1022-00007 · Northgate Telecommunications PLC · DPIAs

dpia-007-marketing-profiling.docx DOCUMENT Finance & Banking

14 / 39 ← → ✕

Contract analysis Extract to table

DATA PROTECTION IMPACT ASSESSMENT

DPIA-007: Marketing Profiling and Targeted Advertising

(NorthCloud Freemium Tier)

CONFIDENTIAL — LEGAL PRIVILEGED

Right-click to update Table of Contents

1. Introduction and Purpose

1.1 Background to the Assessment

This Data Protection Impact Assessment ("DPIA") is conducted pursuant to Article 35 of the UK General Data Protection Regulation ("UK GDPR") and the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), which require a data protection impact assessment to be carried out where a type of processing — in particular one using new technologies and taking into account the nature, scope, context, and purposes of the processing — is likely to result in a high risk to the rights and freedoms of natural persons. This assessment is prepared by Calderwood & Harkness LLP ("C&H") on behalf of and at the instruction of Northgate Telecommunications PLC ("NTP" or the "Company").

NTP is a United Kingdom-headquartered public limited company incorporated in England and Wales (Company Number 04837291), with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT. NTP operates telecommunications infrastructure across the United Kingdom and the European Union, and provides enterprise Software-as-a-Service ("SaaS") solutions through its NorthCloud platform. NTP is a significant market participant in the European unified communications and collaboration sector, with a substantial and growing customer base across multiple jurisdictions.

The NorthCloud platform is a cloud-based unified communications platform sold on a business-to-business ("B2B") basis across fourteen (14) EU/EEA member states, in addition to the United Kingdom. NorthCloud is supported by a geographically distributed data centre infrastructure, with primary hosting facilities located in London, Frankfurt, Amsterdam, and Dublin. The platform provides a comprehensive suite of enterprise communication, collaboration, and productivity tools.

NTP's NorthCloud service includes a freemium tier, which provides a free, entry-level version of the NorthCloud platform to prospective enterprise and small-business customers. The freemium tier serves as a primary acquisition channel for NTP, allowing prospective customers to experience the platform's core functionality before committing to a paid subscription. In connection with the freemium tier, NTP conducts marketing profiling and targeted advertising activities directed at freemium-tier users with the objectives of (a) converting those users to paid NorthCloud subscriptions and (b) delivering third-party advertising to monetise the freemium offering.

It is these marketing profiling and targeted advertising activities that are the subject of this DPIA. The processing activities described herein involve the systematic collection, analysis, and use of personal data relating to freemium-tier users for the purposes of behavioural profiling, interest-based segmentation, cross-device tracking, automated content personalisation, and programmatic advertising delivery. As set out in further detail below, these activities involve processing on a large scale and entail systematic and extensive evaluation of personal aspects of natural persons based on automated processing, including profiling, which together meet the thresholds for mandatory DPIA under Article 35(3)(a) and (b) of the UK GDPR and EU GDPR.

NTP processes personal data of approximately 6.3 million consumer subscribers and approximately 42,000 enterprise clients across its UK and EU operations. The freemium tier specifically serves an estimated 340,000 active users across the UK and EU, representing a significant processing population.

For the purposes of EU GDPR compliance, NTP's lead EU data protection supervisory authority is the Data Protection Commission of Ireland (the "DPC"), by virtue of NTP's EU establishment through its subsidiary Northgate Ireland Ltd (Companies Registration Office Number: 587214), registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland. Northgate Ireland Ltd serves as NTP's main establishment in the European Union for the purposes of the one-stop-shop mechanism under Article 56 of the EU GDPR.

In the United Kingdom, NTP is registered with the Information Commissioner's Office ("ICO") under registration number ZA482917. The ICO is NTP's competent supervisory authority for UK GDPR purposes.

1.2 Regulatory Context and Prior Enforcement

The regulatory context for this DPIA is materially informed by NTP's prior enforcement history and ongoing supervisory scrutiny, both of which are directly relevant to the processing activities assessed herein.

On 15 September 2021, the ICO issued an Enforcement Notice to NTP bearing reference ENF/2021/0934 (the "Enforcement Notice"). The Enforcement Notice concerned inadequate consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal. Specifically, the ICO found that NTP's cookie consent implementation on the NorthCloud platform failed to meet the requirements of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and Articles 6(1)(a) and 7 of the UK GDPR, in that consent was not freely given, was not sufficiently specific, and was obtained through pre-ticked boxes and bundled consent mechanisms that did not allow users to exercise genuine choice regarding different categories of cookies. A monetary penalty of £320,000 was imposed and paid by NTP. NTP completed the mandated remediation measures in March 2022.

The prior Enforcement Notice is directly relevant to this DPIA. The processing activities assessed herein concern marketing profiling and targeted advertising conducted on the same NorthCloud platform ecosystem, and the consent mechanism deficiencies that formed the basis of the Enforcement Notice bear material similarity to deficiencies identified in the current assessment. As set out in Section 5 below, the legacy of this enforcement action places NTP under heightened regulatory scrutiny and increases the severity of compliance failures in this area. Any recurrence of similar deficiencies would likely result in substantially increased penalties and reputational harm.

Additionally, in November 2022, the DPC (Ireland) opened a preliminary inquiry (reference IN-22-11-3) concerning cross-border data transfers from Northgate Ireland Ltd to third countries. While this inquiry is primarily directed at NTP's broader international data transfer arrangements, it touches upon data flows underpinning certain marketing analytics activities conducted through the NorthCloud platform, including some of the processing activities that are the subject of this DPIA. The inquiry remains open as of the date of this assessment, and its outcome may have implications for the transfer mechanisms relied upon for marketing data sharing with third-party advertising technology partners.

These enforcement and supervisory developments underscore the importance of ensuring that the processing activities assessed in this DPIA are conducted in full compliance with applicable data protection law, and that any identified risks are mitigated to the fullest extent practicable.

1.3 Legal Basis for Conducting This DPIA

The legal obligation to conduct this DPIA arises from Article 35(1) of the UK GDPR and EU GDPR, which provides that where a type of processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.

The processing activities described in this DPIA satisfy multiple criteria that trigger the mandatory DPIA requirement:

(a) Article 35(3)(a): The processing involves a systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling. The marketing profiling system creates behavioural profiles of freemium-tier users, assigns propensity scores, segments users into marketing cohorts, and delivers personalised content and advertising based on those profiles. While the marketing decisions based on this profiling may not in all cases produce legal effects or similarly significant effects on data subjects, the systematic and extensive nature of the evaluation, combined with the scale of processing, brings this activity within the scope of Article 35(3)(a).

(b) Article 35(3)(b): The processing involves processing on a large scale of personal data. Approximately 340,000 active freemium-tier users are subject to the profiling activities described herein, across fifteen jurisdictions (the UK and fourteen EU/EEA member states). This constitutes large-scale processing within the meaning of Article 35(3)(b) and Recital 91 of the GDPR.

In addition, guidance from both the ICO and the European Data Protection Board ("EDPB") confirms that profiling for marketing purposes, when combined with large-scale processing and the use of innovative or intrusive technologies (such as cross-device tracking, behavioural analytics, and real-time bidding), triggers a mandatory DPIA. The EDPB's Guidelines on Data Protection Impact Assessment (WP 248 rev.01) identify multiple criteria that, when present in combination, indicate a high-risk processing operation. The present case engages at least five of the nine EDPB criteria: (i) evaluation or scoring (profiling); (ii) automated decision-making with legal or similarly significant effect (potentially, in the case of conversion-gating); (iii) systematic monitoring; (iv) processing on a large scale; and (v) innovative use or application of new technological solutions (cross-device tracking, probabilistic matching).

This DPIA was mandated by the NTP Board Audit & Risk Committee pursuant to a resolution dated 8 December 2022, which directed the comprehensive build-out of NTP's GDPR compliance programme, including the completion of Data Protection Impact Assessments for all high-risk processing activities identified in the preliminary data mapping and risk assessment conducted by C&H and Ashdown Consulting Group Ltd in Phase 1 of the engagement.

1.4 Scope of This DPIA

This DPIA covers all marketing profiling and targeted advertising activities conducted on users of the NorthCloud freemium tier across the United Kingdom and European Union jurisdictions in which NorthCloud operates.

The processing activities within scope include, without limitation:

(a) behavioural profiling of freemium-tier users based on in-platform usage data;

(b) interest-based segmentation and cohort assignment;

(c) cross-device tracking, including both deterministic (login-based) and probabilistic (fingerprinting-based) device association;

(d) third-party advertising delivery, including participation in real-time bidding ("RTB") ecosystems;

(e) conversion analytics, including propensity scoring and churn risk modelling;

(f) automated content personalisation, including personalised in-platform messages, email campaigns, and feature recommendations; and

(g) retargeting campaigns conducted on external platforms using hashed identifiers and cookie-syncing techniques.

The geographic scope of this DPIA encompasses processing conducted by NTP PLC (UK) and the following EU subsidiaries involved in NorthCloud operations:

• Northgate Ireland Ltd (CRO Number: 587214; Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland);

• Northgate GmbH (HRB 214503 B; Friedrichstraße 91, 10117 Berlin, Germany);

• Northgate B.V. (KvK 72841936; Herikerbergweg 44, 1101 CM Amsterdam, Netherlands);

• Northgate France SAS (SIREN 891 247 503; 27 Rue de Berri, 75008 Paris, France); and

• Northgate Iberia S.L. (CIF B-91847263; Calle de Serrano 41, 28001 Madrid, Spain).

Exclusions: This DPIA does not cover the paid and enterprise tiers of the NorthCloud platform. The paid/enterprise tiers are subject to separate controller-processor arrangements and rely on different lawful bases for processing (principally, performance of contract). Marketing profiling on the paid/enterprise tiers, to the extent it occurs, is subject to separate assessment. Additionally, this DPIA does not cover NTP's broader telecommunications services or its non-NorthCloud product offerings, which are addressed in separate assessments as appropriate.

2. Systematic Description of Processing Operations

In accordance with Article 35(7)(a) of the UK GDPR and EU GDPR, this section provides a systematic description of the envisaged processing operations, including the purposes of processing and, where applicable, the legitimate interests pursued by the controller.

2.1 Nature of the Processing

The marketing profiling and targeted advertising activities on the NorthCloud freemium tier involve the following categories of processing operations:

User Registration Data Collection. At the point of freemium tier sign-up, NTP collects registration data from prospective users, including: full name, email address, business name, job title, and geographic location. This data is collected through the NorthCloud sign-up form on both the web and mobile application interfaces. The registration data forms the foundational layer of the user's marketing profile.

In-Platform Behavioural Tracking. Following registration, NTP tracks user behaviour within the NorthCloud freemium platform on an ongoing basis. The tracked behavioural data includes: feature usage patterns (which features are accessed, in what order, and how frequently); session duration and frequency; feature adoption sequences (the chronological order in which features are first used); and communication metadata (the frequency and timing of communications initiated through the platform, excluding the content of those communications). This tracking is conducted through server-side event logging and client-side analytics instrumentation embedded in the NorthCloud web and mobile interfaces.

Cookie and Tracking Technology Deployment. NTP deploys first-party and third-party cookies, tracking pixels, software development kits ("SDKs"), and similar tracking technologies on the NorthCloud web and mobile interfaces. These technologies collect browsing behaviour (pages viewed, click paths, scroll depth), device information (device type, operating system version, browser type and version, screen resolution, language settings), IP addresses, and referral data (the source from which the user arrived at the NorthCloud platform, including UTM campaign parameters). A comprehensive register of cookies and tracking technologies is provided at Appendix C.

