Privacy Notice — Consumer Subscribers (NorthCloud Platform)

Privacy Notice — Consumer Subscribers (NorthCloud Platform)
Effective Date: 1 September 2023
Version 2.0 (Revised)
This Privacy Notice has been prepared by Calderwood & Harkness LLP on behalf of Northgate Telecommunications PLC. It has been drafted to comply with the transparency and information requirements set out in Articles 13 and 14 of Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and the corresponding provisions of the UK General Data Protection Regulation (the "UK GDPR"), as retained and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and the Data Protection Act 2018.
Right-click to update Table of Contents
1. Who We Are — Identity of the Controller
The controller of your personal data is Northgate Telecommunications PLC ("NTP," "we," "us," or "our"), a public limited company incorporated in England and Wales under Company Number 04837291.
Our registered office address is:
Northgate Telecommunications PLC 140 Queensway Place Reading, Berkshire RG1 4QT United Kingdom
Our principal office address, from which our day-to-day data protection governance is conducted, is:
Northgate Tower 88 Canary Wharf Boulevard London E14 5HN United Kingdom
NTP operates the NorthCloud unified communications platform, a cloud-based Software-as-a-Service ("SaaS") solution provided to consumers and businesses across the United Kingdom and fourteen (14) EU/EEA member states. NorthCloud delivers voice, video, messaging, collaboration, and IoT connectivity services to millions of subscribers through a single integrated platform. As the provider of the NorthCloud platform and the entity that determines the purposes and means of processing your personal data in connection with your consumer subscription, NTP acts as the data controller for the purposes of the GDPR and the UK GDPR.
NTP is registered with the UK Information Commissioner's Office ("ICO") under registration number ZA482917. You may verify this registration at the ICO's public register of data controllers.
For its EU operations, NTP's EU establishment is Northgate Ireland Ltd, a private limited company registered in Ireland under Companies Registration Office ("CRO") Number 587214, with its registered address at:
Unit 12, Grand Canal Dock Business Centre Barrow Street Dublin 2, D02 KV92 Ireland
Northgate Ireland Ltd serves as the main establishment of NTP within the European Union for the purposes of Article 56 GDPR. Accordingly, the Data Protection Commission ("DPC") of Ireland acts as the lead EU supervisory authority with respect to NTP's cross-border processing activities in the EU/EEA under the one-stop-shop mechanism.
In addition to Northgate Ireland Ltd, NTP's EU subsidiaries involved in the delivery, support, and operation of NorthCloud services across the EU/EEA include the following entities:
•  Northgate GmbH — Berlin, Germany (sales, engineering, and data centre operations)
•  Northgate B.V. — Amsterdam, Netherlands (data centre and network operations)
•  Northgate France SAS — Paris, France (sales and customer support)
•  Northgate Iberia S.L. — Madrid, Spain (sales and managed services)
Each of these entities may process personal data on behalf of, or jointly with, NTP in connection with the delivery of NorthCloud services. The specific roles and responsibilities of these entities are governed by intra-group data processing agreements and, where applicable, joint controllership arrangements that clearly allocate responsibilities under the GDPR.
2. How to Contact Our Data Protection Officer
NTP has appointed a Data Protection Officer ("DPO") in accordance with Article 37 of the GDPR and the UK GDPR. The DPO is responsible for overseeing NTP's compliance with applicable data protection legislation, advising on data protection impact assessments, and serving as the primary point of contact for data subjects and supervisory authorities in relation to all matters concerning the processing of personal data.
Our DPO is:
Sanjay Mehta Data Protection Officer Northgate Telecommunications PLC Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN United Kingdom
You may contact the DPO by any of the following means:
Email: dpo@northgatetelecoms.com Post: Data Protection Officer, Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom
Data subjects may contact the DPO with any questions regarding how their personal data is processed, to request further information about the processing activities described in this Privacy Notice, or to exercise any of their data protection rights as set out in Section 10 below. We endeavour to acknowledge all privacy inquiries within five (5) business days and to provide a substantive response within the timeframes required by applicable law.
