • information related to the disclosing party's business or financial matters, including business methods, marketing strategies, pricing, competitor information, product development strategies and methods, customer lists, and financial results
    • information received from third parties that the disclosing party is required to keep confidential
    • oral information identified as confidential by the disclosing party
    • information disclosed by a subsidiary or agents of the disclosing party
    • all tangible materials containing such information, whether in written or printed documents, computer disks, or tapes, whether user or machine-readable
  • Confidential Information does not include information that:
    • (a) is already known to the receiving party;
    • (b) becomes publicly known through no wrongful act of the receiving party;
    • (c) is received from a third party without any confidentiality restrictions; or
    • (d) is approved for release by prior written authorisation from the disclosing party.
  • The parties agree to keep the Confidential Information confidential and to protect it as a trade secret by preventing any unauthorised copying, use, distribution, installation, or transfer of possession. Specifically, neither party shall allow its personnel to remove any proprietary or restrictive notices included in any material provided by the disclosing party, nor shall the receiving party permit its personnel to reproduce or copy such material except as expressly authorised under this Agreement. Each party may only use Confidential Information to fulfil its obligations under this Agreement.
  • Both parties acknowledge that any unauthorised use or disclosure of the other party's Confidential Information may cause irreparable harm, for which remedies other than injunctive relief may be inadequate. Therefore, both parties agree that the non-disclosing party may seek injunctive or other equitable relief to prevent such unauthorised use or disclosure. The parties recognise that the disclosure of Confidential Information could result in irreparable damage to the party whose information is disclosed.
  • The terms and provisions of this Section 10 shall survive any termination of the Agreement.

11. Data Protection

  • Where Customer data includes personal data which Nory processes as a data processor, the provisions of the data processing agreement in Schedule 2 shall apply.

12. General Warranty Disclaimer

  • Nory makes and the Customer receives no warranties, express, implied, or statutory, except as expressly set forth herein. The Services is provided "as is," without warranty of any kind, either express or implied, including without limitation, any warranties concerning the availability, accuracy, usefulness, or content of information, products or services or any warranties of merchantability or fitness for a particular purpose.
  • The Customer acknowledges that data transmission and storage is subject to the likelihood of human and machine errors, omissions, delays, and losses, including inadvertent loss of data or damage to media, that may give rise to loss or damage. In addition, the Customer agrees that Nory does not represent that the Services will be uninterrupted, without omissions, or error free.

13. Third Party Applications

  • Under this Agreement, Nory may:
    • (i) make available software applications or services provided by a third party vendor other than Nory ("Third Party Applications") and
    • (ii) provide support services for the Third Party Applications for which the Customer has a valid license or right to use. Nory does not license the Third Party Applications to the Customer directly. Nory provides services to facilitate the Customer entering into agreements directly with Third Party Application vendors and this is known as "reselling". The Customer's use of the Third Party Application is subject always to compliance with the relevant Third Party Application vendor's terms and conditions. Any Third Party Applications and any exchange of data between Customer and any Third Party Application vendor is solely between Customer and the applicable Third Party Application vendor. Nory will not be liable for any issues arising from the use of a Third Party Application with the Services. Customer will remove or cease integration with a Third Party Application if required in order to avoid violating applicable law or third-party rights. If Customer does not take required action in accordance with the above, or if in Nory's reasonable judgment continued violation is likely, Nory may disable the applicable Service and/or integration with the relevant Third Party Application. If requested by Nory, Customer shall confirm such deletion and discontinuance of use in writing and Nory shall be authorised to provide a copy of such confirmation to any such third party claimant or governmental authority, as applicable.
  • Nory recommends that the Customer refers to the third-party's terms and conditions and privacy policy prior to using the relevant Third Party Application. Any contract entered into, and any transaction completed, via any third-party website is between the Customer and the relevant third-party and not Nory.

14. Limitation of Liability

  • Nothing in this Agreement excludes the liability of either party for:
    • (i) death or personal injury,
    • (ii) fraud or fraudulent misrepresentation or
    • (iii) any other liability which cannot be excluded by law.
  • Neither party shall have any liability for any loss of profits, loss of business, wasted expenditure, depletion of goodwill and/or similar losses, loss or corruption of data or information or any special, indirect or consequential loss, costs, damages, charges or expense.
  • The Customer's relationship with third-party vendors of Third Party Applications shall be governed by the Customer's agreement with those third-party vendors. Nory shall have no liability whatsoever to the Customer or its affiliates for any acts or omissions of the third-party vendor of Third Party Applications or for the performance of the Third Party Applications. The Customer understands the foregoing and agrees with it and shall make no claims against Nory in relation to the same.
  • Either party's total aggregate liability to the other in contract, tort (including negligence, or breach of statutory duty), misrepresentation, restitution or otherwise arising in connection with the performance of this Agreement shall be limited to the fees paid under this Agreement for the Services giving rise to the liability in the twelve (12) months preceding the first incident out of which the liability arose.
  • Nory agrees to maintain during the Term, at a minimum, professional indemnity and cyber insurance with a reputable insurance company.