Cross-Device Tracking. NTP links user activity across desktop web, mobile web, and native mobile application interfaces through two distinct matching methodologies:

(i) Deterministic matching: where a user is logged into their NorthCloud account on multiple devices, activity across those devices is linked through the common user identifier associated with the authenticated session. This form of matching is transparent and under the user's direct control, as it is contingent upon the user's decision to log in.

(ii) Probabilistic matching: in addition to deterministic matching, NTP employs probabilistic cross-device association techniques, including browser fingerprinting and statistical inference of device associations based on shared IP addresses, temporal usage patterns, and device attribute correlations. Probabilistic matching enables NTP to associate activity across devices even where the user is not logged in on all devices, but operates without explicit user awareness or consent.

Profile Creation and Enrichment. The data collected through the foregoing mechanisms is aggregated and processed to create user profiles that incorporate: behavioural data (usage patterns, engagement metrics); inferred interests (based on feature usage and content interaction); predicted propensity to convert to a paid NorthCloud subscription (a numerical score derived from a machine learning model trained on historical conversion data); predicted churn risk (a score indicating the likelihood that the user will abandon the freemium service); and demographic and firmographic inferences (estimated company size, industry vertical, and seniority level of the user, derived from a combination of registration data and behavioural signals).

Automated Segmentation and Cohort Assignment. User profiles are processed through automated segmentation algorithms that assign each user to one or more marketing cohorts. These cohorts are defined by combinations of behavioural, demographic, and firmographic attributes and are used to determine the marketing content and advertising delivered to each user. Segment assignment is updated on a rolling basis as new behavioural data is collected.

Personalised Marketing Delivery. Based on segment assignment, NTP delivers personalised marketing content to freemium-tier users through multiple channels:

(a) In-platform messages: personalised banners, feature recommendations, and upgrade prompts displayed within the NorthCloud interface;

(b) Email campaigns: targeted email communications promoting paid-tier features, special offers, and product updates, delivered through NTP's marketing automation platform; and

(c) Third-party display advertising: targeted advertisements delivered on external websites and applications through programmatic advertising networks.

Real-Time Bidding Participation. For third-party advertising, NTP participates in the real-time bidding ("RTB") ecosystem. This involves the sharing of pseudonymised user data segments with advertising demand-side platforms ("DSPs") and ad exchanges. When a freemium-tier user visits a webpage or opens an application that participates in the same advertising exchange, a bid request is generated containing the user's pseudonymised segment information (but not direct identifiers), which is broadcast to multiple DSPs that evaluate the bid opportunity and, if interested, submit a bid to display an advertisement to that user. The winning bidder's advertisement is then displayed. This process occurs in real time, typically within 100 milliseconds.

Retargeting Campaigns. NTP conducts retargeting campaigns on external platforms (including major social media platforms and display advertising networks) using hashed email identifiers and cookie-syncing techniques. These campaigns are designed to re-engage freemium-tier users who have shown high propensity to convert but have not yet upgraded to a paid subscription.

2.2 Purpose of the Processing

The processing activities described in Section 2.1 serve the following purposes:

Primary Purpose — Conversion Marketing. The primary purpose of the processing is the conversion of freemium-tier users to paid NorthCloud subscriptions through personalised marketing and targeted feature recommendations. The freemium tier is a core component of NTP's customer acquisition strategy, and the ability to deliver relevant, personalised marketing based on each user's behaviour and characteristics is integral to the commercial viability of the freemium model. NTP's legitimate commercial interest lies in maximising the conversion rate from freemium to paid subscriptions, thereby sustaining and growing the NorthCloud revenue base.

Secondary Purpose — Freemium Tier Monetisation. The secondary purpose is the monetisation of the freemium tier through the delivery of third-party targeted advertising. Because freemium-tier users do not pay a subscription fee, advertising revenue partially offsets the cost of providing the free service. The profiling and segmentation activities enable NTP to offer advertisers the ability to reach relevant audiences, which generates higher advertising yields than would be achievable with untargeted advertising.

Tertiary Purpose — Product Development Insights. A tertiary purpose of the processing is the generation of aggregated analytics on freemium user behaviour to inform the NorthCloud product roadmap. Aggregated behavioural data — analysed at a cohort level rather than an individual level — provides insights into feature adoption patterns, user experience friction points, and unmet user needs. This purpose is overseen by Laura Dearden, VP Product & Engineering, NorthCloud, and relies on aggregated and anonymised data outputs rather than individual-level profiles.

2.3 Categories of Personal Data Processed

The following categories of personal data are processed in connection with the marketing profiling and targeted advertising activities:

Identification Data. Full name, email address, business name, job title, and unique NorthCloud user identifier.

Contact Data. Email address, and telephone number where voluntarily provided by the user during registration or account setup.

Device and Technical Data. Internet Protocol ("IP") address, device type and model, operating system name and version, browser type and version, mobile advertising identifiers (Tidewater Industries Identifier for Advertisers ("IDFA") and Severin Industries Advertising Identifier ("GAID")), screen resolution, and device language settings.

Behavioural Data. In-platform usage logs recording feature interactions, session timestamps (start time, end time, and duration), click-stream data capturing the sequence of user actions within the platform, page views, and search queries entered within the NorthCloud platform interface.

Tracking Data. Cookie identifiers (both first-party and third-party), pixel tracking data, cross-device graph data (associations between device identifiers attributed to the same user), referral URLs (the webpage from which the user navigated to NorthCloud), and UTM campaign parameters (source, medium, campaign name, term, and content identifiers).

Inferred and Derived Data. Marketing segment assignments, interest category classifications (e.g., "collaboration-focused," "security-conscious," "video-heavy user"), propensity scores (conversion likelihood score on a 0-100 scale, churn risk score on a 0-100 scale), and firmographic inferences (estimated company size band, estimated industry vertical, estimated seniority level).

Communication Metadata. Frequency and timing of communications initiated by the user through the NorthCloud platform, including the number of messages, calls, and meetings initiated or received per period. This category expressly excludes the content of any communications, which is not accessed or processed for marketing purposes.

Location Data. Approximate geolocation derived from IP address (typically accurate to city or regional level). In addition, precise geolocation data may be collected from users of the NorthCloud mobile application who have granted location permissions through the mobile operating system. Precise geolocation data is used for location-based advertising targeting where available.

Special Category Data. No special category data (as defined in Article 9(1) of the UK GDPR and EU GDPR) is intentionally collected or processed as part of the marketing profiling activities. However, the risk assessment in Section 5 identifies that behavioural profiling carries a non-trivial risk of incidental inference of special category attributes, such as political opinions, religious beliefs, or health status, through patterns of behaviour or feature usage that may serve as proxies for such characteristics. This risk is addressed in the mitigation measures set out in Section 6.4.

2.4 Categories of Data Subjects

The data subjects affected by the processing activities described in this DPIA are users of the NorthCloud freemium tier. As of the date of this assessment, the freemium tier has approximately 340,000 active users across the UK and the fourteen EU/EEA member states in which NorthCloud operates. This figure represents a subset of NTP's total data subject population of approximately 6.3 million consumer subscribers and 42,000 enterprise clients.

The freemium-tier user population is predominantly composed of small-business owners, IT decision-makers, and individual professionals who are evaluating unified communications platforms for adoption by their organisations. The demographic and professional profile of freemium-tier users is diverse, spanning multiple industries, seniority levels, and geographic locations within the UK and EU.

Users of the freemium tier span all fifteen jurisdictions in which NorthCloud operates: the United Kingdom, Ireland, Germany, the Netherlands, France, Spain, Italy, Belgium, Austria, Sweden, Denmark, Finland, Poland, Portugal, and the Czech Republic. The geographic distribution of users broadly correlates with NTP's commercial presence in each market, with the United Kingdom, Germany, and the Netherlands representing the largest user populations.

2.5 Recipients and Data Sharing

Personal data processed in connection with the marketing profiling and targeted advertising activities is shared with the following categories of recipients:

Internal Recipients within NTP Group.

(a) NTP Marketing Team: Accesses user profile data, segment assignments, and campaign performance analytics for the purpose of planning, executing, and optimising marketing campaigns directed at freemium-tier users.

(b) NorthCloud Product Team: Receives aggregated behavioural analytics (not individual-level profiles) for product development purposes, under the oversight of Laura Dearden, VP Product & Engineering.

(c) NTP Data Analytics Team: Processes behavioural data and marketing performance metrics to generate insights, reporting, and predictive models in support of the marketing and product functions.

Third-Party Advertising Partners. Pseudonymised user segment data is shared with advertising demand-side platforms and ad exchanges through the RTB ecosystem. These partners receive bid requests containing segment identifiers, approximate geolocation, device type, and other non-directly-identifying attributes. They do not receive direct identifiers (names, email addresses, or NorthCloud user IDs) as part of the standard RTB bid stream. However, the combination of data points contained in bid requests may, in certain circumstances, be sufficient to enable re-identification when combined with other data sources available to the recipient.

Third-Party Cookie and Tracking Technology Providers. Analytics and measurement partners whose tracking technologies (cookies, pixels, SDKs) are embedded on the NorthCloud web and mobile interfaces receive data collected through those technologies. These include analytics platforms, attribution and measurement services, and advertising verification providers. A complete register of these technologies is provided at Appendix C.

Processors and Sub-Processors. The NorthCloud platform and its associated marketing data infrastructure are hosted by Pinnacle Cloud Services Ltd ("Pinnacle") (Company Number 09142837; Apex House, 24 Victoria Embankment, London EC4Y 0DZ), which acts as a data processor on behalf of NTP. Pinnacle's sub-processor chain includes:

(i) Pinnacle India Pvt Ltd (Corporate Identification Number: U72200HR2016PTC065412; Gurugram, Haryana, India), which provides infrastructure support and monitoring services and has remote access to the hosting environment for those purposes; and

(ii) Pinnacle APAC Pte Ltd (Unique Entity Number: 201824567K; Singapore), which provides infrastructure support and monitoring services for the Asia-Pacific region and similarly has remote access capabilities.

Both Pinnacle sub-processors are engaged under the terms of the amended Data Processing Agreement between NTP and Pinnacle executed on 28 June 2023, which incorporates EU Standard Contractual Clauses Module 3 (Processor to Sub-processor) and the UK Addendum to the EU SCCs, together with applicable supplementary measures.

Data Mapping Context. This marketing profiling processing activity is among the 147 total processing activities catalogued in NTP's Record of Processing Activities ("ROPA"), of which 89 are recorded in the UK ROPA (maintained by NTP PLC) and 58 are recorded in the ROPAs of the EU subsidiaries. The NorthCloud freemium marketing profiling activity is recorded as a distinct entry in both the UK ROPA and the relevant EU subsidiary ROPAs, reflecting the cross-border nature of the processing.

2.6 Data Flows and International Transfers

Primary Data Storage. NorthCloud customer data for EU-based freemium-tier users is hosted in Pinnacle Cloud Services data centres located in Dublin, Ireland and Frankfurt, Germany. Customer data for UK-based freemium-tier users is hosted in Pinnacle's London, United Kingdom data centre. The allocation of data to storage locations is determined by the user's country of registration, in accordance with NTP's data residency architecture.

International Transfers. The processing activities described in this DPIA give rise to international transfers of personal data to third countries that have not been the subject of an adequacy decision by the European Commission or the UK Secretary of State. The following international transfers are identified:

(a) Pinnacle Sub-Processor Chain — India: Personal data stored in the Dublin and Frankfurt data centres is accessible remotely by Pinnacle India Pvt Ltd in Gurugram, India, for the purposes of infrastructure support and monitoring. India has not been the subject of an adequacy decision. This transfer is covered by EU Standard Contractual Clauses Module 3 (Processor to Sub-processor) and the UK Addendum to the EU SCCs, as incorporated into the amended DPA between NTP and Pinnacle executed on 28 June 2023. A Transfer Impact Assessment ("TIA") has been conducted (TIA-002: Pinnacle → Pinnacle India Pvt Ltd), which concludes that the transfer mechanisms and supplementary measures in place provide an essentially equivalent level of protection.