When contacting us, please provide sufficient information to enable us to identify you and to understand your query or request. We may need to verify your identity before responding to certain requests, as described further in Section 10.9 below.
3. What Personal Data We Collect
This section sets out the categories of personal data that NTP processes in connection with NorthCloud consumer subscriber accounts. The specific data processed in relation to your account will depend on the NorthCloud subscription tier you have chosen (including the freemium, standard, and premium tiers), the features and services you use, and your interactions with NTP and the NorthCloud platform.
3.1 Account and Identity Data
When you create a NorthCloud consumer subscriber account, we collect personal data that is necessary to establish and manage your account and to verify your identity. This includes:
•  Your full name (first name, middle name or initial, and surname);
•  Your email address;
•  Your postal address (including street address, city, county or region, postcode, and country);
•  Your telephone number (mobile and/or landline);
•  Your date of birth;
•  Your account credentials, including your chosen username and password (passwords are stored in cryptographically hashed form using industry-standard hashing algorithms and are not accessible to NTP personnel in plaintext); and
•  Government-issued identification documents (such as a passport, driving licence, or national identity card), where required for identity verification purposes—for example, where you request a change to your account, where we are required to verify your identity for regulatory purposes, or in connection with the exercise of certain data protection rights.
3.2 Billing and Financial Data
In order to process payments for your NorthCloud subscription and to manage your billing relationship with NTP, we collect and process the following financial and transactional data:
•  Payment card details, including card number, cardholder name, expiry date, and card verification value (CVV) (note: full payment card details are processed by our PCI-DSS compliant payment processors and are not stored in cleartext by NTP);
•  Bank account information, including sort code and account number, where you have opted to pay by direct debit;
•  Your billing address, where different from your postal address;
•  Your complete transaction history with NTP, including details of subscription charges, one-off payments, credits, refunds, and adjustments;
•  Invoices generated in connection with your subscription; and
•  Payment status information, including records of successful and failed payment attempts, outstanding balances, and arrears.
3.3 Service Usage and Technical Data
When you use the NorthCloud platform, we automatically collect certain usage and technical data that is necessary for the provision and improvement of our services. This includes:
•  NorthCloud platform usage logs, including records of your login activity, features accessed, actions performed within the platform, and session duration;
•  Feature interaction data, such as which NorthCloud features you use most frequently (e.g., voice calling, video conferencing, messaging, file sharing, screen sharing), the frequency and duration of such use, and your navigation patterns within the platform;
•  Your Internet Protocol ("IP") address, including both IPv4 and IPv6 addresses;
•  Device identifiers, including the make, model, and unique device identifier of any device used to access the NorthCloud platform;
•  Browser type and version, operating system type and version, screen resolution, and language settings;
•  Data collected through cookies and similar tracking technologies deployed on the NorthCloud platform, including but not limited to session cookies, persistent cookies, web beacons, pixel tags, and local storage objects.
For detailed information regarding the specific cookies and similar tracking technologies used on the NorthCloud platform, the purposes for which they are used, and how you can manage your cookie preferences, please refer to our separate Cookie Policy, which is available on the NorthCloud platform at any time and is incorporated by reference into this Privacy Notice.
3.4 Communications Data
NTP provides voice calling, video conferencing, and messaging services through the NorthCloud platform. In connection with these services, we process certain communications data:
•  Communications content: The content of communications made through the NorthCloud platform—including voice calls, video calls, and instant messages—is processed to the extent technically necessary for the provision of the service (i.e., for the real-time transmission and delivery of communications to the intended recipients). NTP does not ordinarily retain communications content beyond what is necessary for real-time delivery, except where retention is required for specific service provision purposes (e.g., voicemail storage, message history features selected by the subscriber) or where required by law.
