Privacy and Cookie Policy
This policy explains which personal data Northdeck collects, why, how long we keep it and what your rights are. It covers our website northdeck.nl, the contact, demo and sign-up forms, our email contact with you, and the accounts of people who use the Northdeck app.
The business data that customers load into the Northdeck app is a different matter: there we act on behalf of the customer, who decides what is loaded and why. That is covered in section 7 and in the Data Processing Agreement that customers receive with their contract.
1. Who is responsible
Northdeck is a trade name of Handelsonderneming PJB, registered with the Netherlands Chamber of Commerce under number 95934693, VAT number NL005180434B90, Viermorgen 23, 3317 DT Dordrecht, the Netherlands. Handelsonderneming PJB is responsible for the processing described here. For everything in this policy, contact us at info@northdeck.nl.
2. What we collect and why
| When | Which data | Why | Legal basis | How long |
|---|---|---|---|---|
| You fill in the contact form | Name, company, work email, phone (optional), company size, sector, the systems you use, your message, the language of the page | To reply to you | Steps at your request before a possible contract; our legitimate interest in answering business enquiries | 12 months after our last contact, unless an agreement follows |
| You request a demo ("Get instant demo") | Name, work email, company, phone (optional), chosen sector, the language of the page, time of the request | To email you the demo link; to record the request as a lead in our CRM (HubSpot) and follow up once; to prevent abuse (at most one demo email per address per 24 hours) | Steps at your request (sending the demo link); legitimate interest (business follow-up, security) | 12 months after our last contact, unless an agreement follows |
| You sign up for a subscription | Company name, KvK number, your name, work email, plan and billing choice, the versions of the terms you accepted and when, a hashed IP address, and the payment details you enter at Stripe | To conclude the agreement, record your acceptance of the terms, take payment and create your workspace | Performance of the contract; legal obligation (tax records) | Duration of the agreement plus 2 years; payment records 7 years |
| You email us or we talk | Name, email address, role, company and what we discussed | To answer you and keep track of our contact with your company | Legitimate interest | Up to 2 years after our last contact |
| We approach you about Northdeck | Name, role, company and work contact details from public business sources such as company websites | To introduce Northdeck to companies it may help | Legitimate interest. Every message lets you opt out, and we then stop | Until you object, or at most 2 years |
| Your company becomes a customer | Contact details of contact persons; invoicing details | To carry out the agreement and invoice | Performance of the contract; legal obligation (tax records) | Duration of the agreement; invoices 7 years |
| You use the Northdeck app | Name, email, role in the workspace, sign-ins and actions in the audit log | To give you access, protect accounts and show your company who changed what | Performance of the contract with your employer; legitimate interest in security | As long as your account exists; audit log at most 2 years |
| You visit the website | Technical data such as IP address, browser and pages visited | To run the website securely and, with your consent, to see how it is used | Legitimate interest; consent for analytics cookies | See section 5 |
How we approach companies. We look for companies based on public information on their own website. We use software with an AI language model from Anthropic to summarise that public company information and to write a first draft of an email. We only give the model company information and the business contact details needed for the email; Anthropic does not use this data to train its models. The software checks the facts in the draft against the source and does not send anything itself: a person (our founder) reads every email, edits it where needed and sends it. No automated decisions are made about you. If you no longer want to hear from us, reply to the email or write to info@northdeck.nl; we record this so that you receive no further emails from us.
We do not sell personal data, do not use it for automated decisions about you and do not use it to train AI models.
3. Who we share it with
We only share personal data with service providers that help us run Northdeck, under a data processing agreement with each:
- Shopify hosts our website and receives the contact form.
- Google (Google Workspace) handles our email and documents.
- HubSpot is our CRM: contacts, demo requests and companies we approach.
- Resend sends emails from the app and the demo email.
- Anthropic provides the AI language model we use to summarise public company information and draft emails, and the model behind the AI assistant in the app.
- Supabase hosts the Northdeck app database, in Frankfurt, Germany.
- Scaleway calculates the figures in the Northdeck app on its servers in Amsterdam, the Netherlands, without storing the data.
- Stripe processes payments and direct debits for subscriptions.
- Cloudflare delivers the Northdeck app to your browser.
- GitHub stores our source code and our internal knowledge base, which holds the business contact details of companies we approach and our contact with them.
- Neon hosts the database of our internal sales and operations tools, in Frankfurt, Germany.
- Moneybird is our accounting software.
- Our accountant and, where the law requires it, government authorities.
Transfers outside the EU. Some of these providers are based outside the European Economic Area, or can access data from there for support. The table shows where each provider processes personal data and which safeguard covers a transfer. You can ask us for a copy of these safeguards at info@northdeck.nl.
| Provider | Where | Safeguard for transfers outside the EEA |
|---|---|---|
| Shopify | Ireland, Canada and the US | Adequacy decision for Canada; Standard Contractual Clauses |
| EU and US | EU–US Data Privacy Framework; Standard Contractual Clauses | |
| HubSpot | EU data centre; support access from the US | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Resend | Sending from Ireland; account and log data in the US | EU–US Data Privacy Framework |
| Anthropic | US | Standard Contractual Clauses |
| Supabase | Frankfurt, Germany; support access from the US possible | Standard Contractual Clauses |
| Scaleway | Amsterdam, the Netherlands | No transfer |
| Stripe | EU and US | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Cloudflare | Global network | EU–US Data Privacy Framework; Standard Contractual Clauses |
| GitHub | US | Standard Contractual Clauses |
| Neon | Frankfurt, Germany; support access from the US possible | Standard Contractual Clauses |
| Moneybird | EU | No transfer |
4. Security
We protect personal data with encrypted connections (HTTPS), access only for people who need it, separation of each customer's data in the database, encryption at rest by our hosting provider, and an audit log of changes in the app.
5. Cookies and similar technology
Website. Our website runs on Shopify, which places cookies that are needed for the site to work and to protect it. These do not need your consent. Cookies for statistics or marketing are only placed after you consent in the cookie banner, and you can withdraw that consent at any time through the same banner. We do not use advertising cookies. The website loads its typefaces from Google Fonts; your browser then sends your IP address to Google.
App. The Northdeck app stores your sign-in session and a few preferences, such as your language and the workspace you last opened, in your browser. In the public demo, the changes you make and the files you import are sent to our calculation service in Amsterdam only to calculate the figures; they are held in memory during the calculation and are not stored. The app does not use tracking or advertising cookies.
6. Your rights
You can ask us to see, correct or delete your personal data, to restrict its use, or to receive it in a common format. You can also object to its use based on legitimate interest, including direct contact about Northdeck. Send your request to info@northdeck.nl; we answer within one month. We may ask you to confirm your identity.
If you are not satisfied with how we handle your data, please tell us. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
7. Data our customers load into Northdeck
Customers load business data into Northdeck from their own systems, such as orders, invoices, contracts, customers and planning. This can include personal data, for example the name of a contact person at a client, of an employee in a planning, or of a consumer who bought from the customer in its webshop, on a marketplace or in its store. For consumers, Northdeck only takes the name, the country of delivery and the order details (date, channel, products, amounts, returns); it does not read their address, email address or phone number. For this data the customer is the controller and Northdeck is the processor: we only process it on the customer's instructions to provide the service, as set out in the Data Processing Agreement we sign with each customer. If your data is in a Northdeck workspace of a company you deal with or bought from, and you want to exercise your rights, please contact that company; we will help them respond.
8. Changes
We may update this policy, for example when we add a service provider. The date at the top shows the latest version. We inform customers about significant changes by email.