(b) Pinnacle Sub-Processor Chain — Singapore: Personal data stored in the Dublin and Frankfurt data centres is accessible remotely by Pinnacle APAC Pte Ltd in Singapore for similar infrastructure support purposes. While Singapore has not received a blanket adequacy decision from the European Commission, the transfer is similarly covered by EU SCCs Module 3 and the UK Addendum. A TIA has been conducted (TIA-003: Pinnacle → Pinnacle APAC Pte Ltd).

(c) Third-Party Advertising Technology Partners — United States: Pseudonymised user segment data is shared with third-party advertising technology partners (DSPs, ad exchanges, and retargeting platforms), certain of which operate servers and process data in the United States. Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18) and the subsequent adoption of the EU-US Data Privacy Framework, transfers to certified US recipients may rely on the adequacy decision of 10 July 2023. For non-certified recipients, transfers are addressed through EU SCCs Module 2 (Controller to Processor) and the UK International Data Transfer Agreement ("IDTA") where applicable.

Supplementary Measures. In accordance with EDPB Recommendations 01/2020 on supplementary measures, the following technical measures are applied to all international transfers of marketing data:

• AES-256 encryption at rest for all personal data stored in Pinnacle data centres;

• TLS 1.3 encryption in transit for all data transmissions between NTP systems, Pinnacle data centres, and sub-processor access points; and

• Pseudonymisation of direct identifiers (names, email addresses) before any transfer to third-party advertising technology partners or before data is made accessible to Pinnacle sub-processors in India and Singapore.

Cross-References. The international transfer arrangements described in this section are documented in further detail in the following related deliverables: TIA-002 (Pinnacle → Pinnacle India Pvt Ltd); TIA-003 (Pinnacle → Pinnacle APAC Pte Ltd); the amended DPA between NTP and Pinnacle Cloud Services Ltd (executed 28 June 2023); and NTP's International Transfers Policy & Mechanism Selection Guidance.

2.7 Data Retention

Personal data processed in connection with the NorthCloud freemium-tier marketing profiling and targeted advertising activities is retained in accordance with the following periods, which are aligned with NTP's Data Retention Schedule:

Freemium User Registration Data. Registration data (name, email, business name, job title, location) is retained for the duration of the user's active freemium account, plus twelve (12) months following account closure or deletion. The twelve-month post-closure retention period is maintained to support re-engagement marketing (subject to applicable consent) and to address any post-closure data subject rights requests or disputes.

Behavioural and Tracking Data. Behavioural usage logs and tracking data (including cookie identifiers, click-stream data, device data, and location data) are retained for a maximum period of thirteen (13) months from the date of collection. This retention period is aligned with ICO guidance on cookie lifespans and the CNIL's recommendation that analytics cookies should not persist beyond thirteen months. Upon expiry of the retention period, behavioural and tracking data is automatically deleted from active systems.

Marketing Profiles and Segment Assignments. Marketing profiles, including propensity scores and segment assignments, are refreshed on a rolling ninety (90) day window. Profile data older than ninety days is either overwritten by refreshed data or, where retained for analytical purposes, is anonymised and aggregated such that individual users cannot be identified. Historical segment data retained in anonymised and aggregated form is maintained indefinitely for trend analysis and product development purposes, but is no longer personal data within the meaning of Article 4(1) of the GDPR.

Cookie Consent Records. Records of user consent (or refusal of consent) for cookies and tracking technologies are retained for the duration of the consent validity period, plus three (3) years thereafter. The extended retention of consent records is maintained for accountability purposes, to demonstrate compliance with the consent requirements of Article 7(1) of the UK GDPR and EU GDPR, and Regulation 6 of PECR.

The detailed retention periods for all categories of data processed by NTP are recorded in NTP's Data Retention Schedule, which forms part of the GDPR programme deliverables prepared by C&H.

2.8 Technology and Infrastructure

The marketing profiling and targeted advertising activities are supported by the following technology and infrastructure components:

Hosting Infrastructure. The NorthCloud platform is hosted on Pinnacle Cloud Services Ltd's Infrastructure-as-a-Service ("IaaS") and Platform-as-a-Service ("PaaS") infrastructure. Pinnacle provides compute, storage, and networking resources across its Dublin, Frankfurt, London, and Amsterdam data centres. The hosting arrangement is governed by the amended DPA between NTP and Pinnacle, which includes detailed technical and organisational security measures.

Marketing Automation Platform. NTP utilises a marketing automation platform that is integrated into the NorthCloud platform infrastructure. This platform manages email campaign delivery, in-platform messaging, user journey orchestration, and campaign performance analytics. The marketing automation platform is configured to interface with the user profile and segmentation databases to enable personalised content delivery.

Consent Management Platform. As part of the mitigation measures identified in this DPIA (see Section 6.1), NTP is implementing a granular Consent Management Platform ("CMP") on all NorthCloud freemium tier interfaces. The CMP will manage the collection, recording, and enforcement of user consent preferences for cookies and tracking technologies. The implementation of the CMP is a critical remediation measure and a precondition for the continuation of certain marketing profiling activities.

Sundial Solutions Privacy Management Platform. NTP has engaged Ashdown Consulting Group Ltd ("Ashdown") (Company Number 11293847; 15 Bedford Row, London WC1R 4BU) to configure the Sundial Solutions privacy management platform for NTP's use. Sundial Solutions is being configured by Ashdown to support: consent record-keeping, ROPA maintenance and reporting, DPIA tracking and documentation, data subject rights request management, vendor risk management, and data mapping. Anita Chakravarti, Lead Privacy Engineer at Ashdown, provided technical inputs on data flow mapping for this DPIA, including the identification of data collection points, data storage locations, internal and external data flows, and processing technology dependencies.

Analytics and Measurement Infrastructure. NTP deploys first-party and third-party analytics tools to measure platform usage, marketing campaign effectiveness, and advertising performance. These tools are implemented through JavaScript tags, tracking pixels, and mobile SDKs integrated into the NorthCloud web and mobile interfaces. All such technologies are catalogued in the register provided at Appendix C.

3. Assessment of Necessity and Proportionality

In accordance with Article 35(7)(b) of the UK GDPR and EU GDPR, this section assesses the necessity and proportionality of the processing operations in relation to their purposes.

3.1 Lawful Basis Analysis

The lawful bases currently relied upon or proposed for the marketing profiling and targeted advertising activities on the NorthCloud freemium tier are as follows:

Conversion Marketing — Legitimate Interest (Article 6(1)(f)). NTP relies on legitimate interest as the lawful basis for processing personal data for the purpose of converting freemium-tier users to paid NorthCloud subscriptions. This includes basic behavioural analytics, feature usage tracking, and the delivery of personalised in-platform messages and email communications promoting paid-tier features.

This processing activity is one of the 64 processing activities across NTP's operations (representing 43.5% of the 147 total processing activities catalogued in the ROPA) that rely on legitimate interest as their lawful basis. The reliance on legitimate interest for conversion marketing is assessed against the three-part test required by Article 6(1)(f) and the ICO's legitimate interests assessment guidance, as follows:

Purpose Test — Identification of Legitimate Interest. NTP has a legitimate commercial interest in converting freemium-tier users to paid subscribers. The freemium model is a deliberate customer acquisition strategy, and the conversion of free users to paying customers is essential to the economic sustainability of the NorthCloud platform. The interest is genuine, current, and not speculative. It does not conflict with any applicable law.

Necessity Test. Profiling and personalisation enable more efficient and relevant marketing than untargeted, generic approaches. Targeted marketing reduces the volume of communications required to achieve a given conversion rate and reduces user fatigue from irrelevant or excessive marketing contacts. In this sense, the processing is necessary to achieve the stated purpose — the conversion objective could not be achieved as effectively through less data-intensive means, at least to the extent that basic behavioural analytics and deterministic personalisation are concerned.

Balancing Test. The balancing exercise requires consideration of whether the legitimate interest is overridden by the interests, rights, or freedoms of data subjects. Several factors weigh in the balancing analysis:

• Reasonable expectations: Freemium-tier users may reasonably expect that NTP will use their registration data and basic usage data to deliver relevant marketing communications. The concept of a "freemium" model is widely understood, and users may anticipate that their use of a free service will be accompanied by marketing activity. However, users are unlikely to expect the degree of behavioural tracking, cross-device monitoring, and detailed profiling that NTP currently conducts. In particular, probabilistic cross-device matching (browser fingerprinting) and the creation of detailed behavioural profiles with propensity scores materially exceed the reasonable expectations of most users.

• Power imbalance: A degree of power imbalance exists between NTP and freemium-tier users. Users depend on the freemium service for their communications needs and may feel compelled to accept tracking and profiling as a condition of continued access, particularly where the consent mechanisms do not provide genuine free choice. This imbalance weighs against reliance on legitimate interest for more intrusive forms of processing.

• Impact on data subjects: The profiling activities may have tangible impacts on users, including receiving differential marketing treatment based on their profile (e.g., users with low propensity scores may receive fewer promotional offers), and exposure to targeted advertising that reflects inferred interests and behaviours. While these impacts are generally not of the same gravity as decisions producing legal effects, they constitute a meaningful intrusion into informational self-determination.

• Safeguards: NTP offers a general opt-out mechanism for marketing communications, but currently does not provide granular control over profiling specifically. The mitigation measures in Section 6 address this gap.

Conclusion on Legitimate Interest. Legitimate interest under Article 6(1)(f) is supportable as the lawful basis for basic conversion marketing activities, including the use of registration data and in-platform behavioural analytics for personalised feature recommendations and email marketing, provided that transparent and easily accessible opt-out mechanisms are available and immediately effective. However, legitimate interest is not an appropriate lawful basis for the following processing activities, which exceed the boundaries of what can be justified under the balancing test:

(a) Cross-device tracking using probabilistic (fingerprinting-based) matching methods;

(b) The creation of detailed behavioural profiles incorporating extensive inferred and derived data (propensity scores, firmographic inferences) without explicit user awareness; and

(c) Third-party advertising data sharing via RTB, which serves NTP's commercial interests in advertising monetisation rather than a direct benefit to the data subject.

These processing activities require consent under Article 6(1)(a) of the UK GDPR and EU GDPR.

Third-Party Advertising Cookies — Consent (Article 6(1)(a)). NTP relies on consent as the lawful basis for the deployment of marketing and third-party advertising cookies and similar tracking technologies on the NorthCloud platform, and for the associated third-party advertising activities. This processing activity is one of the 9 processing activities (representing 6.1% of the 147 total) that rely on consent as their lawful basis.

The current consent mechanisms deployed on the NorthCloud freemium tier have been identified as deficient in several material respects:

(a) Pre-ticked boxes: In certain implementations of the cookie consent interface, marketing and advertising cookie categories are selected by default, requiring the user to actively deselect them. Pre-ticked boxes do not constitute valid consent under Article 7 and Recital 32 of the GDPR, as confirmed by the Court of Justice of the European Union in Planet49 (Case C-673/17).

(b) Bundled consent: The consent mechanism bundles multiple categories of cookies into a single consent action, rather than providing granular, purpose-specific consent options. Users are not given the ability to consent to analytics cookies while declining advertising cookies, for example.

(c) Insufficient granularity: The privacy information provided at the point of consent collection does not adequately distinguish between the different categories of cookies and tracking technologies deployed, nor the different purposes they serve.

