Privacy and Cookie Policy
This policy explains which personal data Northdeck collects, why, how long we keep it and what your rights are. It covers our website northdeck.nl, the pilot and contact form, our email contact with you, and the accounts of people who use the Northdeck app.
The business data that customers load into the Northdeck app is a different matter: there we act on behalf of the customer, who decides what is loaded and why. That is covered in section 7 and in the Data Processing Agreement that customers receive with their contract.
1. Who is responsible
Northdeck B.V. is in formation. Until it is incorporated, its founder Patrick Blommers is responsible for the processing described here, on behalf of Northdeck B.V. in formation. Once the company is registered, we will add its Chamber of Commerce number and address here. For everything in this policy, contact us at info@northdeck.nl.
2. What we collect and why
| When | Which data | Why | Legal basis | How long |
|---|---|---|---|---|
| You fill in the pilot or contact form | Name, company, work email, phone (optional), company size, sector, the systems you use, your message, the language of the page | To reply to you and prepare a proposal | Steps at your request before a possible contract; our legitimate interest in answering business enquiries | 12 months after our last contact, unless an agreement follows |
| You email us or we talk | Name, email address, role, company and what we discussed | To answer you and keep track of our contact with your company | Legitimate interest | Up to 2 years after our last contact |
| We approach you about Northdeck | Name, role, company and work contact details from public business sources such as company websites | To introduce Northdeck to companies it may help | Legitimate interest. Every message lets you opt out, and we then stop | Until you object, or at most 2 years |
| Your company becomes a customer | Contact details of contact persons; invoicing details | To carry out the agreement and invoice | Performance of the contract; legal obligation (tax records) | Duration of the agreement; invoices 7 years |
| You use the Northdeck app | Name, email, role in the workspace, sign-ins and actions in the audit log | To give you access, protect accounts and show your company who changed what | Performance of the contract with your employer; legitimate interest in security | As long as your account exists; audit log at most 2 years |
| You visit the website | Technical data such as IP address, browser and pages visited | To run the website securely and, with your consent, to see how it is used | Legitimate interest; consent for analytics cookies | See section 5 |
We do not sell personal data, do not use it for automated decisions about you and do not use it to train AI models.
3. Who we share it with
We only share personal data with service providers that help us run Northdeck, under a data processing agreement with each:
- Shopify hosts our website and receives the contact form.
- Google (Google Workspace) handles our email and documents.
- Supabase hosts the Northdeck app database, in Frankfurt, Germany.
- Cloudflare delivers the Northdeck app to your browser.
- Our accountant and, where the law requires it, government authorities.
Some of these providers are based outside the European Union. Where personal data leaves the EU, the transfer is covered by an adequacy decision, the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
4. Security
We protect personal data with encrypted connections (HTTPS), access only for people who need it, separation of each customer's data in the database, encryption at rest by our hosting provider, and an audit log of changes in the app.
5. Cookies and similar technology
Website. Our website runs on Shopify, which places cookies that are needed for the site to work and to protect it. These do not need your consent. Cookies for statistics or marketing are only placed after you consent in the cookie banner, and you can withdraw that consent at any time through the same banner. We do not use advertising cookies.
App. The Northdeck app stores your sign-in session and a few preferences, such as your language and the workspace you last opened, in your browser. In the public demo, the example data you change stays in your own browser and is never sent to us. The app does not use tracking or advertising cookies.
6. Your rights
You can ask us to see, correct or delete your personal data, to restrict its use, or to receive it in a common format. You can also object to its use based on legitimate interest, including direct contact about Northdeck. Send your request to info@northdeck.nl; we answer within one month. We may ask you to confirm your identity.
If you are not satisfied with how we handle your data, please tell us. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
7. Data our customers load into Northdeck
Customers load business data into Northdeck from their own systems, such as invoices, contracts, customers and planning. This can include personal data, for example the name of a contact person at a client or of an employee in a planning. For this data the customer is the controller and Northdeck is the processor: we only process it on the customer's instructions to provide the service, as set out in the Data Processing Agreement we sign with each customer. If your data is in a Northdeck workspace of a company you deal with and you want to exercise your rights, please contact that company; we will help them respond.
8. Changes
We may update this policy, for example when we add a service provider. The date at the top shows the latest version. We inform customers about significant changes by email.