Data Processing Agreement

1. About this agreement

This Data Processing Agreement ("DPA") is between NorthQuest LLC, a Wyoming limited liability company ("NorthQuest", "we"), and the business that uses NorthQuest under the Terms of Service ("Customer", "you"). It forms part of the Terms and applies whenever NorthQuest processes personal data in Customer Data for you. You accept it by accepting the Terms.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given by the data protection laws that apply, such as the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (FADP) and the California Consumer Privacy Act as amended by the CPRA (CCPA). If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses (section 15) apply and conflict with this DPA, the Clauses win.

See: Terms of Service · Privacy Policy

2. Roles

You decide which people you contact and what data you put into or sync to NorthQuest, so you are the controller of that data (or a processor acting for your own client). NorthQuest is your processor (or your sub-processor) and processes the data only on your behalf.

For the account data of your team members (name, email, sign-in and billing details), NorthQuest is the controller, as described in the Privacy Policy.

3. Subject matter and duration

NorthQuest processes Customer Data to provide the Service described in the Terms. Processing is continuous and lasts as long as the Terms are in force and afterwards until the data is erased under section 13.

4. Nature and purpose

NorthQuest processes Customer Data only to:

• Store and show your leads, lists, campaigns, CRM records and notes.
• Send the emails you create or schedule, from the mailboxes you connect.
• Sync your connected mailboxes to find replies, bounces and delivery receipts, and show those conversations in the inbox.
• Record unsubscribes, bounces, opens and clicks (when you turn tracking on) and booked meetings (when you connect a booking tool), and report on them.
• Apply your blocklist and suppression lists, keep the Service secure, prevent abuse and give you support.

5. Categories of data subjects and personal data

Data subjects: your leads and prospects, the people who write to or receive email from your connected mailboxes, and your team members as far as they appear in Customer Data. Personal data:

• Contact and business details: name, email address, job title, company, website, location, LinkedIn URL and other fields you import.
• Email content and metadata: sender, recipients, subject, body, dates, and attachment names and sizes.
• Activity: emails sent, replies, bounces, unsubscribes, opens and clicks when tracked, booked meetings, notes and status changes.

6. Sensitive data

NorthQuest is not designed for special categories of personal data (such as health, religion or political opinions), data about criminal convictions, or data about children. You agree not to put such data into the Service.

7. Your obligations

You are responsible for the lawfulness of the processing you instruct, including having a lawful basis to collect the personal data and to email each person, giving the notices the law requires, honoring opt-outs and answering data subjects. Your instructions must comply with data protection law.

8. NorthQuest's obligations

NorthQuest will:

• Process Customer Data only on your documented instructions, unless the law requires otherwise (in which case we will tell you first unless the law forbids it). The Terms, this DPA and the way you use and configure the Service are your instructions. We will tell you if we believe an instruction breaks data protection law.
• Make sure everyone who may access Customer Data is bound by confidentiality.
• Keep the security measures in section 9.
• Use subprocessors only as described in sections 10 and 11.
• Help you answer data-subject requests and, as far as reasonable and taking into account the information available to us, with security, breach notification, data protection impact assessments and consultations with authorities (section 12).
• Tell you about a personal-data breach without undue delay (section 12).
• Erase Customer Data at the end of the Service, after giving you the chance to export it (section 13).
• Make available the information needed to show it meets this DPA, and allow audits on reasonable request (section 14).

9. Security measures in summary

NorthQuest protects Customer Data with technical and organizational measures that fit the risk, including:

• Encryption in transit and encrypted storage of mailbox credentials (OAuth tokens and SMTP/IMAP passwords).
• Workspace isolation enforced by the database on every request and checked by automated tests.
• Two-factor sign-in with single-use backup codes, and immediate sign-out of removed team members.
• An audit trail of sensitive actions, such as data exports.
• Error reports and logs with secrets removed before they leave the app.
• A global switch that stops bulk sending during an incident.

10. Subprocessors

You give NorthQuest a general authorization to use subprocessors, including those below. Each is bound by written terms that protect Customer Data at least as well as this DPA, and NorthQuest stays responsible for their work.

• Supabase: database and authentication (United States).
• Vercel: hosting and running the app (United States).
• Stripe: subscriptions, payments and invoices.
• Resend: account and notification emails, which can include a lead's name and an email subject.
• Sentry: error monitoring.
• Cloudflare Turnstile: bot checks on sign-in, sign-up and password reset.
• Anthropic: only when a workspace member uses Draft with AI or NorthQuest AI; it receives the recent messages of that conversation to write a draft, or the member's question and a short summary of the workspace (counts and campaign names) to answer it (United States).
• Services you connect yourself: Google (Gmail API) and Microsoft (Microsoft Graph) as your own mailbox providers, your SMTP/IMAP provider, Cal.com or Calendly, and HubSpot, Pipedrive or Salesforce. NorthQuest reaches them on your behalf only for the features you use; your own agreement with each provider applies.