(d) Lack of genuine free choice: In some implementations, access to the NorthCloud freemium tier is conditioned on acceptance of all cookie categories, including marketing and advertising cookies. This conditioning undermines the "freely given" requirement of Article 7, as users cannot use the freemium service without accepting non-essential cookies. The EDPB's Guidelines 05/2020 on consent under Regulation 2016/679 make clear that where consent is a condition for provision of a service, and the processing is not necessary for the provision of that service, consent is unlikely to be freely given.

These deficiencies echo, in material substance, the issues identified by the ICO in Enforcement Notice ENF/2021/0934 (dated 15 September 2021), which concerned inadequate consent mechanisms for direct marketing cookies on the same NorthCloud portal. The persistence of similar deficiencies on the freemium tier — notwithstanding the remediation completed on the customer portal in March 2022 — represents a significant compliance risk and underscores the urgency of the consent mechanism redesign recommended in Section 6.1.

Conclusion on Consent. The consent mechanisms deployed on the NorthCloud freemium tier must be fundamentally redesigned to meet the requirements of Article 6(1)(a), Article 7, and Recital 32 of the UK GDPR and EU GDPR. Consent must be freely given, specific, informed, and unambiguous, and must be demonstrated by a clear affirmative action. The redesigned consent mechanisms are described in Section 6.1.

ePrivacy Directive / PECR Considerations. Independent of the GDPR lawful basis analysis, the storage of and access to information on a user's terminal equipment (i.e., the setting and reading of cookies, the operation of tracking pixels, and the execution of SDKs) is subject to the prior consent requirement of Article 5(3) of the ePrivacy Directive 2002/58/EC, as implemented in the UK by Regulation 6 of PECR, and in relevant EU member states by their respective national implementing legislation. The only exception to this consent requirement is for technologies that are strictly necessary for the provision of an information society service explicitly requested by the user. Marketing and advertising cookies, profiling cookies, and third-party tracking technologies do not fall within this exception and therefore require prior consent. This requirement applies irrespective of the GDPR lawful basis relied upon for the broader processing.

3.2 Necessity Assessment

This section assesses whether the processing activities described in Section 2 are necessary for the achievement of the stated purposes identified in Section 2.2.

Basic conversion marketing analytics — including the tracking of in-platform feature usage, the identification of users who are highly engaged with the freemium service, and the delivery of personalised upgrade prompts and feature recommendations — are reasonably necessary to sustain the freemium business model and to achieve the primary purpose of converting free users to paying subscribers. Without any behavioural analytics capability, NTP would be limited to generic, untargeted marketing, which would be less effective and would require higher volumes of marketing communications, potentially resulting in greater user fatigue and a worse user experience.

However, several elements of the current processing go beyond what is strictly necessary to achieve the stated purposes:

(a) Probabilistic cross-device matching is not strictly necessary for conversion marketing. Deterministic (login-based) cross-device association — which links user activity across devices only where the user is actively logged into their NorthCloud account — is sufficient to deliver a coherent cross-device marketing experience. The incremental benefit of probabilistic matching (extending cross-device tracking to situations where the user is not logged in) is modest relative to the additional intrusiveness and opacity it entails.

(b) Granular behavioural profiling for third-party advertising purposes is not necessary for the primary conversion marketing purpose. While advertising monetisation serves NTP's commercial interest in sustaining the freemium tier, the creation of detailed behavioural profiles for the purpose of selling targeted advertising to third parties is a separate commercial objective that introduces additional data processing and data sharing beyond what is needed for NTP's own conversion marketing.

(c) Real-time bidding data sharing exposes pseudonymised user data to a wide ecosystem of demand-side platforms and ad exchanges, many of which NTP has no direct contractual relationship with. The breadth of data dissemination inherent in the open RTB ecosystem exceeds what is necessary for NTP's direct marketing objectives and creates data security and re-identification risks that are not commensurate with the conversion marketing purpose.

3.3 Proportionality Assessment

The proportionality assessment considers whether the volume and intrusiveness of the data processing is proportionate to the benefits sought, both for NTP and for data subjects.

The current scope of data collection and tracking on the NorthCloud freemium tier is extensive. The combination of in-platform behavioural tracking, cookie-based browsing tracking, cross-device association (including probabilistic methods), and third-party advertising data sharing creates a comprehensive surveillance infrastructure that captures a detailed picture of each user's digital behaviour across multiple devices, contexts, and platforms. The volume and granularity of data collected, and the intrusiveness of the tracking mechanisms employed (particularly probabilistic fingerprinting), are disproportionate to the stated conversion marketing objective.

The third-party advertising data sharing introduces additional risks — including loss of control over data in the RTB ecosystem, re-identification risk, and exposure to a wide range of third-party recipients — without delivering a commensurate benefit to data subjects. Freemium-tier users do not receive improved service quality or additional features in exchange for their exposure to targeted advertising; the benefit flows primarily to NTP (in the form of advertising revenue) and to third-party advertisers.

The proportionality of the processing can be materially improved through the implementation of data minimisation, purpose limitation, and granular consent mechanisms. Specifically:

• discontinuing probabilistic cross-device matching reduces intrusiveness without materially impairing conversion marketing effectiveness;

• Implementing granular consent for different categories of marketing and advertising gives users meaningful control over the extent of their exposure to profiling and tracking;

• Transitioning from open RTB to private marketplace or direct deal arrangements limits the breadth of data dissemination; and

• Enforcing strict retention limits ensures that the volume of stored personal data does not grow beyond what is necessary for current marketing purposes.

The processing involves approximately 340,000 active freemium-tier users, which constitutes large-scale processing. The scale of the processing amplifies both the benefits and the risks: the larger the user population, the greater the commercial value of effective conversion marketing, but also the greater the potential harm in the event of a data breach, unauthorised data sharing, or systematic rights violation.

3.4 Data Subject Rights Safeguards

NTP has established data subject rights procedures in accordance with Articles 15–22 of the UK GDPR and EU GDPR, as documented in NTP's Data Subject Rights Procedure. Data subject rights requests are managed through a centralised intake process, with a service level agreement of one (1) calendar month for response, extendable by two (2) additional months for complex or high-volume requests, in accordance with Article 12(3).

The following data subject rights are particularly relevant to the marketing profiling and targeted advertising activities:

Right to Object to Direct Marketing Profiling (Article 21(2)). The right to object to processing for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, is an absolute right that must be available to data subjects prominently and easily. The current NorthCloud freemium-tier interface provides users with general privacy settings, but the ability to exercise a granular objection to marketing profiling specifically is limited. As part of the mitigation measures in Section 6.8, NTP will implement prominent, one-click opt-out mechanisms that are immediately effective.

Rights Regarding Solely Automated Decision-Making (Article 22). Article 22(1) provides that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The assessment of whether the profiling-based marketing decisions made in connection with the NorthCloud freemium tier fall within the scope of Article 22 requires consideration of whether those decisions produce legal effects or similarly significant effects on data subjects.

In the majority of cases, the marketing personalisation delivered through the freemium-tier profiling system — such as the selection of which upgrade prompts, feature recommendations, or advertisements a user sees — does not produce legal effects or similarly significant effects. However, one identified practice, referred to internally as "conversion-gating," involves the restriction or modification of certain freemium-tier features or functionality based on a user's profile score (e.g., reducing access to certain features for users assessed as having low conversion propensity, in order to create an incentive to upgrade). Conversion-gating could, depending on its implementation, cross the threshold into "similarly significant effects" as contemplated by Article 22(1), particularly if it materially limits the user's ability to use the service. This practice must be monitored and, if it produces similarly significant effects, must be brought within the safeguards of Article 22, including the provision of meaningful information about the logic involved, the right to obtain human intervention, and the right to contest the decision.

Right of Access (Article 15) and Right to Information (Articles 13–14). Data subjects have the right to access the personal data held about them, including information about the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing. The current privacy notice disclosures are assessed as insufficient in this regard (see Risk 2 in Section 5.2). Enhanced transparency measures are recommended in Section 6.2.

4. Consultation with Stakeholders

In accordance with Article 35(2) and (9) of the UK GDPR and EU GDPR, the controller has sought the views of relevant stakeholders in the preparation of this DPIA.

4.1 Internal Stakeholders Consulted

The following NTP internal stakeholders were consulted during the preparation of this DPIA:

Sanjay Mehta — Data Protection Officer, Northgate Telecommunications PLC. Mr Mehta was consulted throughout the preparation of this DPIA in accordance with Article 35(2), which requires the controller to seek the advice of the DPO where one has been designated. Mr Mehta holds the Certified Information Privacy Professional/Europe (CIPP/E) certification from the International Association of Privacy Professionals. He was appointed as NTP's DPO in March 2019 and reports to the General Counsel with a dotted-line reporting relationship to the Board Audit & Risk Committee, ensuring the organisational independence required by Article 38.

Mr Mehta advised on the regulatory risk profile of the processing, with particular reference to the context established by the prior ICO Enforcement Notice (ENF/2021/0934) and the active DPC preliminary inquiry (IN-22-11-3). He confirmed that the processing meets the triggers for mandatory DPIA under Article 35(3)(a) and (b). He provided input on the risk assessment methodology and reviewed the proposed mitigation measures for adequacy and feasibility. His formal DPO opinion is set out in Section 8.

Laura Dearden — VP, Product & Engineering, NorthCloud. Ms Dearden provided detailed technical descriptions of the NorthCloud profiling algorithms, data collection mechanisms, and cross-device tracking methodologies employed on the freemium tier. She described the product roadmap for the freemium tier, including planned expansions of profiling capabilities and new data collection features that informed the forward-looking risk assessment. Ms Dearden confirmed the technical feasibility of implementing the privacy-by-design controls and mitigation measures recommended in Section 6, including the CMP implementation, the discontinuation of probabilistic cross-device matching, the profiling transparency dashboard, and the algorithmic fairness testing framework.

Thomas Okoye — Chief Information Security Officer, Northgate Telecommunications PLC. Mr Okoye assessed the technical security measures applicable to the marketing data infrastructure, including encryption standards (AES-256 at rest, TLS 1.3 in transit), access controls (role-based access, multi-factor authentication for administrative access), network security (segmentation of marketing data systems from production communications systems), and the security governance framework applicable to third-party marketing technology integrations. Mr Okoye, who previously served as CISO at Meridian Digital Group, also assessed the security risks arising from the marketing technology stack (third-party SDKs, pixels, and analytics tags) and recommended the tag management governance controls described in Section 6.6.

Philippa Crane — Head of People & HR, Northgate Telecommunications PLC. Ms Crane was consulted on any employee-facing dimensions of the freemium-tier marketing activities. Specifically, C&H and Mr Mehta identified that NTP employees may, in certain circumstances, use the NorthCloud freemium tier for testing, product evaluation, or demonstration purposes, which could result in employee personal data being processed through the freemium marketing profiling system. Ms Crane confirmed that this overlap is minimal and that separate controls are in place: NTP employees using the freemium tier for internal purposes are provisioned with designated test accounts that are excluded from the marketing profiling system. No further employee privacy concerns were identified.

4.2 External Stakeholders Consulted

Ashdown Consulting Group Ltd. Ashdown was consulted in its capacity as NTP's privacy technology advisory partner. Robert Fairclough, Managing Director of Ashdown, and Anita Chakravarti, Lead Privacy Engineer at Ashdown, provided the following inputs to this DPIA:

(a) Data flow mapping outputs: Ashdown prepared detailed data flow maps for the NorthCloud freemium marketing profiling system, identifying all data collection points, data storage locations, internal and external data flows, and processing technology dependencies. The data flow diagram at Appendix A is derived from Ashdown's mapping outputs.

