This Data Processing Addendum (“DPA”) supplements the Northgale Terms of Service and applies where Northgale processes personal data on your behalf, including under the GDPR and the CCPA. Capitalized terms have the meaning given in the Terms or in the applicable data protection law.

1. Roles

For the personal data you submit to the Service, you are the data controller (or business under the CCPA) and Northgale is the data processor (or service provider). Northgale processes personal data only on your documented instructions.

2. Processing details

Subject matter: provision of the Norma and Aegis services.
Duration: the term of your subscription plus any required retention period.
Nature and purpose: hosting, explanation, audit-logging, and support.
Categories of data subjects: your end users and employees whose data you submit.
Categories of personal data: whatever personal data you choose to submit as customer content.

3. Subprocessors

You authorize Northgale to engage the subprocessors listed on our Subprocessors page. Northgale will notify you of additions and gives you the opportunity to object. Northgale remains liable for its subprocessors' compliance.

4. Security

Northgale implements appropriate technical and organizational measures, including encryption in transit and at rest, least-privilege access controls, and logging, as described on our Security page.

5. Data subject requests and assistance

Northgale will assist you in responding to data subject requests and, where required, in completing data protection impact assessments and consultations with supervisory authorities, to the extent the information is within Northgale's control.

6. International transfers

Data is hosted in the United States. Where the GDPR applies, transfers are governed by the applicable legal transfer mechanisms, including standard contractual clauses where required.

7. Execution

A fully executed DPA is available to customers on request. Enterprise plans include a signed DPA and, where applicable, Business Associate and other industry-specific agreements. Contact contact@northgale.io to request one.