•  Call metadata: NTP collects metadata associated with communications conducted through the NorthCloud platform, including the date and time of calls, the duration of calls, the identities or identifiers of call participants, and related technical routing information.
The processing of communications data is subject to applicable telecommunications regulations, including the Regulation of Investigatory Powers Act 2000 ("RIPA"), the Investigatory Powers Act 2016, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") in the United Kingdom, as well as equivalent EU member state legislation implementing Directive 2002/58/EC (the "ePrivacy Directive"). Further details regarding communications data retention are set out in Sections 5.4 and 9 of this Privacy Notice.
3.5 Network and Connectivity Data
As a telecommunications and unified communications provider, NTP processes certain network and connectivity data in order to deliver, maintain, and optimise the NorthCloud platform. This includes:
•  Subscriber metadata associated with your NorthCloud account and the network services provided to you;
•  Location data, including cell-level location information (where you access NorthCloud services via mobile networks) and IP-derived geolocation data;
•  Device identifiers associated with your use of NorthCloud services, including International Mobile Equipment Identity ("IMEI") numbers and Media Access Control ("MAC") addresses, where applicable; and
•  Network performance telemetry data associated with your subscriber account, including latency, packet loss, jitter, bandwidth utilisation, and signal strength metrics collected for the purpose of monitoring and improving service quality.
3.6 Marketing and Preferences Data
NTP collects and processes certain data relating to your communication preferences and, where you have consented, your marketing profile:
•  Your communication preferences, including your preferred method of contact (email, SMS, in-platform notification, post) and the types of communications you wish to receive from NTP;
•  Your marketing opt-in and opt-out status, including records of when and how you provided or withdrew consent to receive marketing communications;
•  Profiling data used for targeted advertising on the NorthCloud freemium tier, where you have consented to such processing (see Sections 5.3 and 6.3 for further details). This includes interest categories and behavioural segments inferred from your usage of the NorthCloud platform; and
•  Demographic data and inferred preferences used to tailor advertising content displayed within the NorthCloud freemium tier.
3.7 Customer Support Data
When you contact NTP for customer support, we collect and process data relating to your inquiry or complaint, including:
•  Records of your queries, complaints, and support tickets, including the subject matter, date, and resolution status of each interaction;
•  Written correspondence exchanged between you and NTP's customer support team, whether by email, in-platform chat, or post;
•  Call recordings of telephone interactions with NTP's customer support team, where applicable. Where calls are recorded for quality assurance and training purposes, you will be informed at the commencement of the call and given the opportunity to object; and
•  Any additional personal data you voluntarily provide to us in the course of a customer support interaction.
4. How We Collect Your Personal Data
NTP collects personal data from range sources, which we describe below.
4.1 Data Provided Directly by You
We collect personal data that you provide to us directly through your interactions with NTP and the NorthCloud platform. This includes, but is not limited to, data provided:
•  When you register for a NorthCloud consumer subscriber account;
•  When you complete subscription forms, including the selection of your subscription tier and the provision of billing information;
•  When you contact NTP's customer service team by telephone, email, in-platform chat, or post;
•  When you participate in surveys, competitions, promotions, or research activities conducted by NTP;
•  When you update your account information, communication preferences, or marketing consent settings through the NorthCloud platform;
•  When you submit a complaint or a data subject access request; and
•  When you interact with NTP via social media or other public channels.
4.2 Data Collected Automatically
We collect certain personal data automatically through your use of the NorthCloud platform. This data is generated by the platform and the underlying network infrastructure as a consequence of your use of the services and includes:
•  Service usage logs and feature interaction data, as described in Section 3.3;
•  Cookies and similar tracking technologies, as described in Section 3.3 and our separate Cookie Policy;
•  Device and network data, including IP addresses, device identifiers, browser and operating system information, and network performance telemetry data, as described in Sections 3.3 and 3.5; and
•  Communications metadata, as described in Section 3.4.