(b) Technical assessment of cookies and tracking technologies: Ms Chakravarti conducted a technical audit of all cookies, pixels, SDKs, and similar tracking technologies deployed on the NorthCloud freemium-tier web and

DATA PROTECTION IMPACT ASSESSMENT
DPIA-007: Marketing Profiling and Targeted Advertising
(NorthCloud Freemium Tier)
CONFIDENTIAL — LEGAL PRIVILEGED
Right-click to update Table of Contents
1. Introduction and Purpose
1.1 Background to the Assessment
This Data Protection Impact Assessment ("DPIA") is conducted pursuant to Article 35 of the UK General Data Protection Regulation ("UK GDPR") and the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), which require a data protection impact assessment to be carried out where a type of processing — in particular one using new technologies and taking into account the nature, scope, context, and purposes of the processing — is likely to result in a high risk to the rights and freedoms of natural persons. This assessment is prepared by Calderwood & Harkness LLP ("C&H") on behalf of and at the instruction of Northgate Telecommunications PLC ("NTP" or the "Company").
NTP is a United Kingdom-headquartered public limited company incorporated in England and Wales (Company Number 04837291), with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT. NTP operates telecommunications infrastructure across the United Kingdom and the European Union, and provides enterprise Software-as-a-Service ("SaaS") solutions through its NorthCloud platform. NTP is a significant market participant in the European unified communications and collaboration sector, with a substantial and growing customer base across multiple jurisdictions.
The NorthCloud platform is a cloud-based unified communications platform sold on a business-to-business ("B2B") basis across fourteen (14) EU/EEA member states, in addition to the United Kingdom. NorthCloud is supported by a geographically distributed data centre infrastructure, with primary hosting facilities located in London, Frankfurt, Amsterdam, and Dublin. The platform provides a comprehensive suite of enterprise communication, collaboration, and productivity tools.
NTP's NorthCloud service includes a freemium tier, which provides a free, entry-level version of the NorthCloud platform to prospective enterprise and small-business customers. The freemium tier serves as a primary acquisition channel for NTP, allowing prospective customers to experience the platform's core functionality before committing to a paid subscription. In connection with the freemium tier, NTP conducts marketing profiling and targeted advertising activities directed at freemium-tier users with the objectives of (a) converting those users to paid NorthCloud subscriptions and (b) delivering third-party advertising to monetise the freemium offering.
It is these marketing profiling and targeted advertising activities that are the subject of this DPIA. The processing activities described herein involve the systematic collection, analysis, and use of personal data relating to freemium-tier users for the purposes of behavioural profiling, interest-based segmentation, cross-device tracking, automated content personalisation, and programmatic advertising delivery. As set out in further detail below, these activities involve processing on a large scale and entail systematic and extensive evaluation of personal aspects of natural persons based on automated processing, including profiling, which together meet the thresholds for mandatory DPIA under Article 35(3)(a) and (b) of the UK GDPR and EU GDPR.
NTP processes personal data of approximately 6.3 million consumer subscribers and approximately 42,000 enterprise clients across its UK and EU operations. The freemium tier specifically serves an estimated 340,000 active users across the UK and EU, representing a significant processing population.
For the purposes of EU GDPR compliance, NTP's lead EU data protection supervisory authority is the Data Protection Commission of Ireland (the "DPC"), by virtue of NTP's EU establishment through its subsidiary Northgate Ireland Ltd (Companies Registration Office Number: 587214), registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland. Northgate Ireland Ltd serves as NTP's main establishment in the European Union for the purposes of the one-stop-shop mechanism under Article 56 of the EU GDPR.
In the United Kingdom, NTP is registered with the Information Commissioner's Office ("ICO") under registration number ZA482917. The ICO is NTP's competent supervisory authority for UK GDPR purposes.
1.2 Regulatory Context and Prior Enforcement
The regulatory context for this DPIA is materially informed by NTP's prior enforcement history and ongoing supervisory scrutiny, both of which are directly relevant to the processing activities assessed herein.
On 15 September 2021, the ICO issued an Enforcement Notice to NTP bearing reference ENF/2021/0934 (the "Enforcement Notice"). The Enforcement Notice concerned inadequate consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal. Specifically, the ICO found that NTP's cookie consent implementation on the NorthCloud platform failed to meet the requirements of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and Articles 6(1)(a) and 7 of the UK GDPR, in that consent was not freely given, was not sufficiently specific, and was obtained through pre-ticked boxes and bundled consent mechanisms that did not allow users to exercise genuine choice regarding different categories of cookies. A monetary penalty of £320,000 was imposed and paid by NTP. NTP completed the mandated remediation measures in March 2022.
The prior Enforcement Notice is directly relevant to this DPIA. The processing activities assessed herein concern marketing profiling and targeted advertising conducted on the same NorthCloud platform ecosystem, and the consent mechanism deficiencies that formed the basis of the Enforcement Notice bear material similarity to deficiencies identified in the current assessment. As set out in Section 5 below, the legacy of this enforcement action places NTP under heightened regulatory scrutiny and increases the severity of compliance failures in this area. Any recurrence of similar deficiencies would likely result in substantially increased penalties and reputational harm.
Additionally, in November 2022, the DPC (Ireland) opened a preliminary inquiry (reference IN-22-11-3) concerning cross-border data transfers from Northgate Ireland Ltd to third countries. While this inquiry is primarily directed at NTP's broader international data transfer arrangements, it touches upon data flows underpinning certain marketing analytics activities conducted through the NorthCloud platform, including some of the processing activities that are the subject of this DPIA. The inquiry remains open as of the date of this assessment, and its outcome may have implications for the transfer mechanisms relied upon for marketing data sharing with third-party advertising technology partners.
These enforcement and supervisory developments underscore the importance of ensuring that the processing activities assessed in this DPIA are conducted in full compliance with applicable data protection law, and that any identified risks are mitigated to the fullest extent practicable.
1.3 Legal Basis for Conducting This DPIA
The legal obligation to conduct this DPIA arises from Article 35(1) of the UK GDPR and EU GDPR, which provides that where a type of processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
The processing activities described in this DPIA satisfy multiple criteria that trigger the mandatory DPIA requirement:
(a) Article 35(3)(a): The processing involves a systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling. The marketing profiling system creates behavioural profiles of freemium-tier users, assigns propensity scores, segments users into marketing cohorts, and delivers personalised content and advertising based on those profiles. While the marketing decisions based on this profiling may not in all cases produce legal effects or similarly significant effects on data subjects, the systematic and extensive nature of the evaluation, combined with the scale of processing, brings this activity within the scope of Article 35(3)(a).
(b) Article 35(3)(b): The processing involves processing on a large scale of personal data. Approximately 340,000 active freemium-tier users are subject to the profiling activities described herein, across fifteen jurisdictions (the UK and fourteen EU/EEA member states). This constitutes large-scale processing within the meaning of Article 35(3)(b) and Recital 91 of the GDPR.
In addition, guidance from both the ICO and the European Data Protection Board ("EDPB") confirms that profiling for marketing purposes, when combined with large-scale processing and the use of innovative or intrusive technologies (such as cross-device tracking, behavioural analytics, and real-time bidding), triggers a mandatory DPIA. The EDPB's Guidelines on Data Protection Impact Assessment (WP 248 rev.01) identify multiple criteria that, when present in combination, indicate a high-risk processing operation. The present case engages at least five of the nine EDPB criteria: (i) evaluation or scoring (profiling); (ii) automated decision-making with legal or similarly significant effect (potentially, in the case of conversion-gating); (iii) systematic monitoring; (iv) processing on a large scale; and (v) innovative use or application of new technological solutions (cross-device tracking, probabilistic matching).
This DPIA was mandated by the NTP Board Audit & Risk Committee pursuant to a resolution dated 8 December 2022, which directed the comprehensive build-out of NTP's GDPR compliance programme, including the completion of Data Protection Impact Assessments for all high-risk processing activities identified in the preliminary data mapping and risk assessment conducted by C&H and Ashdown Consulting Group Ltd in Phase 1 of the engagement.
1.4 Scope of This DPIA
This DPIA covers all marketing profiling and targeted advertising activities conducted on users of the NorthCloud freemium tier across the United Kingdom and European Union jurisdictions in which NorthCloud operates.
The processing activities within scope include, without limitation:
(a) behavioural profiling of freemium-tier users based on in-platform usage data;
(b) interest-based segmentation and cohort assignment;
(c) cross-device tracking, including both deterministic (login-based) and probabilistic (fingerprinting-based) device association;
(d) third-party advertising delivery, including participation in real-time bidding ("RTB") ecosystems;
(e) conversion analytics, including propensity scoring and churn risk modelling;
(f) automated content personalisation, including personalised in-platform messages, email campaigns, and feature recommendations; and
(g) retargeting campaigns conducted on external platforms using hashed identifiers and cookie-syncing techniques.
The geographic scope of this DPIA encompasses processing conducted by NTP PLC (UK) and the following EU subsidiaries involved in NorthCloud operations:
• Northgate Ireland Ltd (CRO Number: 587214; Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland);
• Northgate GmbH (HRB 214503 B; Friedrichstraße 91, 10117 Berlin, Germany);
• Northgate B.V. (KvK 72841936; Herikerbergweg 44, 1101 CM Amsterdam, Netherlands);
• Northgate France SAS (SIREN 891 247 503; 27 Rue de Berri, 75008 Paris, France); and
• Northgate Iberia S.L. (CIF B-91847263; Calle de Serrano 41, 28001 Madrid, Spain).
Exclusions: This DPIA does not cover the paid and enterprise tiers of the NorthCloud platform. The paid/enterprise tiers are subject to separate controller-processor arrangements and rely on different lawful bases for processing (principally, performance of contract). Marketing profiling on the paid/enterprise tiers, to the extent it occurs, is subject to separate assessment. Additionally, this DPIA does not cover NTP's broader telecommunications services or its non-NorthCloud product offerings, which are addressed in separate assessments as appropriate.
2. Systematic Description of Processing Operations
In accordance with Article 35(7)(a) of the UK GDPR and EU GDPR, this section provides a systematic description of the envisaged processing operations, including the purposes of processing and, where applicable, the legitimate interests pursued by the controller.
2.1 Nature of the Processing
The marketing profiling and targeted advertising activities on the NorthCloud freemium tier involve the following categories of processing operations:
User Registration Data Collection. At the point of freemium tier sign-up, NTP collects registration data from prospective users, including: full name, email address, business name, job title, and geographic location. This data is collected through the NorthCloud sign-up form on both the web and mobile application interfaces. The registration data forms the foundational layer of the user's marketing profile.
In-Platform Behavioural Tracking. Following registration, NTP tracks user behaviour within the NorthCloud freemium platform on an ongoing basis. The tracked behavioural data includes: feature usage patterns (which features are accessed, in what order, and how frequently); session duration and frequency; feature adoption sequences (the chronological order in which features are first used); and communication metadata (the frequency and timing of communications initiated through the platform, excluding the content of those communications). This tracking is conducted through server-side event logging and client-side analytics instrumentation embedded in the NorthCloud web and mobile interfaces.
Cookie and Tracking Technology Deployment. NTP deploys first-party and third-party cookies, tracking pixels, software development kits ("SDKs"), and similar tracking technologies on the NorthCloud web and mobile interfaces. These technologies collect browsing behaviour (pages viewed, click paths, scroll depth), device information (device type, operating system version, browser type and version, screen resolution, language settings), IP addresses, and referral data (the source from which the user arrived at the NorthCloud platform, including UTM campaign parameters). A comprehensive register of cookies and tracking technologies is provided at Appendix C.
Cross-Device Tracking. NTP links user activity across desktop web, mobile web, and native mobile application interfaces through two distinct matching methodologies:
(i) Deterministic matching: where a user is logged into their NorthCloud account on multiple devices, activity across those devices is linked through the common user identifier associated with the authenticated session. This form of matching is transparent and under the user's direct control, as it is contingent upon the user's decision to log in.
(ii) Probabilistic matching: in addition to deterministic matching, NTP employs probabilistic cross-device association techniques, including browser fingerprinting and statistical inference of device associations based on shared IP addresses, temporal usage patterns, and device attribute correlations. Probabilistic matching enables NTP to associate activity across devices even where the user is not logged in on all devices, but operates without explicit user awareness or consent.
Profile Creation and Enrichment. The data collected through the foregoing mechanisms is aggregated and processed to create user profiles that incorporate: behavioural data (usage patterns, engagement metrics); inferred interests (based on feature usage and content interaction); predicted propensity to convert to a paid NorthCloud subscription (a numerical score derived from a machine learning model trained on historical conversion data); predicted churn risk (a score indicating the likelihood that the user will abandon the freemium service); and demographic and firmographic inferences (estimated company size, industry vertical, and seniority level of the user, derived from a combination of registration data and behavioural signals).
Automated Segmentation and Cohort Assignment. User profiles are processed through automated segmentation algorithms that assign each user to one or more marketing cohorts. These cohorts are defined by combinations of behavioural, demographic, and firmographic attributes and are used to determine the marketing content and advertising delivered to each user. Segment assignment is updated on a rolling basis as new behavioural data is collected.
Personalised Marketing Delivery. Based on segment assignment, NTP delivers personalised marketing content to freemium-tier users through multiple channels:
(a) In-platform messages: personalised banners, feature recommendations, and upgrade prompts displayed within the NorthCloud interface;
(b) Email campaigns: targeted email communications promoting paid-tier features, special offers, and product updates, delivered through NTP's marketing automation platform; and
(c) Third-party display advertising: targeted advertisements delivered on external websites and applications through programmatic advertising networks.
Real-Time Bidding Participation. For third-party advertising, NTP participates in the real-time bidding ("RTB") ecosystem. This involves the sharing of pseudonymised user data segments with advertising demand-side platforms ("DSPs") and ad exchanges. When a freemium-tier user visits a webpage or opens an application that participates in the same advertising exchange, a bid request is generated containing the user's pseudonymised segment information (but not direct identifiers), which is broadcast to multiple DSPs that evaluate the bid opportunity and, if interested, submit a bid to display an advertisement to that user. The winning bidder's advertisement is then displayed. This process occurs in real time, typically within 100 milliseconds.
Retargeting Campaigns. NTP conducts retargeting campaigns on external platforms (including major social media platforms and display advertising networks) using hashed email identifiers and cookie-syncing techniques. These campaigns are designed to re-engage freemium-tier users who have shown high propensity to convert but have not yet upgraded to a paid subscription.
2.2 Purpose of the Processing
The processing activities described in Section 2.1 serve the following purposes:
Primary Purpose — Conversion Marketing. The primary purpose of the processing is the conversion of freemium-tier users to paid NorthCloud subscriptions through personalised marketing and targeted feature recommendations. The freemium tier is a core component of NTP's customer acquisition strategy, and the ability to deliver relevant, personalised marketing based on each user's behaviour and characteristics is integral to the commercial viability of the freemium model. NTP's legitimate commercial interest lies in maximising the conversion rate from freemium to paid subscriptions, thereby sustaining and growing the NorthCloud revenue base.
Secondary Purpose — Freemium Tier Monetisation. The secondary purpose is the monetisation of the freemium tier through the delivery of third-party targeted advertising. Because freemium-tier users do not pay a subscription fee, advertising revenue partially offsets the cost of providing the free service. The profiling and segmentation activities enable NTP to offer advertisers the ability to reach relevant audiences, which generates higher advertising yields than would be achievable with untargeted advertising.
Tertiary Purpose — Product Development Insights. A tertiary purpose of the processing is the generation of aggregated analytics on freemium user behaviour to inform the NorthCloud product roadmap. Aggregated behavioural data — analysed at a cohort level rather than an individual level — provides insights into feature adoption patterns, user experience friction points, and unmet user needs. This purpose is overseen by Laura Dearden, VP Product & Engineering, NorthCloud, and relies on aggregated and anonymised data outputs rather than individual-level profiles.
2.3 Categories of Personal Data Processed
The following categories of personal data are processed in connection with the marketing profiling and targeted advertising activities:
Identification Data. Full name, email address, business name, job title, and unique NorthCloud user identifier.
Contact Data. Email address, and telephone number where voluntarily provided by the user during registration or account setup.
Device and Technical Data. Internet Protocol ("IP") address, device type and model, operating system name and version, browser type and version, mobile advertising identifiers (Tidewater Industries Identifier for Advertisers ("IDFA") and Severin Industries Advertising Identifier ("GAID")), screen resolution, and device language settings.
Behavioural Data. In-platform usage logs recording feature interactions, session timestamps (start time, end time, and duration), click-stream data capturing the sequence of user actions within the platform, page views, and search queries entered within the NorthCloud platform interface.
Tracking Data. Cookie identifiers (both first-party and third-party), pixel tracking data, cross-device graph data (associations between device identifiers attributed to the same user), referral URLs (the webpage from which the user navigated to NorthCloud), and UTM campaign parameters (source, medium, campaign name, term, and content identifiers).
Inferred and Derived Data. Marketing segment assignments, interest category classifications (e.g., "collaboration-focused," "security-conscious," "video-heavy user"), propensity scores (conversion likelihood score on a 0-100 scale, churn risk score on a 0-100 scale), and firmographic inferences (estimated company size band, estimated industry vertical, estimated seniority level).
Communication Metadata. Frequency and timing of communications initiated by the user through the NorthCloud platform, including the number of messages, calls, and meetings initiated or received per period. This category expressly excludes the content of any communications, which is not accessed or processed for marketing purposes.
Location Data. Approximate geolocation derived from IP address (typically accurate to city or regional level). In addition, precise geolocation data may be collected from users of the NorthCloud mobile application who have granted location permissions through the mobile operating system. Precise geolocation data is used for location-based advertising targeting where available.
Special Category Data. No special category data (as defined in Article 9(1) of the UK GDPR and EU GDPR) is intentionally collected or processed as part of the marketing profiling activities. However, the risk assessment in Section 5 identifies that behavioural profiling carries a non-trivial risk of incidental inference of special category attributes, such as political opinions, religious beliefs, or health status, through patterns of behaviour or feature usage that may serve as proxies for such characteristics. This risk is addressed in the mitigation measures set out in Section 6.4.
2.4 Categories of Data Subjects
The data subjects affected by the processing activities described in this DPIA are users of the NorthCloud freemium tier. As of the date of this assessment, the freemium tier has approximately 340,000 active users across the UK and the fourteen EU/EEA member states in which NorthCloud operates. This figure represents a subset of NTP's total data subject population of approximately 6.3 million consumer subscribers and 42,000 enterprise clients.
The freemium-tier user population is predominantly composed of small-business owners, IT decision-makers, and individual professionals who are evaluating unified communications platforms for adoption by their organisations. The demographic and professional profile of freemium-tier users is diverse, spanning multiple industries, seniority levels, and geographic locations within the UK and EU.
Users of the freemium tier span all fifteen jurisdictions in which NorthCloud operates: the United Kingdom, Ireland, Germany, the Netherlands, France, Spain, Italy, Belgium, Austria, Sweden, Denmark, Finland, Poland, Portugal, and the Czech Republic. The geographic distribution of users broadly correlates with NTP's commercial presence in each market, with the United Kingdom, Germany, and the Netherlands representing the largest user populations.
2.5 Recipients and Data Sharing
Personal data processed in connection with the marketing profiling and targeted advertising activities is shared with the following categories of recipients:
Internal Recipients within NTP Group.
(a) NTP Marketing Team: Accesses user profile data, segment assignments, and campaign performance analytics for the purpose of planning, executing, and optimising marketing campaigns directed at freemium-tier users.
(b) NorthCloud Product Team: Receives aggregated behavioural analytics (not individual-level profiles) for product development purposes, under the oversight of Laura Dearden, VP Product & Engineering.
(c) NTP Data Analytics Team: Processes behavioural data and marketing performance metrics to generate insights, reporting, and predictive models in support of the marketing and product functions.
Third-Party Advertising Partners. Pseudonymised user segment data is shared with advertising demand-side platforms and ad exchanges through the RTB ecosystem. These partners receive bid requests containing segment identifiers, approximate geolocation, device type, and other non-directly-identifying attributes. They do not receive direct identifiers (names, email addresses, or NorthCloud user IDs) as part of the standard RTB bid stream. However, the combination of data points contained in bid requests may, in certain circumstances, be sufficient to enable re-identification when combined with other data sources available to the recipient.
Third-Party Cookie and Tracking Technology Providers. Analytics and measurement partners whose tracking technologies (cookies, pixels, SDKs) are embedded on the NorthCloud web and mobile interfaces receive data collected through those technologies. These include analytics platforms, attribution and measurement services, and advertising verification providers. A complete register of these technologies is provided at Appendix C.
Processors and Sub-Processors. The NorthCloud platform and its associated marketing data infrastructure are hosted by Pinnacle Cloud Services Ltd ("Pinnacle") (Company Number 09142837; Apex House, 24 Victoria Embankment, London EC4Y 0DZ), which acts as a data processor on behalf of NTP. Pinnacle's sub-processor chain includes:
(i) Pinnacle India Pvt Ltd (Corporate Identification Number: U72200HR2016PTC065412; Gurugram, Haryana, India), which provides infrastructure support and monitoring services and has remote access to the hosting environment for those purposes; and
(ii) Pinnacle APAC Pte Ltd (Unique Entity Number: 201824567K; Singapore), which provides infrastructure support and monitoring services for the Asia-Pacific region and similarly has remote access capabilities.
Both Pinnacle sub-processors are engaged under the terms of the amended Data Processing Agreement between NTP and Pinnacle executed on 28 June 2023, which incorporates EU Standard Contractual Clauses Module 3 (Processor to Sub-processor) and the UK Addendum to the EU SCCs, together with applicable supplementary measures.
Data Mapping Context. This marketing profiling processing activity is among the 147 total processing activities catalogued in NTP's Record of Processing Activities ("ROPA"), of which 89 are recorded in the UK ROPA (maintained by NTP PLC) and 58 are recorded in the ROPAs of the EU subsidiaries. The NorthCloud freemium marketing profiling activity is recorded as a distinct entry in both the UK ROPA and the relevant EU subsidiary ROPAs, reflecting the cross-border nature of the processing.
2.6 Data Flows and International Transfers
Primary Data Storage. NorthCloud customer data for EU-based freemium-tier users is hosted in Pinnacle Cloud Services data centres located in Dublin, Ireland and Frankfurt, Germany. Customer data for UK-based freemium-tier users is hosted in Pinnacle's London, United Kingdom data centre. The allocation of data to storage locations is determined by the user's country of registration, in accordance with NTP's data residency architecture.
International Transfers. The processing activities described in this DPIA give rise to international transfers of personal data to third countries that have not been the subject of an adequacy decision by the European Commission or the UK Secretary of State. The following international transfers are identified:
(a) Pinnacle Sub-Processor Chain — India: Personal data stored in the Dublin and Frankfurt data centres is accessible remotely by Pinnacle India Pvt Ltd in Gurugram, India, for the purposes of infrastructure support and monitoring. India has not been the subject of an adequacy decision. This transfer is covered by EU Standard Contractual Clauses Module 3 (Processor to Sub-processor) and the UK Addendum to the EU SCCs, as incorporated into the amended DPA between NTP and Pinnacle executed on 28 June 2023. A Transfer Impact Assessment ("TIA") has been conducted (TIA-002: Pinnacle → Pinnacle India Pvt Ltd), which concludes that the transfer mechanisms and supplementary measures in place provide an essentially equivalent level of protection.
