Privacy Policy
Introduction
True & North respects the privacy of its customers, suppliers and partners. We have therefore formulated and implemented a policy on complete transparency regarding the processing of personal data, its purpose(s) and the possibilities to exercise your legal rights in the best possible way. We have formulated a separate privacy policy for employees, available upon employment and upon request.
Definitions
- The Party responsible for processing personal data is True & North registered at 27 Mortimer Street in the United Kingdom and company registration number 07842694 (the “Controller”).
- Data Protection Authority: The Data Protection Authority of the United Kingdom.
- Data Protection laws:
- For European citizens or residents, the EU GDPR 2018; the EU e-privacy Directive 2002 (soon to be replaced by the EU e-privacy regulation)
- For UK citizens or residents, the UK GDPR 2020 and the UK Data Protection Act 2018
- and/or the national laws of the United Kingdom.
Collection of data
- Your personal data will be collected by True & North and its data processors.
- Personal data means any information relating to an identified or identifiable natural person (‘data subject’).
- An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The types of personal data we may process:
| Business process | Type | Data subject | Legal basis |
| Website | Identification | Customers | Consent |
| Identification, Financial, Educational and employment history, Copy of ID, Contracts | Customers, Employees, Suppliers, Partners | Legitimate interest | |
| Storage and exchange of documents | Not applicable | Not applicable | Legitimate interest |
| Delivery of goods and services | Identification | Customers | Performance of a contract |
| Financial and business administration | Identification, Financial, Contracts | Customers, Employees, Suppliers, Partners | Legitimate interest |
| Marketing | Identification | Customers | Consent |
Purposes
True & North processes personal data for one or more of the following purposes:
- Customer, employee, contractor, partner or supplier management
- Business and financial administration
- Direct marketing
- Delivery of goods or services
- Work planning
How we collect, store, or otherwise process your data:
The following business processes describe how we may collect, store or otherwise process the types of personal information set out in the table above:
- Collection of cookies, subscription to newsletter or filling out the contact form on the website(s)
- Analyse trends and profiles for our legitimate interest to aim to enhance, modify, personalise and improve our services and communications for the benefit of our customers
- Process and respond to support requests, enquiries and complaints received from you through the use of a business email
- Provide services and products requested and/or purchased by you and communicate with you about such services and/or products. We do this as necessary in order to carry out a contract with you and in accordance with our legitimate interest in operating a business;
- Carry out administrative activities such as invoicing and collecting payments either locally on devices or using cloud services
- Store and exchange personal information contained in documents through email and cloud services
- Marketing and customer acquisition through email or using cloud services.
Sharing data with third parties
We may have to share your data with third parties, including third-party service providers and other entities in the group. We require third parties to respect the security of your data and treat it according to the law.
We may transfer your Personal Data outside the United Kingdom. If we do, you can expect a similar degree of protection in respect of your Personal Data.
We will only share your Personal Data with third parties in accordance with the GDPR and as outlined in the legal justification table above.
We share your personal data with the following enterprise third parties. We also share your data with SME third parties, details of which are available upon request. You will be notified when we have engaged with a new third-party recipient of your personal data.
HubSpot
| Function | CRM |
| Business process | Website, Marketing, Software tools and applications |
| Data categories | Identification, Business data |
| Data subjects | Customers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
Google Workspace
| Function | Email provider, Document storage service, Marketing tool, Appointment scheduling tool |
| Business process | Email, Digital storage of documents, Administration, Marketing |
| Data categories | Identification, Financial, Educational and employment history, Copy of ID, Contracts, Business data |
| Data subjects | Customers, Employees, Contractors, Suppliers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
Microsoft Office 365
| Function | Document storage service, other software suite |
| Business process | Digital storage of documents, Administration, Software tools and applications |
| Data categories | Identification, Financial, Educational and employment history, Copy of ID, Contracts, Software tools and applications, Business data |
| Data subjects | Customers, Employees, Contractors, Suppliers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
Typeform
| Function | Marketing tool |
| Business process | Marketing |
| Data categories | Identification |
| Data subjects | Customers, Suppliers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
Xero
| Function | Accountancy software, Bookkeeping software |
| Business process | Administration |
| Data categories | Identification, Financial, Business data |
| Data subjects | Customers, Employees, Contractors, Suppliers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
Mailchimp
| Function | Marketing tool |
| Business process | Marketing |
| Data categories | Identification |
| Data subjects | Customers |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
DocuSign
| Function | Document storage service |
| Business process | Digital storage of documents, Administration |
| Data categories | Identification, Contracts |
| Data subjects | Customers, Employees, Contractors, Suppliers, Partners |
| Security measures | Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g., SSL); Data is minimized and regularly deleted according to national retention periods. |
International data transfers
The third parties we have engaged for the abovementioned business process may transfer your personal information outside of the United Kingdom. True & North’s third-party processors take all necessary measures to ensure the confidentiality, availability and integrity of personal data and comply with the GDPR regarding international data transfers. The international nature of its compliance certifications, as well as far-reaching technical security measures (including but not limited to encryption of the personal data, making the data illegible to an unauthorised recipient), are sufficient to ensure that the data subjects continue to benefit from the fundamental rights they are entitled to under the GDPR.