11. Changes to subprocessors

We will update this list and tell workspace owners by email or in the app at least 30 days before a new subprocessor starts processing Customer Data. You may object on reasonable data protection grounds within that time; if we can't resolve the objection, you may end the Terms for the affected Service.

12. Data-subject requests and breaches

The app lets you find, export and delete leads, add people to your blocklist, and export or delete a workspace. If a data subject contacts NorthQuest about Customer Data, we will pass the request to you without undue delay and will not answer it ourselves except to say we passed it on, unless you ask us to. We will give you reasonable help with requests you can't handle in the app.

If NorthQuest becomes aware of a personal-data breach affecting Customer Data, we will tell you without undue delay, share what we know about its nature, likely effects and the people and data involved, take reasonable steps to contain it, and keep you updated as we learn more. Telling you is not an admission of fault.

13. Deletion and return

You can export a workspace's data as one file in Settings at any time before it is deleted. When a workspace is deleted or closed, sending stops at once and its Customer Data is erased 30 days later; until then it can be restored on request. A deleted account is erased at once. Erased data may remain in backups for up to 30 more days.

After erasure we keep only billing records, the audit trail of account and workspace actions, the sign-in security log, records of who authorized sending from a mailbox, and suppression lists (people who unsubscribed or bounced, kept so they are never emailed again), and data we must keep by law. Suppression lists keep the email address of each person who opted out or bounced, so that nobody can email them again.

14. Audits

On reasonable request, NorthQuest will give you the information you need to check that it meets this DPA, such as answers to a security questionnaire. If that isn't enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit NorthQuest with at least 30 days' notice, no more than once a year (unless a supervisory authority requires it or after a personal-data breach), during business hours and in a way that doesn't put other customers' data at risk. You bear the costs of the audit.

15. International transfers: EU Standard Contractual Clauses

NorthQuest stores and processes Customer Data in the United States, where our database and app run. Some subprocessors listed above (for example for payments, email delivery and error monitoring) may process limited data in other countries, under their own safeguards. Where data protection law requires safeguards for personal data transferred from the European Economic Area to NorthQuest, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, the "Clauses") are incorporated into this DPA by reference and apply as follows:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) where you are a processor. You are the data exporter and NorthQuest the data importer.
• Clause 7 (docking clause) is included.
• Clause 9: Option 2 (general written authorisation) applies; NorthQuest will give at least 30 days' notice of new subprocessors, as in section 11.
• Clause 11: the optional language about an independent dispute resolution body is not used.
• Clause 13: the competent supervisory authority is the one determined under Clause 13(a), based on your establishment or your representative in the EU.
• Clause 17: the Clauses are governed by the law of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.
• Annex I: the parties are the Customer and NorthQuest with the contact details in the Terms; the processing is described in sections 3 to 6 of this DPA. Annex II: the measures in section 9. Annex III: the subprocessors in section 10.

16. United Kingdom and Switzerland

United Kingdom: for personal data transferred from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022, the "UK Addendum") is incorporated into this DPA. Table 1 is completed with the parties' details in this DPA, Table 2 with the modules and options in section 15, and Table 3 with the annex details in section 15. For Table 4, neither party may end the UK Addendum under its Section 19. If the UK Addendum and the Clauses conflict for such transfers, the UK Addendum wins.

Switzerland: for personal data transferred from Switzerland, the Clauses apply with these changes: the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority as far as the FADP governs the transfer; references to the GDPR include the FADP; references to EU Member States do not prevent data subjects in Switzerland from bringing claims where they habitually live (Clause 18(c)); and the governing law and courts remain those in section 15.

17. U.S. state privacy laws

Where the CCPA or similar U.S. state privacy laws apply, NorthQuest is your service provider or processor, and processes personal data in Customer Data only for the business purpose of providing the Service described in the Terms. NorthQuest will not: sell or share that personal data (including for cross-context behavioral advertising); retain, use or disclose it for any other purpose or outside its direct business relationship with you; or combine it with personal data it receives from others or collects itself, except as those laws allow.

NorthQuest will comply with the obligations those laws place on service providers, give the personal data the level of privacy protection they require, and tell you if it can no longer meet these obligations. You may take reasonable steps to make sure NorthQuest uses the data in line with these obligations and to stop and fix any unauthorized use. NorthQuest certifies that it understands and will comply with these restrictions.

18. Liability and term

Each party's liability under this DPA and the Clauses is subject to the limits in the Terms, except where the law or the Clauses don't allow it. This DPA lasts as long as NorthQuest processes Customer Data for you.

19. Contact

NorthQuest LLC, 30 N. Gould Street, Ste N, Sheridan, WY 82801, USA. Data protection questions: legal@northquest.io.