(b) Pinnacle Sub-Processor Chain — Singapore: Personal data stored in the Dublin and Frankfurt data centres is accessible remotely by Pinnacle APAC Pte Ltd in Singapore for similar infrastructure support purposes. While Singapore has not received a blanket adequacy decision from the European Commission, the transfer is similarly covered by EU SCCs Module 3 and the UK Addendum. A TIA has been conducted (TIA-003: Pinnacle → Pinnacle APAC Pte Ltd).
(c) Third-Party Advertising Technology Partners — United States: Pseudonymised user segment data is shared with third-party advertising technology partners (DSPs, ad exchanges, and retargeting platforms), certain of which operate servers and process data in the United States. Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18) and the subsequent adoption of the EU-US Data Privacy Framework, transfers to certified US recipients may rely on the adequacy decision of 10 July 2023. For non-certified recipients, transfers are addressed through EU SCCs Module 2 (Controller to Processor) and the UK International Data Transfer Agreement ("IDTA") where applicable.
Supplementary Measures. In accordance with EDPB Recommendations 01/2020 on supplementary measures, the following technical measures are applied to all international transfers of marketing data:
• AES-256 encryption at rest for all personal data stored in Pinnacle data centres;
• TLS 1.3 encryption in transit for all data transmissions between NTP systems, Pinnacle data centres, and sub-processor access points; and
• Pseudonymisation of direct identifiers (names, email addresses) before any transfer to third-party advertising technology partners or before data is made accessible to Pinnacle sub-processors in India and Singapore.
Cross-References. The international transfer arrangements described in this section are documented in further detail in the following related deliverables: TIA-002 (Pinnacle → Pinnacle India Pvt Ltd); TIA-003 (Pinnacle → Pinnacle APAC Pte Ltd); the amended DPA between NTP and Pinnacle Cloud Services Ltd (executed 28 June 2023); and NTP's International Transfers Policy & Mechanism Selection Guidance.
2.7 Data Retention
Personal data processed in connection with the NorthCloud freemium-tier marketing profiling and targeted advertising activities is retained in accordance with the following periods, which are aligned with NTP's Data Retention Schedule:
Freemium User Registration Data. Registration data (name, email, business name, job title, location) is retained for the duration of the user's active freemium account, plus twelve (12) months following account closure or deletion. The twelve-month post-closure retention period is maintained to support re-engagement marketing (subject to applicable consent) and to address any post-closure data subject rights requests or disputes.
Behavioural and Tracking Data. Behavioural usage logs and tracking data (including cookie identifiers, click-stream data, device data, and location data) are retained for a maximum period of thirteen (13) months from the date of collection. This retention period is aligned with ICO guidance on cookie lifespans and the CNIL's recommendation that analytics cookies should not persist beyond thirteen months. Upon expiry of the retention period, behavioural and tracking data is automatically deleted from active systems.
Marketing Profiles and Segment Assignments. Marketing profiles, including propensity scores and segment assignments, are refreshed on a rolling ninety (90) day window. Profile data older than ninety days is either overwritten by refreshed data or, where retained for analytical purposes, is anonymised and aggregated such that individual users cannot be identified. Historical segment data retained in anonymised and aggregated form is maintained indefinitely for trend analysis and product development purposes, but is no longer personal data within the meaning of Article 4(1) of the GDPR.
Cookie Consent Records. Records of user consent (or refusal of consent) for cookies and tracking technologies are retained for the duration of the consent validity period, plus three (3) years thereafter. The extended retention of consent records is maintained for accountability purposes, to demonstrate compliance with the consent requirements of Article 7(1) of the UK GDPR and EU GDPR, and Regulation 6 of PECR.
The detailed retention periods for all categories of data processed by NTP are recorded in NTP's Data Retention Schedule, which forms part of the GDPR programme deliverables prepared by C&H.
2.8 Technology and Infrastructure
The marketing profiling and targeted advertising activities are supported by the following technology and infrastructure components:
Hosting Infrastructure. The NorthCloud platform is hosted on Pinnacle Cloud Services Ltd's Infrastructure-as-a-Service ("IaaS") and Platform-as-a-Service ("PaaS") infrastructure. Pinnacle provides compute, storage, and networking resources across its Dublin, Frankfurt, London, and Amsterdam data centres. The hosting arrangement is governed by the amended DPA between NTP and Pinnacle, which includes detailed technical and organisational security measures.
Marketing Automation Platform. NTP utilises a marketing automation platform that is integrated into the NorthCloud platform infrastructure. This platform manages email campaign delivery, in-platform messaging, user journey orchestration, and campaign performance analytics. The marketing automation platform is configured to interface with the user profile and segmentation databases to enable personalised content delivery.
Consent Management Platform. As part of the mitigation measures identified in this DPIA (see Section 6.1), NTP is implementing a granular Consent Management Platform ("CMP") on all NorthCloud freemium tier interfaces. The CMP will manage the collection, recording, and enforcement of user consent preferences for cookies and tracking technologies. The implementation of the CMP is a critical remediation measure and a precondition for the continuation of certain marketing profiling activities.
Sundial Solutions Privacy Management Platform. NTP has engaged Ashdown Consulting Group Ltd ("Ashdown") (Company Number 11293847; 15 Bedford Row, London WC1R 4BU) to configure the Sundial Solutions privacy management platform for NTP's use. Sundial Solutions is being configured by Ashdown to support: consent record-keeping, ROPA maintenance and reporting, DPIA tracking and documentation, data subject rights request management, vendor risk management, and data mapping. Anita Chakravarti, Lead Privacy Engineer at Ashdown, provided technical inputs on data flow mapping for this DPIA, including the identification of data collection points, data storage locations, internal and external data flows, and processing technology dependencies.
Analytics and Measurement Infrastructure. NTP deploys first-party and third-party analytics tools to measure platform usage, marketing campaign effectiveness, and advertising performance. These tools are implemented through JavaScript tags, tracking pixels, and mobile SDKs integrated into the NorthCloud web and mobile interfaces. All such technologies are catalogued in the register provided at Appendix C.
3. Assessment of Necessity and Proportionality
In accordance with Article 35(7)(b) of the UK GDPR and EU GDPR, this section assesses the necessity and proportionality of the processing operations in relation to their purposes.
3.1 Lawful Basis Analysis
The lawful bases currently relied upon or proposed for the marketing profiling and targeted advertising activities on the NorthCloud freemium tier are as follows:
Conversion Marketing — Legitimate Interest (Article 6(1)(f)). NTP relies on legitimate interest as the lawful basis for processing personal data for the purpose of converting freemium-tier users to paid NorthCloud subscriptions. This includes basic behavioural analytics, feature usage tracking, and the delivery of personalised in-platform messages and email communications promoting paid-tier features.
This processing activity is one of the 64 processing activities across NTP's operations (representing 43.5% of the 147 total processing activities catalogued in the ROPA) that rely on legitimate interest as their lawful basis. The reliance on legitimate interest for conversion marketing is assessed against the three-part test required by Article 6(1)(f) and the ICO's legitimate interests assessment guidance, as follows:
Purpose Test — Identification of Legitimate Interest. NTP has a legitimate commercial interest in converting freemium-tier users to paid subscribers. The freemium model is a deliberate customer acquisition strategy, and the conversion of free users to paying customers is essential to the economic sustainability of the NorthCloud platform. The interest is genuine, current, and not speculative. It does not conflict with any applicable law.
Necessity Test. Profiling and personalisation enable more efficient and relevant marketing than untargeted, generic approaches. Targeted marketing reduces the volume of communications required to achieve a given conversion rate and reduces user fatigue from irrelevant or excessive marketing contacts. In this sense, the processing is necessary to achieve the stated purpose — the conversion objective could not be achieved as effectively through less data-intensive means, at least to the extent that basic behavioural analytics and deterministic personalisation are concerned.
Balancing Test. The balancing exercise requires consideration of whether the legitimate interest is overridden by the interests, rights, or freedoms of data subjects. Several factors weigh in the balancing analysis:
• Reasonable expectations: Freemium-tier users may reasonably expect that NTP will use their registration data and basic usage data to deliver relevant marketing communications. The concept of a "freemium" model is widely understood, and users may anticipate that their use of a free service will be accompanied by marketing activity. However, users are unlikely to expect the degree of behavioural tracking, cross-device monitoring, and detailed profiling that NTP currently conducts. In particular, probabilistic cross-device matching (browser fingerprinting) and the creation of detailed behavioural profiles with propensity scores materially exceed the reasonable expectations of most users.
• Power imbalance: A degree of power imbalance exists between NTP and freemium-tier users. Users depend on the freemium service for their communications needs and may feel compelled to accept tracking and profiling as a condition of continued access, particularly where the consent mechanisms do not provide genuine free choice. This imbalance weighs against reliance on legitimate interest for more intrusive forms of processing.
• Impact on data subjects: The profiling activities may have tangible impacts on users, including receiving differential marketing treatment based on their profile (e.g., users with low propensity scores may receive fewer promotional offers), and exposure to targeted advertising that reflects inferred interests and behaviours. While these impacts are generally not of the same gravity as decisions producing legal effects, they constitute a meaningful intrusion into informational self-determination.
• Safeguards: NTP offers a general opt-out mechanism for marketing communications, but currently does not provide granular control over profiling specifically. The mitigation measures in Section 6 address this gap.
Conclusion on Legitimate Interest. Legitimate interest under Article 6(1)(f) is supportable as the lawful basis for basic conversion marketing activities, including the use of registration data and in-platform behavioural analytics for personalised feature recommendations and email marketing, provided that transparent and easily accessible opt-out mechanisms are available and immediately effective. However, legitimate interest is not an appropriate lawful basis for the following processing activities, which exceed the boundaries of what can be justified under the balancing test:
(a) Cross-device tracking using probabilistic (fingerprinting-based) matching methods;
(b) The creation of detailed behavioural profiles incorporating extensive inferred and derived data (propensity scores, firmographic inferences) without explicit user awareness; and
(c) Third-party advertising data sharing via RTB, which serves NTP's commercial interests in advertising monetisation rather than a direct benefit to the data subject.
These processing activities require consent under Article 6(1)(a) of the UK GDPR and EU GDPR.
Third-Party Advertising Cookies — Consent (Article 6(1)(a)). NTP relies on consent as the lawful basis for the deployment of marketing and third-party advertising cookies and similar tracking technologies on the NorthCloud platform, and for the associated third-party advertising activities. This processing activity is one of the 9 processing activities (representing 6.1% of the 147 total) that rely on consent as their lawful basis.
The current consent mechanisms deployed on the NorthCloud freemium tier have been identified as deficient in several material respects:
(a) Pre-ticked boxes: In certain implementations of the cookie consent interface, marketing and advertising cookie categories are selected by default, requiring the user to actively deselect them. Pre-ticked boxes do not constitute valid consent under Article 7 and Recital 32 of the GDPR, as confirmed by the Court of Justice of the European Union in Planet49 (Case C-673/17).
(b) Bundled consent: The consent mechanism bundles multiple categories of cookies into a single consent action, rather than providing granular, purpose-specific consent options. Users are not given the ability to consent to analytics cookies while declining advertising cookies, for example.
(c) Insufficient granularity: The privacy information provided at the point of consent collection does not adequately distinguish between the different categories of cookies and tracking technologies deployed, nor the different purposes they serve.
(d) Lack of genuine free choice: In some implementations, access to the NorthCloud freemium tier is conditioned on acceptance of all cookie categories, including marketing and advertising cookies. This conditioning undermines the "freely given" requirement of Article 7, as users cannot use the freemium service without accepting non-essential cookies. The EDPB's Guidelines 05/2020 on consent under Regulation 2016/679 make clear that where consent is a condition for provision of a service, and the processing is not necessary for the provision of that service, consent is unlikely to be freely given.