15. Miscellaneous

  • Independent Contractor: Nory and the Customer are independent contractors. Neither Nory nor the Customer are, or shall be deemed for any purpose to be, employees or agents of the other and neither party shall have the power or authority to bind the other party to any contract or obligation.
  • Variation: No modification, amendment, supplement to or waiver of this Agreement shall be binding upon the parties hereto unless made in writing and duly signed by both parties.
  • Severability: In the event any one or more of the provisions of this Agreement is held to be invalid or otherwise unenforceable, the enforceability of the remaining provisions shall be unimpaired.
  • Assignment: This Agreement shall be binding upon and inure to the benefit of the parties hereto and their respective heirs, personal representatives, successors and permitted assigns; No party shall assign this Agreement or any of its rights and obligations hereunder without the prior written consent of the other parties; provided, however, that either party may assign this Agreement and all of its rights and obligations hereunder to a purchaser of all or substantially all of the assets of such party who expressly assumes all of such party's obligations under this Agreement in connection with such assignment.
  • Notices: Any notice to be given by a party under or in connection with this Agreement shall be in writing and signed by or on behalf of the party giving it and shall be delivered by:
    • (a) email to the email addresses set out in the applicable order form and
    • (b) hand or pre-paid recorded delivery, special delivery or registered post to the addresses set out in the applicable order form. Notices regarding termination and/or disputes must be sent using both methods specified above.
  • Force Majeure: Nory shall not be responsible for failure to perform in a timely manner under this services agreement when its failure results from any of the following causes: Acts of God or public enemies, civil war, insurrection or riot, fire, flood, explosion, earthquake or serious accident, strike, labour trouble or work interruption or any cause beyond its reasonable control.
  • Survival: Sections 3, 12 and 15 shall survive termination of this Agreement. Any other provisions of this Agreement that by their nature extend beyond the expiration or termination of this Agreement shall survive the expiration or termination of this Agreement and shall remain in effect until all such obligations are satisfied.
  • Entire Agreement:
    • (a) This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous and contemporaneous agreements, promises, assurances and understandings between them, whether written or oral, relating to its subject matter.
    • (b) Each party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.
    • (c) To the extent there is any inconsistency between this Agreement and any order form, the terms of the order form shall prevail as to pricing, product and service scope.
  • Governing Law: This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and interpreted in accordance with the laws of Ireland.
  • Jurisdiction: Each party irrevocably agrees that the courts of Ireland shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).

Schedule 1 - Service Level Agreement

  • Nory will provide a support channel by in chat app. Nory's support is staffed by trained technical staff, available between 9am to 6pm, 7 days a week to respond to the Customer's request for support services, excluding December 25th.
  • Nory will use its reasonable endeavours to respond all requests for support services within its then current standard response times. Nory's current standard response times are:

SeverityDescriptionResponse TimeTarget Resolution TimeAlert MethodUrgent (P0)Product is not functioning60 minutes< 12 HoursIn app chatMedium (P1)Product functionality exists but the problem requires circumvention< 3 Hours< 48 HoursIn app chatLow (P3)a) Issue is procedural b) Involves an update requests c) Involves setup change requests72 hoursTBD on case by case basisIn app chat/email

Severity Description Response Time Target Resolution Time Alert Method
Urgent (P0) Product is not functioning 60 minutes < 12 Hours In app chat
Medium (P1) Product functionality exists but the problem requires circumvention < 3 Hours < 48 Hours In app chat
Low (P3) a) Issue is procedural
b) Involves an update requests
c) Involves setup change requests
72 hours TBD on case by case basis In app chat/email

Talent Funnel Applicant Tracking System Integration

  • To the extent that issues arising relating to the Talent Funnel Applicant Tracking System integration, the Customer may in the first instance contact Nory and Nory will provide assistance where practicable.
  • Where Nory cannot provide the support required by the Customer, Talent Funnel will provide the required support directly to the Customer.

Schedule 2 - Data Processing Agreement

Definitions

Capitalised terms shall have the meaning given to them in this clause 1.

