Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of every agreement between Northdeck and a customer under our Terms of Service. It sets out how Northdeck handles personal data in the Customer Data, as required by Article 28 of the General Data Protection Regulation (GDPR). Terms defined in the Terms of Service have the same meaning here.
1. Roles
1.1 The Customer is the controller of the personal data in the Customer Data. Northdeck (a trade name of Handelsonderneming PJB, Viermorgen 23, 3317 DT Dordrecht, the Netherlands, Chamber of Commerce number 95934693, VAT number NL005180434B90) is the processor.
1.2 Northdeck processes this personal data only on the Customer's documented instructions, including with regard to transfers outside the European Economic Area. The agreement, the configuration of the workspace and the Customer's actions in the Service are those instructions. If Northdeck believes an instruction breaks the law, it tells the Customer.
2. What is processed
- Purpose: providing the Service: reading data from the Customer's Source Systems, storing it, calculating KPIs, and showing dashboards, drill-downs and reports to the Customer's Users. Plus support, backups and security.
- Nature: collecting (read-only), storing, structuring, calculating, displaying, exporting and deleting.
- Data subjects: contact persons at the Customer's clients and suppliers, consumers who buy from the Customer (for example in its webshop, on marketplaces or in its stores), the Customer's employees as far as they appear in the source data (for example in planning or hours), and the Customer's Users.
- Types of personal data: names, business contact details, roles, and business records linked to a person, such as quotes, contracts, invoices, hours and planning. For consumers: name, country of delivery and order data (date, channel, products, amounts, returns); the Service does not read their address, email address or phone number. For Users: name, email, role, sign-ins and actions in the audit log.
- Special categories: none. The Customer does not load special categories of personal data (such as health data or reasons for absence) or criminal-records data, unless agreed in writing with additional measures.
- Duration: for as long as the agreement runs, plus the export and deletion period in article 8.
3. Confidentiality
Northdeck only gives access to personal data to people who need it to provide the Service and who are bound by confidentiality.
4. Security
Northdeck takes appropriate technical and organisational measures, which include at least:
- storage of Customer Data in the European Union (Frankfurt, Germany);
- separation of each customer's data by row-level access rules in the database, tested automatically with every change to the software;
- encrypted connections (TLS) and encryption at rest by the hosting provider;
- read-only access to Source Systems: the Service never writes back;
- access per role within the workspace, with restricted tables that only management roles can read;
- an audit log of sign-ins, imports and configuration changes;
- the hosting provider's service-role keys used only on the server side, never in the browser;
- daily backups by the hosting provider;
- access by Northdeck staff only where needed for support or maintenance.
Northdeck may update these measures as long as the level of protection does not decrease.
5. Sub-processors
5.1 The Customer gives general permission for the following sub-processors:
| Sub-processor | What for | Where the data is | Safeguard for transfers outside the EEA |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and storage of the Service | Frankfurt, Germany (EU); support access from the US possible | Standard Contractual Clauses |
| Scaleway SAS | Server-side calculation of KPIs, reports and drill-downs; Customer Data is held in memory only and not stored | Amsterdam, the Netherlands (EU) | No transfer |
| Resend, Inc. | Sending email from the Service (invitations, password resets, reports and alerts) | Sending from Ireland (EU); account and log data in the US | EU–US Data Privacy Framework |
| Anthropic, PBC | The AI assistant: it receives a User's question and the figures the Service calculates to answer it, such as totals, trends or the totals of one customer or product; not the source rows. Not used to train AI models; deleted within 30 days | United States | Standard Contractual Clauses |
| Cloudflare, Inc. | Delivery of the application to the browser; network security | Global network; does not store Customer Data | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Google Workspace) | Email and support communication, if the Customer sends personal data by email | EU and US | EU–US Data Privacy Framework; Standard Contractual Clauses |
5.2 Northdeck informs the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds; if no solution is found, the Customer may end the agreement for the affected part without penalty.
5.3 Northdeck imposes the same data protection obligations on each sub-processor and remains responsible for them towards the Customer.
5.4 Northdeck only transfers personal data outside the European Economic Area, or allows access from outside it, with a safeguard under Chapter V of the GDPR. The safeguard per sub-processor is in the table in 5.1. Where a sub-processor relies on the EU–US Data Privacy Framework and that framework ceases to apply, Northdeck relies on the European Commission's Standard Contractual Clauses or another valid safeguard, or replaces the sub-processor under 5.2. On request Northdeck gives the Customer a copy of the safeguards.
6. Personal data breaches
6.1 Northdeck informs the Customer without undue delay, and in any case within 48 hours after discovering it, of a breach involving personal data in the Customer Data.
6.2 The notice describes what happened, which data and data subjects are affected as far as known, the likely consequences, and the measures taken or proposed. Northdeck gives further information as it becomes available.
6.3 The Customer decides whether to notify the supervisory authority and data subjects. Northdeck helps where needed.
7. Assistance
Northdeck helps the Customer, as far as reasonably possible, to respond to requests from data subjects, and with data protection impact assessments and consultations with the supervisory authority. If a data subject contacts Northdeck directly, Northdeck forwards the request to the Customer.
8. Return and deletion
After the agreement ends, the Customer Data remains available to the Customer for export for at least 30 days, as set out in clauses 8.3 and 8.5 of the Terms of Service. Northdeck then deletes the Customer Data within 60 days, and from backups when they rotate out, unless the law requires Northdeck to keep it. On request Northdeck confirms the deletion in writing.
9. Audits
Northdeck provides the Customer with the information needed to show that it meets this DPA. The Customer may have an audit carried out once a year, or after a breach, by an independent auditor bound by confidentiality, with at least 30 days' notice and at the Customer's own cost. Northdeck first answers questions in writing; an on-site audit only takes place if those answers are not sufficient.
10. Liability and duration
The limitations of liability in the Terms of Service apply to this DPA. This DPA ends when Northdeck no longer processes personal data for the Customer. Obligations that by their nature continue, such as confidentiality and deletion, remain in force.