True & North relies on processing agreements with these sub-processors that include the model clauses (or “Standard Contractual Clauses”), which have been tested on the adequacy of its protection regarding the specific sub-processing activities carried out in this particular sub-processing relationship.
Additional security measures are taken to safeguard international data transfers:
- Encryption
- Anonymisation
- Pseudonymisation.
Storage and protection of data
Your data is protected by True & North and its processors in pursuance of all legal requirements set by the relevant data processing laws. True & North has taken technical and organizational security measures to protect your data and requires its data processors to meet the same requirements. True & North has signed processing agreements with its processors to ensure an adequate level of data protection.
The following security measures are taken by True & North to protect your personal data in the course of the listed business processes:
Organisational security measures
Staff
True & North staff members are required to conduct themselves in a manner consistent with True & North’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. All staff members undergo appropriate background checks before hiring and sign a confidentiality agreement outlining their responsibility to protect customer data.
We continuously train staff members on best security practices, including how to identify social hacks, phishing scams, and hackers.
Access controls
True & North maintains your data privacy by allowing only authorized individuals access to information when it is critical to complete tasks for you. True & North staff members will not process customer data without authorization.
Data hosting
As a rule, data is hosted within the United Kingdom, but it is possible that we might transfer personal data to countries within the EEA, to the UK or in exceptional circumstances outside of those areas. We ensure that we comply with the GDPR and the DPA when sending data overseas by relying on data processing agreements containing standard contractual clauses with our sub-processors or by taking additional measures to secure this data transfer, such as anonymisation.
Physical security
The data centres on which personal data is hosted are secured and monitored 24/7, and physical access to facilities is strictly limited to select staff.
Technical security measures
All devices which are used to access personal data for which we are responsible are secured with antivirus software, firewalls, encryption and access management. We regularly update operating systems and software to ensure vulnerabilities cannot be exploited.
We carry out regular vulnerability scanning of our website and have engaged credentialed external auditors to verify the adequacy of our security and privacy measures.
Your rights regarding information
Each data subject has the right to information on and access to, and rectification, erasure and restriction of processing of their personal data, as well as the right to object to the processing and the right to data portability.
You can exercise these rights by contacting us at the following email address: info@trueandnorth.co.uk. Each request must be accompanied by a copy of a valid ID, on which you put your signature and state the address where we can contact you. Ensure that you write “Data Request” in the subject line of your email.
Within one month of the submitted request, you will receive an answer from us. We will not charge you for submitting your request unless the request is manifestly unfounded or otherwise unreasonable in its nature. Depending on the complexity and the number of requests, this period may be extended to two months.
Marketing
- You may receive commercial offers from True & North. If you do not wish to receive them (anymore), please send us an email to the following address: info@trueandnorth.co.uk and ensure that you write “Data Opt-Out” in the subject line of your email.
- Our partners will not use your personal data for commercial purposes.
- If you encounter any personal data from other data subjects while visiting our website, you are to refrain from collection, any unauthorized use or any other act that constitutes an infringement of the privacy of the data subject(s) in question. The collector is not responsible in these circumstances.