  • "Controller" shall have the meaning given to it in Data Protection Legislation
  • "Data Protection Legislation" means any statute, regulation, order, or any other legal instrument which pertains to the protection of privacy and confidentiality of personal information, including: (i) GDPR (including the UK GDPR); (ii) any binding decision of the European Commission or the European Data Protection Board adopted pursuant to GDPR; (iii) the UK Data Protection Act 2018 (iv) any applicable law which implements those provisions of GDPR which do not have direct effect in the European Economic Area, including those that repeal or replace the Data Protection Acts 1988 and 2003 in Ireland
  • "Data Subject" shall have the meaning given to it in Data Protection Legislation
  • "DPA" shall mean this data processing agreement
  • "EEA" means the European Economic Area
  • "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
  • "Personal Data" shall have the meaning given to it in Data Protection Legislation and as described in this Schedule 2
  • "Personal Data Breach" shall have the meaning given to it in Data Protection Legislation
  • "Processor" shall have the meaning given to it in Data Protection Legislation
  • "Restricted Transfer" means a transfer which is covered by Chapter V of the UK GDPR
  • "UK GDPR" means the version of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC in place in the United Kingdom

Role of the Parties

  • Customer shall be the Controller and Nory shall be the Processor with respect to the Personal Data processed by Nory on the Customer's behalf in performing its obligations under this DPA.
  • Nory shall comply with all applicable Data Protection Legislation and its obligations under this DPA in relation to its processing of Personal Data.
  • The parties acknowledge that Nory shall process the Personal Data described in the Annex to this Schedule 2 on behalf of the Customer for the purposes of the provision of the Services.
  • Nory shall process the Personal Data detailed in the Annex to this Schedule 2 for the term of the Agreement or until such time as the Customer or Nory deletes the Personal Data in accordance with clause 9 of this Schedule 2.

Instructions

  • Documented Instructions: Nory will only act on documented instructions from the Customer regarding the processing of Personal Data pursuant to this DPA. These instructions shall be to process the Personal Data for the purpose of providing the Services under the Agreement unless required to do so for other purposes by European Union or European Union member state law to which Nory is subject and in such case, Nory shall notify the Customer of that legal requirement before processing unless the European Union or European Union member state law prohibits Nory from notifying the Customer.

Confidentiality and Security of Processing

  • Confidentiality: Nory shall ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  • Security: Nory shall implement appropriate technical and organisational measures as are listed in the Annex to this Schedule 2 to ensure an appropriate level of security of processing of the Personal Data to protect against accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, such Personal Data.
  • Taking into account the nature of the processing undertaken by it, Nory shall provide reasonable assistance to the Customer in complying with its security obligations under Data Protection Legislation to ensure secure processing of the Personal Data.
  • Personal Data Breach: Nory will notify the Customer without undue delay upon becoming aware of a Personal Data Breach and provide the Customer with all relevant information relating to the breach and with all reasonable assistance in the investigation, containment, rectification and notification of the Personal Data Breach.

Assistance

  • Data Subject Rights: Taking into account the nature of the processing undertaken by it, Nory shall provide all reasonable assistance to the Customer in order to enable the Customer to respond to requests from Data Subjects seeking to exercise their rights under Data Protection Legislation in respect of the Personal Data processed by Nory on behalf of the Customer.
  • Other Data Protection Obligations: Nory shall provide all reasonable assistance to the Customer in order to enable the Customer to comply with its obligations under Data Protection Legislation which could include, but are not limited to, conducting any required data protection impact assessments, risk analysis or consultation with relevant supervisory authorities upon request from the Customer.

Audit and Compliance

  • Audits: Subject to reasonable access arrangements, Nory shall make available to the Customer all information necessary to demonstrate its compliance with its obligations under this DPA and subject to being reimbursed for all reasonably incurred and properly vouched costs incurred by Nory in permitting same, allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.
  • Records: Nory shall keep, or cause to be kept, full and accurate records relating to all processing of Personal Data on behalf of the Customer as part of the Services.

Sub-Processors

  • Authorised Sub-Processors: It is hereby agreed between the parties that Nory may engage one of the entities set out in the Annex to this Schedule 2 to process the Personal Data on its behalf provided that:
    • (i) any such engagement shall respect the conditions set down in this DPA for engaging any other entity to process the Personal Data on its behalf and
    • (ii) Nory shall notify the Customer in advance of the identity of any such sub-processor and the location in which the sub-processor will be processing Personal Data on behalf of Nory. It is hereby further agreed that Nory shall remain fully liable to the Customer for the performance of such sub-processor's obligations.
  • New or Replacement Sub-Processors: In the event Nory intends to add or replace any of the sub-processors listed in the Annex to this Schedule 2, Nory shall promptly notify the Customer via the Sub-processor dashboard on the Nory website. The Customer may notify Nory of any objections to the proposed sub-processor within thirty (30) business days of the notice. Nory and the Customer shall negotiate in good faith to agree to further measures including contractual or operational adjustments relevant to the appointment of the proposed sub-processor or operation of the services to address the Customer's objection. Where such further measures cannot be agreed between the parties within forty-five (45) business days from Nory's receipt of the Customer's objection, the Customer may, by written notice to Nory with immediate effect, terminate that part of the Services which require use of the proposed sub-processor.