These deficiencies echo, in material substance, the issues identified by the ICO in Enforcement Notice ENF/2021/0934 (dated 15 September 2021), which concerned inadequate consent mechanisms for direct marketing cookies on the same NorthCloud portal. The persistence of similar deficiencies on the freemium tier — notwithstanding the remediation completed on the customer portal in March 2022 — represents a significant compliance risk and underscores the urgency of the consent mechanism redesign recommended in Section 6.1.
Conclusion on Consent. The consent mechanisms deployed on the NorthCloud freemium tier must be fundamentally redesigned to meet the requirements of Article 6(1)(a), Article 7, and Recital 32 of the UK GDPR and EU GDPR. Consent must be freely given, specific, informed, and unambiguous, and must be demonstrated by a clear affirmative action. The redesigned consent mechanisms are described in Section 6.1.
ePrivacy Directive / PECR Considerations. Independent of the GDPR lawful basis analysis, the storage of and access to information on a user's terminal equipment (i.e., the setting and reading of cookies, the operation of tracking pixels, and the execution of SDKs) is subject to the prior consent requirement of Article 5(3) of the ePrivacy Directive 2002/58/EC, as implemented in the UK by Regulation 6 of PECR, and in relevant EU member states by their respective national implementing legislation. The only exception to this consent requirement is for technologies that are strictly necessary for the provision of an information society service explicitly requested by the user. Marketing and advertising cookies, profiling cookies, and third-party tracking technologies do not fall within this exception and therefore require prior consent. This requirement applies irrespective of the GDPR lawful basis relied upon for the broader processing.
3.2 Necessity Assessment
This section assesses whether the processing activities described in Section 2 are necessary for the achievement of the stated purposes identified in Section 2.2.
Basic conversion marketing analytics — including the tracking of in-platform feature usage, the identification of users who are highly engaged with the freemium service, and the delivery of personalised upgrade prompts and feature recommendations — are reasonably necessary to sustain the freemium business model and to achieve the primary purpose of converting free users to paying subscribers. Without any behavioural analytics capability, NTP would be limited to generic, untargeted marketing, which would be less effective and would require higher volumes of marketing communications, potentially resulting in greater user fatigue and a worse user experience.
However, several elements of the current processing go beyond what is strictly necessary to achieve the stated purposes:
(a) Probabilistic cross-device matching is not strictly necessary for conversion marketing. Deterministic (login-based) cross-device association — which links user activity across devices only where the user is actively logged into their NorthCloud account — is sufficient to deliver a coherent cross-device marketing experience. The incremental benefit of probabilistic matching (extending cross-device tracking to situations where the user is not logged in) is modest relative to the additional intrusiveness and opacity it entails.
(b) Granular behavioural profiling for third-party advertising purposes is not necessary for the primary conversion marketing purpose. While advertising monetisation serves NTP's commercial interest in sustaining the freemium tier, the creation of detailed behavioural profiles for the purpose of selling targeted advertising to third parties is a separate commercial objective that introduces additional data processing and data sharing beyond what is needed for NTP's own conversion marketing.
(c) Real-time bidding data sharing exposes pseudonymised user data to a wide ecosystem of demand-side platforms and ad exchanges, many of which NTP has no direct contractual relationship with. The breadth of data dissemination inherent in the open RTB ecosystem exceeds what is necessary for NTP's direct marketing objectives and creates data security and re-identification risks that are not commensurate with the conversion marketing purpose.
3.3 Proportionality Assessment
The proportionality assessment considers whether the volume and intrusiveness of the data processing is proportionate to the benefits sought, both for NTP and for data subjects.
The current scope of data collection and tracking on the NorthCloud freemium tier is extensive. The combination of in-platform behavioural tracking, cookie-based browsing tracking, cross-device association (including probabilistic methods), and third-party advertising data sharing creates a comprehensive surveillance infrastructure that captures a detailed picture of each user's digital behaviour across multiple devices, contexts, and platforms. The volume and granularity of data collected, and the intrusiveness of the tracking mechanisms employed (particularly probabilistic fingerprinting), are disproportionate to the stated conversion marketing objective.
The third-party advertising data sharing introduces additional risks — including loss of control over data in the RTB ecosystem, re-identification risk, and exposure to a wide range of third-party recipients — without delivering a commensurate benefit to data subjects. Freemium-tier users do not receive improved service quality or additional features in exchange for their exposure to targeted advertising; the benefit flows primarily to NTP (in the form of advertising revenue) and to third-party advertisers.
The proportionality of the processing can be materially improved through the implementation of data minimisation, purpose limitation, and granular consent mechanisms. Specifically:
• discontinuing probabilistic cross-device matching reduces intrusiveness without materially impairing conversion marketing effectiveness;
• Implementing granular consent for different categories of marketing and advertising gives users meaningful control over the extent of their exposure to profiling and tracking;
• Transitioning from open RTB to private marketplace or direct deal arrangements limits the breadth of data dissemination; and
• Enforcing strict retention limits ensures that the volume of stored personal data does not grow beyond what is necessary for current marketing purposes.
The processing involves approximately 340,000 active freemium-tier users, which constitutes large-scale processing. The scale of the processing amplifies both the benefits and the risks: the larger the user population, the greater the commercial value of effective conversion marketing, but also the greater the potential harm in the event of a data breach, unauthorised data sharing, or systematic rights violation.
3.4 Data Subject Rights Safeguards
NTP has established data subject rights procedures in accordance with Articles 15–22 of the UK GDPR and EU GDPR, as documented in NTP's Data Subject Rights Procedure. Data subject rights requests are managed through a centralised intake process, with a service level agreement of one (1) calendar month for response, extendable by two (2) additional months for complex or high-volume requests, in accordance with Article 12(3).
The following data subject rights are particularly relevant to the marketing profiling and targeted advertising activities:
Right to Object to Direct Marketing Profiling (Article 21(2)). The right to object to processing for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, is an absolute right that must be available to data subjects prominently and easily. The current NorthCloud freemium-tier interface provides users with general privacy settings, but the ability to exercise a granular objection to marketing profiling specifically is limited. As part of the mitigation measures in Section 6.8, NTP will implement prominent, one-click opt-out mechanisms that are immediately effective.
Rights Regarding Solely Automated Decision-Making (Article 22). Article 22(1) provides that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The assessment of whether the profiling-based marketing decisions made in connection with the NorthCloud freemium tier fall within the scope of Article 22 requires consideration of whether those decisions produce legal effects or similarly significant effects on data subjects.
In the majority of cases, the marketing personalisation delivered through the freemium-tier profiling system — such as the selection of which upgrade prompts, feature recommendations, or advertisements a user sees — does not produce legal effects or similarly significant effects. However, one identified practice, referred to internally as "conversion-gating," involves the restriction or modification of certain freemium-tier features or functionality based on a user's profile score (e.g., reducing access to certain features for users assessed as having low conversion propensity, in order to create an incentive to upgrade). Conversion-gating could, depending on its implementation, cross the threshold into "similarly significant effects" as contemplated by Article 22(1), particularly if it materially limits the user's ability to use the service. This practice must be monitored and, if it produces similarly significant effects, must be brought within the safeguards of Article 22, including the provision of meaningful information about the logic involved, the right to obtain human intervention, and the right to contest the decision.
Right of Access (Article 15) and Right to Information (Articles 13–14). Data subjects have the right to access the personal data held about them, including information about the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing. The current privacy notice disclosures are assessed as insufficient in this regard (see Risk 2 in Section 5.2). Enhanced transparency measures are recommended in Section 6.2.
4. Consultation with Stakeholders
In accordance with Article 35(2) and (9) of the UK GDPR and EU GDPR, the controller has sought the views of relevant stakeholders in the preparation of this DPIA.
4.1 Internal Stakeholders Consulted
The following NTP internal stakeholders were consulted during the preparation of this DPIA:
Sanjay Mehta — Data Protection Officer, Northgate Telecommunications PLC. Mr Mehta was consulted throughout the preparation of this DPIA in accordance with Article 35(2), which requires the controller to seek the advice of the DPO where one has been designated. Mr Mehta holds the Certified Information Privacy Professional/Europe (CIPP/E) certification from the International Association of Privacy Professionals. He was appointed as NTP's DPO in March 2019 and reports to the General Counsel with a dotted-line reporting relationship to the Board Audit & Risk Committee, ensuring the organisational independence required by Article 38.
Mr Mehta advised on the regulatory risk profile of the processing, with particular reference to the context established by the prior ICO Enforcement Notice (ENF/2021/0934) and the active DPC preliminary inquiry (IN-22-11-3). He confirmed that the processing meets the triggers for mandatory DPIA under Article 35(3)(a) and (b). He provided input on the risk assessment methodology and reviewed the proposed mitigation measures for adequacy and feasibility. His formal DPO opinion is set out in Section 8.
Laura Dearden — VP, Product & Engineering, NorthCloud. Ms Dearden provided detailed technical descriptions of the NorthCloud profiling algorithms, data collection mechanisms, and cross-device tracking methodologies employed on the freemium tier. She described the product roadmap for the freemium tier, including planned expansions of profiling capabilities and new data collection features that informed the forward-looking risk assessment. Ms Dearden confirmed the technical feasibility of implementing the privacy-by-design controls and mitigation measures recommended in Section 6, including the CMP implementation, the discontinuation of probabilistic cross-device matching, the profiling transparency dashboard, and the algorithmic fairness testing framework.
Thomas Okoye — Chief Information Security Officer, Northgate Telecommunications PLC. Mr Okoye assessed the technical security measures applicable to the marketing data infrastructure, including encryption standards (AES-256 at rest, TLS 1.3 in transit), access controls (role-based access, multi-factor authentication for administrative access), network security (segmentation of marketing data systems from production communications systems), and the security governance framework applicable to third-party marketing technology integrations. Mr Okoye, who previously served as CISO at Meridian Digital Group, also assessed the security risks arising from the marketing technology stack (third-party SDKs, pixels, and analytics tags) and recommended the tag management governance controls described in Section 6.6.
Philippa Crane — Head of People & HR, Northgate Telecommunications PLC. Ms Crane was consulted on any employee-facing dimensions of the freemium-tier marketing activities. Specifically, C&H and Mr Mehta identified that NTP employees may, in certain circumstances, use the NorthCloud freemium tier for testing, product evaluation, or demonstration purposes, which could result in employee personal data being processed through the freemium marketing profiling system. Ms Crane confirmed that this overlap is minimal and that separate controls are in place: NTP employees using the freemium tier for internal purposes are provisioned with designated test accounts that are excluded from the marketing profiling system. No further employee privacy concerns were identified.
4.2 External Stakeholders Consulted
Ashdown Consulting Group Ltd. Ashdown was consulted in its capacity as NTP's privacy technology advisory partner. Robert Fairclough, Managing Director of Ashdown, and Anita Chakravarti, Lead Privacy Engineer at Ashdown, provided the following inputs to this DPIA:
(a) Data flow mapping outputs: Ashdown prepared detailed data flow maps for the NorthCloud freemium marketing profiling system, identifying all data collection points, data storage locations, internal and external data flows, and processing technology dependencies. The data flow diagram at Appendix A is derived from Ashdown's mapping outputs.
(b) Technical assessment of cookies and tracking technologies: Ms Chakravarti conducted a technical audit of all cookies, pixels, SDKs, and similar tracking technologies deployed on the NorthCloud freemium-tier web and

DATA PROTECTION IMPACT ASSESSMENT

Record

Parties

Dates

Amounts