For comprehensive information regarding the cookies and similar tracking technologies deployed on the NorthCloud platform, including the specific cookies used, the purposes of processing, and the mechanisms available to you for managing your cookie preferences, please refer to NTP's Cookie Policy, which is available on the NorthCloud platform.
4.3 Data Obtained from Third Parties
In certain circumstances, NTP obtains personal data about you from third-party sources. These sources include:
•  Credit reference agencies: NTP may obtain credit history and credit scoring data from recognised credit reference agencies for the purpose of assessing your creditworthiness at the point of subscription and for ongoing fraud detection. The credit reference agencies with which NTP works include Penrose Group, Harborview Enterprises, and Penmark Enterprises. When we conduct a credit check, the credit reference agency will record a search on your credit file.
•  Publicly available sources: NTP may collect personal data from publicly available sources, such as public registers, open electoral rolls, and publicly accessible social media profiles, for the purpose of identity verification or fraud prevention.
•  Third-party advertising partners: In connection with the NorthCloud freemium tier and where you have provided your consent, NTP may receive data from third-party advertising partners and advertising networks. This data may include advertising identifiers, interest categories, and engagement data, and is used for the purpose of delivering targeted advertising within the NorthCloud freemium tier.
Where we obtain personal data from third-party sources, we take reasonable steps to ensure that the third party has a lawful basis for sharing the data with us, and we process the data in accordance with the terms of this Privacy Notice and applicable data protection law.
5. Purposes and Legal Bases for Processing
This section explains the specific purposes for which NTP processes your personal data and the lawful basis that we rely upon for each purpose, as required by Articles 13(1)(c) and 14(1)(c) of the GDPR and the UK GDPR. Where we rely on legitimate interests as the lawful basis, we have identified the specific legitimate interest pursued and have conducted a balancing assessment to ensure that the processing does not override your fundamental rights and freedoms.
The following table provides a summary of the purposes for which we process your personal data, the categories of data involved, and the applicable lawful basis under Article 6(1) of the GDPR / UK GDPR:
5.1 Performance of a Contract — Article 6(1)(b)
Processing that is necessary for the performance of the contract between you and NTP (i.e., your NorthCloud subscription agreement) or in order to take steps at your request prior to entering into such a contract:
5.2 Legitimate Interests — Article 6(1)(f)
Processing that is necessary for the purposes of the legitimate interests pursued by NTP or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms:
Where we rely on legitimate interests as the lawful basis for processing, you have the right to object to such processing in accordance with Article 21 of the GDPR / UK GDPR. Please see Section 10.6 below for further information on how to exercise this right.
5.3 Consent — Article 6(1)(a)
Processing that is carried out on the basis of your freely given, specific, informed, and unambiguous consent:
Important: Where consent is the lawful basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may withdraw your consent:
•  For marketing profiling and targeted advertising: through the "Privacy Settings" section of your NorthCloud account dashboard, or by contacting the DPO (see Section 2);
•  For non-essential cookies: through the cookie management platform accessible via the cookie settings icon on the NorthCloud platform; or
•  By contacting the DPO at any time using the details set out in Section 2.
5.4 Legal Obligation — Article 6(1)(c)
Processing that is necessary for NTP's compliance with a legal obligation to which it is subject:
5.5 Vital Interests — Article 6(1)(d)
In limited and exceptional circumstances, NTP may process personal data where it is necessary to protect the vital interests of a subscriber or another natural person. Specifically:
•  Emergency location services: Where a subscriber makes an emergency call through the NorthCloud platform, NTP may process location data and other personal data as necessary to enable emergency services to locate the subscriber and to protect the vital interests of the subscriber or another person whose life may be at risk.
NTP relies on this lawful basis only in genuine emergency situations and does not use it as a general basis for the processing of location data.
5.6 Public Interest — Article 6(1)(e)
In certain circumstances, NTP processes personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority:
•  Processing that is necessary for NTP's compliance with regulatory obligations in the telecommunications sector, including obligations imposed by the Office of Communications ("Ofcom") under the Communications Act 2003, the Electronic Communications Code, and equivalent EU member state telecommunications regulatory frameworks.
