Data Processing Agreement

Last updated: [date] · Draft for lawyer review

When your team stores leads and contact details in Northlead, you are the controller of that personal data and we process it for you. Our Data Processing Agreement (GDPR Article 28) is part of the Terms of Service and applies automatically to every subscription. A signed copy is available from privacy@northlead.app.

What it says, in short

• We process workspace data only on your documented instructions and only to provide the service.
• Everyone with access is bound to confidentiality.
• Data is hosted in the EU, encrypted in transit, backed up daily and kept separate from other customers' workspaces.
• Because we are based in Serbia, the EU Standard Contractual Clauses (module 2, controller to processor) are included.
• We tell you about a personal data breach without undue delay, and within 48 hours at the latest.
• We help you answer data subject requests and with data protection impact assessments.
• At the end of the subscription we delete workspace data after 30 days, or return it on request.
• We tell you at least 30 days before adding a new sub-processor, and you can object.

Sub-processors

AI and data providers that you connect with your own keys work under your own contract with them and are not our sub-processors.

Full text: [link to the signed DPA PDF once the lawyer has approved it]