Back to home
NorthNorth OS

Data Processing Agreement

Last Updated: 4 July 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between North OS Technologies Ltd. ("North", the "Processor") and the customer ("Customer", the "Controller") and applies where North processes personal data on the Customer's behalf subject to the UK GDPR, the Data Protection Act 2018 or the EU GDPR ("Data Protection Laws").

1. Roles and Scope

  • The Customer is the Controller (or a processor acting on behalf of another controller) of personal data contained in Customer Content — e.g. CRM records, contacts, documents, emails and calendar data connected to the Service.
  • North is the Processor, processing such personal data only to provide, secure and support the Service.
  • North acts as an independent controller for its own account, billing and website data, as described in the Privacy Policy.

2. Processing Details

  • Subject matter: provision of the North OS platform.
  • Duration: the term of the agreement plus the deletion period.
  • Nature and purpose: hosting, storage, transmission, analysis (including AI processing at the Customer's instruction), display and backup.
  • Categories of data: contact details, business records, communications content and metadata, documents, and any other personal data the Customer submits.
  • Data subjects: the Customer's staff, clients, leads, contacts and other individuals whose data the Customer submits.

3. Processor Obligations

North will:

  • Process personal data only on the Customer's documented instructions (including these Terms and use of the Service features), unless required by law
  • Ensure persons authorised to process the data are bound by confidentiality
  • Implement appropriate technical and organisational security measures (see Security Controls below and our Security Policy)
  • Assist the Customer, taking into account the nature of processing, with data subject requests and with obligations under Articles 32–36 (security, breach notification, DPIAs)
  • Make available information necessary to demonstrate compliance and allow for audits (Section 7)
  • Delete or return personal data at the end of the engagement (Section 6)

4. Subprocessors

  • The Customer provides general written authorisation for North to engage subprocessors (e.g. cloud hosting, storage, AI model providers, email delivery).
  • North maintains a list of subprocessors, available on request, and will notify the Customer of intended additions or replacements, giving the Customer the opportunity to object on reasonable data protection grounds.
  • North imposes data protection obligations on subprocessors no less protective than this DPA and remains liable for their performance.

5. International Transfers

Where personal data is transferred outside the UK/EEA to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2: controller-to-processor, or Module 3 as applicable), supplemented by the UK International Data Transfer Addendum issued by the ICO, which are incorporated by reference into this DPA, together with supplementary measures where appropriate.

6. Deletion and Return

Upon termination or expiry, North will, at the Customer's choice, return Customer personal data in a commonly used format or delete it, within 90 days, unless retention is required by law. Backup copies are purged on rolling cycles.

7. Audits

North will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party audits or certifications where available. The Customer may conduct an audit no more than once per year, on at least 30 days' notice, during business hours, subject to confidentiality, and at the Customer's expense, where the information made available is insufficient.

8. Personal Data Breach and Incident Response

North will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide information reasonably required for the Customer to meet its own notification obligations, including the nature of the breach, likely consequences, and measures taken or proposed. See our Security Policy for the incident response process.

9. Security Controls

North implements measures including: encryption of data in transit (TLS 1.2+) and at rest; role-based access controls and least-privilege access; authentication requirements including MFA availability; logging and monitoring; secure development practices; vendor due diligence; backups; and disaster recovery procedures. Details are set out in the Security Policy.

10. Liability and Order of Precedence

The liability of each party under this DPA is subject to the limitations of liability in the Terms of Service. In the event of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service with respect to data protection matters.

11. Contact

To execute a countersigned copy of this DPA, request the subprocessor list, or raise data protection questions, contact North via the website contact form with "DPA" in the subject line.