International Transfers

  • Nory may only transfer Personal Data outside of the EEA and/or the UK:
    • (a) with the prior written consent of the Customer; or
    • (b) where required to do so under applicable law, inform the Customer of this requirement and the details of the transfer prior to transferring any Personal Data.
  • Any transfer of Personal Data outside of the EEA and/or the UK shall be carried out in accordance with Article 46 of the GDPR/UK GDPR and/or other relevant provisions of Data Protection Legislation.

Deletion and/or Return of Personal Data

  • On termination of the Services or at any other time on the instruction of the Customer, Nory shall, acting on the written instructions of the Customer, either delete all Personal Data or return all Personal Data to the Customer and shall delete all existing copies of the Personal Data held by Nory unless it is required under European Union or European Union member state law to retain same. If the Customer fails to provide appropriate written instructions on whether it requires Nory to delete or return all Personal Data on termination of the Agreement, the Customer shall be deemed to have instructed Nory to delete all relevant Personal Data.
  • Where Nory is instructed to delete or return the Personal Data, Nory shall procure that all sub-processors return or delete the Personal Data held by them.

Annex

Details of Processing

Types of personal data processed:

  • first names and surnames
  • usernames or similar identifier
  • job title/position
  • date of birth
  • PPSN
  • email address
  • telephone numbers
  • banking information
  • details of complaints
  • feedback and requests for support
  • IP addresses
  • login data
  • passport
  • CV
  • employment history
  • education history
  • professional certifications and licenses
  • social media links (where provided)
  • photograph (where provided)
  • employment references
  • interview notes and feedback (where applicable)
  • assessment results (where applicable)
  • work permits or visas (where applicable)

Categories of data subjects:

  • employees, consultants, contractors and agents of the Customer and its affiliates
  • third parties with which the Customer conducts business

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A

Nature of the processing: The performance of the Services pursuant to the Agreement.

Purpose(s) for which the personal data is processed on behalf of the controller: Nory will process Personal Data as necessary to perform the Services pursuant to the Agreement and as further instructed by the Customer in its use of the Services.

Duration of the processing: The duration of this DPA, plus the period from the end date of this DPA until deletion of all Personal Data by Nory in accordance with the DPA.

Technical and Organisational Measures

Nory has the following technical and organisational measures in place:

  • Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
  • Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
  • Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing
  • Measures for user identification and authorisation
  • Measures for the protection of data during transmission
  • Measures for the protection of data during storage
  • Measures for ensuring event logging
  • Measures for internal IT and IT security governance and management
  • Measures for ensuring data minimisation
  • Measures for ensuring data quality
  • Measures for ensuring limited data retention

List of Sub-Processors

Category Tool Service Description
Infrastructure & Core Services AWS Cloud hosting and infrastructure provider
Infrastructure & Core Services Gsuite Email, identity, and productivity suite
Infrastructure & Core Services Microsoft Excel Spreadsheet software used for internal analysis
Identity, Authentication & Agreements Docusign Inc. Electronic contract signing and workflow platform
Identity, Authentication & Agreements Dropsign Digital terms acceptance and workflow tool
Communication & Messaging Intercom Customer support and live chat platform
Communication & Messaging Onesignal Push notification delivery service
Communication & Messaging Sendbird In-app chat messaging provider
Communication & Messaging Slack Internal team communication and collaboration
Communication & Messaging Twilio Programmable messaging (SMS, email, etc.) APIs
AI, Automation & Workflow Zapier No-code workflow and automation platform
AI, Automation & Workflow Super AI AI-based invoice OCR and data extraction
AI, Automation & Workflow ChatGPT AI language model used for conversational tasks
Billing, Accounting & Finance API Deck API gateway for financial system integrations
Billing, Accounting & Finance Chargebee Subscription billing and revenue management
Billing, Accounting & Finance Xero Accounting and bookkeeping platform
Billing, Accounting & Finance Bright Payroll, tax compliance, and accounting services
Analytics & Performance Mixpanel Product and user behavior analytics
Analytics & Performance Pavlov Customer performance and health analysis
CRM, Sales & Marketing Aligned Digital sales room for proposal collaboration
CRM, Sales & Marketing Calendly Meeting scheduling and calendar integration
CRM, Sales & Marketing Gsuite Email and document tools for outbound sales use
CRM, Sales & Marketing Hubspot CRM and marketing automation platform
CRM, Sales & Marketing Revenue Hero Inbound lead routing and meeting booking
CRM, Sales & Marketing Sendoso Direct mail and corporate gifting platform
Internal Tools & Collaboration Linear Project and engineering task management
Internal Tools & Collaboration Loom Asynchronous video recording and sharing tool
Internal Tools & Collaboration Notion Internal documentation and collaboration platform