UK GDPR statement

We process the personal data above for the following purposes and on the bases shown:

• Provide and operate the Service — performance of a contract (Art. 6(1)(b) UK/EU GDPR) for Authorised Users; legitimate interests (Art. 6(1)(f)) for organisational contacts of customers.
• Account security, fraud prevention and incident response — legitimate interests, and where applicable legal obligation (Art. 6(1)(c)).
• Customer support — performance of a contract and legitimate interests in responding to enquiries.
• Billing and tax — performance of a contract and legal obligation.
• Improving the Service — legitimate interests in measuring usage, diagnosing errors and prioritising features. We use aggregated and de-identified data wherever practical.
• Marketing communications — consent (Art. 6(1)(a)) where required (e.g. email marketing to non-customers in the EEA/UK), or legitimate interests for soft opt-in messages to existing business contacts. You can unsubscribe at any time.

When you upload employment contracts or related material to the Service, the customer organisation determines the purposes and means of that processing and is the controller. Northline acts as processor and processes that data only:

• to host, analyse, classify and version the contracts within the Service;
• to generate Outputs (compliance scores, impacted-clause queues, suggested rewrites, audit-trail entries);
• to provide support, security, and to maintain the integrity of the Service; and
• where strictly necessary to comply with a legal obligation.

We do not use Customer Data to train shared or third-party foundation models. Where machine-learning components run within the Service, they operate on infrastructure under our control or under contractual commitments that prohibit cross-customer training.

The detailed terms of our processor role — including processing instructions, security measures, sub-processor governance, breach notification, audit rights and standard contractual clauses for international transfers — are set out in the DPA, available on request to privacy@northlinestudio.com.

Customer Data is hosted within the United Kingdom and the European Union. Where personal data is transferred outside the UK or the EEA — for example to a sub-processor providing global support — we rely on appropriate safeguards under UK GDPR and the EU GDPR, including:

• UK adequacy regulations or European Commission adequacy decisions where available;
• the EU Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum to those clauses; and
• transfer impact assessments and supplementary measures (such as encryption and access controls) where required.

Subject to applicable law, you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to certain processing; receive your data in a portable format; and withdraw any consent you have given.

If you are an employee, candidate or contractor of a customer organisation, please contact your employer first — they are the controller of your data within the Service. Where Northline acts as processor, we will support your employer in responding to your request.

To exercise rights against Northline as controller, contact privacy@northlinestudio.com. You may also lodge a complaint with the supervisory authority of your country of residence, including:

• United Kingdom — Information Commissioner’s Office (ICO), ico.org.uk
• France — Commission nationale de l’informatique et des libertés (CNIL), cnil.fr
• Italy — Garante per la protezione dei dati personali, garanteprivacy.it

For any question, request or complaint about this Policy or our processing of personal data, contact privacy@northlinestudio.com. You can also review our Terms of Service.