Data Processing Addendum.

1. What this addendum is

This Data Processing Addendum ("addendum") is part of the agreement between your business ("you") and Slashturn Ltd ("we") under our terms of service. It applies whenever we process personal data for you in providing Northpage. For that data you are the controller and we are your processor. It is our contract under Article 28 of the UK GDPR, and where the EU GDPR applies to you, under Article 28 of the EU GDPR too.

It does not cover the data we handle for ourselves, such as your account and billing details, for which we are the controller. Our privacy policy covers that. If this addendum and the terms disagree about personal data you put into Northpage, this addendum wins.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" mean what they mean in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and the EU GDPR where it applies to you.

2. Details of the processing

3. Your instructions

• We process the data only on your documented instructions. The terms, this addendum and the way you and your team set up and use Northpage are those instructions, including for transfers outside the UK. You can give further reasonable instructions in writing.
• If the law requires us to process the data in another way, we will tell you before we do, unless the law forbids that on important grounds of public interest.
• If we think an instruction breaks data protection law, we will tell you straight away and need not follow it.
• You are responsible for having a lawful basis for the data you put in and for telling the people concerned how it is used, including the readers of your pages and the people you add to a portal or a shoot.

4. Confidentiality

Everyone we allow to process the data is bound to keep it confidential, by contract or by law. Only the people who need to, to run and support the service, can reach it. We do not look at your content except to provide support you ask for, to keep the service secure, or where the law requires.

5. Security

We keep appropriate technical and organisational measures in place to protect the data, as Article 32 of the UK GDPR requires, taking account of the risks. They include:

• encryption in transit (HTTPS only, with HSTS) and at rest in our database and file storage;
• every request limited to the workspaces a person belongs to, enforced in one layer of the code, with tests that one workspace cannot reach another's data;
• no passwords: sign-in is by emailed one-time code through our identity provider, and sessions are signed and sealed;
• page passcodes stored only as hashes, with limits on wrong tries;
• limits on requests to public forms, and protection against cross-site forms;
• AI assistants limited by their keys or connections, and unable to publish;
• secrets kept out of the code, and no content, tokens or email addresses written to logs;
• point-in-time backups of the database, so it can be restored to an earlier moment;
• export of a whole workspace by its owners and editors at any time.

We review these measures as the service changes, and will not reduce the overall level of protection.

6. Sub-processors

You give us general authorisation to use other companies (sub-processors) to process the data. These are the ones we use now:

• Each sub-processor is bound by a written contract with data protection terms that protect the data at least as well as this addendum. We stay responsible to you for what they do.
• How we tell you about changes. Before we add or replace a sub-processor, we update this page and email the owners of every workspace at least 30 days before the new one starts handling your data. The email says who it is, what it will do and where.
• Your right to object. You can object on reasonable data protection grounds by writing to us within those 30 days. We will talk it through with you and look for another way. If we cannot find one, you may end the terms for the affected service before the change applies, and we will refund the unused part of any period you have paid for.
• If we must replace a sub-processor urgently, for example because it has stopped working or has a security problem, we will tell you as soon as we can, and your right to object still applies.
• AI assistants and social networks that you connect are not our sub-processors. You choose them and they act under your own agreement with them.

7. Transfers outside the UK

We transfer the data outside the UK only as section 6 shows, and only with a safeguard that data protection law accepts: UK adequacy regulations (including those for the EEA and the UK-US data bridge for certified companies), or the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. For data the EU GDPR covers, the European Commission's adequacy decision for the UK covers transfers to us, and our onward transfers use the same kinds of safeguards. If a safeguard stops being valid, we will put another in place or stop the transfer.

8. Helping you

• People's rights. Most requests you can answer yourself in Northpage: you can find, correct, export and delete the data. Where you cannot, we will help. If someone writes to us about data we hold for you, we will pass it to you without undue delay and not answer it ourselves unless you ask us to.
• Security, impact assessments and the regulator. We will give you the information and help you reasonably need for your own security duties, data protection impact assessments and any prior consultation with the ICO or another regulator, taking account of what we know about the processing.

9. Personal data breaches

We will tell you without undue delay after we become aware of a personal data breach that affects your data, so you can meet your own duty to tell the ICO within 72 hours where that applies. We will tell the workspace owners by email and include what we know: what happened, the kinds and rough number of people and records affected, the likely effects, and what we have done or plan to do. Where we do not know everything at once, we will send it as we learn it. We will take reasonable steps to contain the breach and limit its effects.

10. When the service ends

When your workspace closes, we keep its data for 30 days so you can change your mind or ask for a copy, then delete it. Copies in backups are removed as those backups expire, within a further 30 days. If you ask within the 30 days, we will give you a copy first. Owners and editors can also export everything at any time before closing. We keep data after that only where the law requires, and then only for as long as it requires.

11. Information and audits

• We will make available the information you reasonably need to show that we meet Article 28, and answer your reasonable written questions about how we protect your data.
• Once a year, on request, we will give you a written report on our security measures and our sub-processors' certifications. We expect that to answer most audit needs.
• Where it does not, or where a regulator requires it, we will allow and contribute to an audit or inspection by you or an independent auditor you choose, bound by confidentiality, on at least 30 days' written notice, during UK working hours, no more than once a year unless there has been a breach, and in a way that does not put other customers' data at risk. You pay your own costs.

12. Liability and how long this lasts

Each of us is liable under this addendum as the terms set out, including their limits, except where data protection law does not allow a limit. This addendum lasts as long as we process personal data for you, including after the terms end, until the data is deleted.

Questions about this addendum, or a signed copy for your records: hello@northpage.app.