Data processing agreement
Effective 2026-09-01
This Data Processing Agreement ("DPA") supplements the Terms of Service and governs how Northline Ops ("Processor") processes personal data on behalf of the Customer ("Controller").
1. Definitions
- Personal Data means any information relating to an identified or identifiable natural person, as defined by applicable data protection law.
- Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- Sub-processor means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
2. Roles and responsibilities
Controller (you): You determine the purposes and means of processing personal data that you enter into your workspace. This includes your clients' contact details, project information, financial records, and any other personal data you upload or create.
Processor (Northline): We process Personal Data solely on your documented instructions and only as necessary to provide the Service described in the Terms of Service.
3. Scope of processing
| Processing activity | Categories of data |
|---|---|
| Running your workspace | Client names, emails, addresses, project details, financial records |
| Delivering emails you send | Recipient name, email address, email content you compose |
| Presenting records to your team | Workspace data available under your team's role permissions |
| Generating and sending invoices | Client billing details, line items, payment amounts |
| Reconciling payments | Payment amounts, payment references, timestamps |
| Hosting documents | Files you upload |
| Client portal access | Portal contact names, emails, and project data |
4. Controller instructions
The Terms of Service, this DPA, and your use of the Service through the product constitute your complete instructions for processing. If we believe an instruction violates applicable data protection law, we will notify you promptly.
5. Personnel
Access to production data is limited to a small number of authorised personnel on a need-to-know basis and only for operational purposes, such as incident resolution and support requests. All personnel with access are bound by confidentiality obligations.
6. Security measures
We implement appropriate technical and organisational measures to protect Personal Data, including:
- Workspace isolation: Controls prevent one customer from accessing another customer's data.
- Protection while stored: Encryption protects Personal Data while it is stored.
- Protection while sent: Encryption protects Personal Data while it is being sent.
- Authentication: Secure Google sign-in and protected session cookies.
- Access control: Role-based permissions limit what each person can see and do.
- Payment and service notifications: Incoming notifications are checked before they are accepted.
- Abuse prevention: Automated safeguards help prevent misuse of the Service.
Full details are available on the Security page.
7. Sub-processors
We engage the sub-processors listed on Sub-processors. That page is the canonical, maintained list. We will not materially change or add a sub-processor without updating that page. If you wish to receive advance notice of sub-processor changes, email privacy@northlineops.com and we will notify you at least 14 days before any change takes effect.
If you object to a new sub-processor on reasonable data protection grounds, you may terminate the Service within 30 days of notification and receive a pro-rata refund for the unused portion of your subscription.
8. International transfers
Our sub-processors operate in the United States, the European Union, and India. We ensure that transfers outside your jurisdiction are protected by appropriate safeguards, including Standard Contractual Clauses where required by applicable law.
9. Data subject rights
As Controller, you are responsible for responding to data subject requests from your own clients. We support you by providing:
- Full workspace data export in JSON and CSV via Account settings → Export.
- Per-client anonymisation via compliance actions in the client record.
- Account and workspace deletion via Account settings → Delete Account.
If we receive a data subject request directly, we will redirect it to you unless legally required to respond.
10. Breach notification
If we become aware of a Personal Data breach affecting your workspace, we will:
- Notify you without undue delay and no later than 72 hours after becoming aware, via the email address on file for your account.
- Provide a description of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed.
- Cooperate with your investigation and any notification obligations you may have under applicable law.
11. Audits
On reasonable request and subject to confidentiality obligations, we will make available information necessary to demonstrate compliance with this DPA. If the information provided is insufficient, you may arrange for an independent third-party audit at your expense, with reasonable advance notice and during business hours.
12. Return and deletion of data
On termination of the Service:
- You may export all workspace data at any time before deletion using the built-in export tools.
- Data follows the retention schedule in the Terms of Service: 30-day read-only grace, 90-day retention, then permanent deletion.
- Backup copies are automatically purged within the 7-day rolling backup window following deletion.
13. Duration and termination
This DPA remains in effect for the duration of the Service agreement. The obligations regarding data security, breach notification, and deletion survive termination of the Service.
14. Governing law
This DPA is governed by the same law that governs the Terms of Service.
15. Contact
DPA-related questions: privacy@northlineops.com.