Data retention
The collected data are used and retained for the duration determined by law. You may, at any time, request your data to be deleted from any True & North account, system or other data processing medium in accordance with the process described above.
Applicable law
These conditions are governed by United Kingdom legislation. The court in the district where the collector has its place of business has the sole jurisdiction if any dispute regarding these conditions may arise, save when a legal exception applies.
Contact
For questions about this privacy policy, product information or information about the website itself, please contact: info@trueandnorth.co.uk.
International data transfers
HubSpot
| Third-party headquarter address | 2 Canal Park, Cambridge, MA 02141, United States |
| The primary location of processing is the USA. | Personal data collected by HubSpot may be stored and processed in any country where HubSpot or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Scherms II) |
|
| For more information, see HubSpot’s Privacy Policy | https://legal.hubspot.com/privacy-policy |
Google Workspace
| Third party headquarter address | 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States |
| The primary location of processing is the USA and EEA. | Personal data collected by Google Workspace may be stored and processed in any country where Google Workspace or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Scherms II) |
|
| For more information, see Google Workspace’s Privacy Policy | https://workspace.google.com/terms/dpa_terms.html |
Microsoft Office 365
| Third party headquarter address | 1 Microsoft Way, Redmond, WA 98052, United States |
| The primary location of processing is the USA. | Personal data collected by Microsoft Office 365 may be stored and processed in any country where Microsoft Office 365 or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
| For more information, see Microsoft Office 365’s Privacy Policy | https://www.microsoft.com/security/business |
Typefor
| Third party headquarter address | CALLE BAC DE RODA (LO) 163 08018, BARCELONA Spain |
| The primary location of processing is the USA and EEA. | Personal data collected by Typeform may be stored and processed in any country where Typeform or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
| For more information, see Typeform’s Privacy Policy | https://help.typeform.com/hc/en-us/articles/360029259552-Security-at-Typeform#h_01FDEP494ZGQY2TTCSJZ2BG4ZJ |
Mailchimp
| Third party headquarter address | 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, United States |
| The primary location of processing is the USA. | Personal data collected by Mailchimp may be stored and processed in any country where Mailchimp or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
| For more information, see Mailchimp’s Privacy Policy | N/A |
DocuSign
| Third party headquarter address | 221 Main Street, Suite 1550, San Francisco, CA 94105 United States |
| The primary location of processing is the USA. | Personal data collected by DocuSign may be stored and processed in any country where DocuSign or its affiliates, subsidiaries, or service providers operate facilities. |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
| For more information, see DocuSign’s Privacy Policy | https://www.docusign.com/company/privacy-policy |
Naq Cyber
| Country where data is processed or sent to | United Kingdom |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
Two Bee
| Country where data is processed or sent to | United Kingdom |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
Blinkhorns
| Country where data is processed or sent to | United Kingdom |
| Safeguards (art. 45 GDPR) | Standard Contractual Clauses |
| Additional safeguards (Schrems II) |
|
FutureNext GmbH
| Country where data is processed or sent to | Germany |
| Safeguards (art. 45 GDPR) | Adequacy decision exists between United Kingdom and European Union |
| Additional safeguards (Schrems II) |
|
Safeguards for international data transfers
True & North’s third-party processors take all necessary measures to ensure the confidentiality, availability and integrity of personal data and comply with the GDPR regarding international data transfers. The international nature of its compliance certifications, as well as far-reaching technical security measures (including but not limited to encryption of the personal data, making the data illegible to an unauthorised recipient), are sufficient to ensure that the data subjects continue to benefit from the fundamental rights they are entitled to under the GDPR.
True & North relies on processing agreements with these sub-processors that include the model clauses (or “Standard Contractual Clauses”), which have been tested on the adequacy of its protection regarding the specific sub-processing activities carried out in this particular sub-processing relationship.
Additional security measures are taken to safeguard international data transfers:
- Encryption
- Anonymisation
- Pseudonymisation where possible.
- Where this third-party processor uses pseudonymisation, they ensure that the personal data can no longer be attributed to a specific data subject without the use of additional information.
- This additional information is kept separately; and
- Technical and organisational measures are taken to ensure that personal data cannot be attributed to identifiable persons (encryption; database and data separation; access controls; and logging).