6. Automated Decision-Making and Profiling
NTP uses automated processing, including profiling, in certain contexts in connection with the NorthCloud platform. In accordance with Articles 13(2)(f), 14(2)(g), and 22 of the GDPR and the UK GDPR, we provide you with the following information regarding these activities.
6.1 Customer Churn Prediction
NTP operates an AI-driven customer churn prediction model on the NorthCloud platform. The purpose of this model is to identify subscribers who may be at risk of discontinuing their subscription, so that NTP can proactively address service issues and offer tailored retention offers.
Data processed: The model analyses service usage patterns (including platform feature usage frequency, session duration, and trends over time), billing history (including payment behaviour and subscription tier changes), and engagement data (including responsiveness to NTP communications and participation in surveys or promotions).
Nature of the processing: The model generates a churn risk score for each subscriber, which is a numerical indicator of the predicted likelihood that the subscriber will cancel their subscription within a defined future period. This profiling is used to inform retention offers (such as discounted subscription rates, feature upgrades, or personalised recommendations) and to prioritise service improvement efforts.
Impact on you: The customer churn prediction model does not produce legal effects concerning you and does not similarly significantly affect you within the meaning of Article 22(1) GDPR / UK GDPR. The model does not result in automated decisions to terminate, restrict, or modify your subscription or your access to NorthCloud features.
Safeguards: NTP has implemented the following safeguards in connection with this processing:
•  Human-in-the-loop review: All retention actions informed by the churn prediction model are subject to review and approval by a member of NTP's Customer Retention team before being implemented. No automated action is taken solely on the basis of the model's output.
•  Data minimisation: The model uses only the minimum categories of data necessary to achieve its purpose. Direct identifiers are pseudonymised within the model's processing environment.
•  Model explainability: NTP maintains documentation of the model's logic, the features used, and the factors contributing to individual predictions, to enable meaningful explanation to data subjects upon request.
•  DPIA-001: A Data Protection Impact Assessment has been completed in respect of this processing, as required by Article 35 GDPR / UK GDPR. The DPIA assessed the risks to the rights and freedoms of data subjects and identified the safeguards described above as appropriate mitigating measures.
6.2 Credit Scoring and Fraud Detection
NTP uses automated processes for credit scoring at the point of subscription and for ongoing fraud detection in connection with NorthCloud consumer subscriber accounts.
Credit scoring: When you apply for certain NorthCloud subscription tiers (specifically, the standard and premium tiers), NTP may conduct an automated credit assessment using data obtained from credit reference agencies in combination with identity verification signals and, where applicable, your payment history with NTP. The purpose of this assessment is to determine your eligibility for the selected subscription tier and to manage NTP's credit risk.
Potential impact: The outcome of the credit scoring process may result in the refusal of certain subscription tiers or in the imposition of conditions (such as a requirement for advance payment or a deposit). Where a decision based solely on automated processing, including profiling, produces legal effects concerning you or similarly significantly affects you, you have the following rights:
•  The right to request human intervention in the decision-making process;
•  The right to express your point of view regarding the decision; and
•  The right to contest the decision.
Logic involved: The credit scoring assessment evaluates the following factors: credit history data (including credit scores, existing credit commitments, and records of defaults or arrears), payment behaviour (including the regularity and timeliness of payments), and identity verification signals (including the consistency of identity data provided with data held by credit reference agencies and fraud prevention databases).
Fraud detection: NTP operates ongoing automated fraud detection processes that monitor account activity, transaction patterns, and network behaviour for indicators of fraudulent activity, including account takeover, identity fraud, payment fraud, and subscription fraud. Where the fraud detection system identifies suspicious activity, the matter is escalated to NTP's Fraud and Security team for human review and investigation.
6.3 Marketing Profiling (Freemium Tier)
Where you have provided your consent (see Section 5.3), NTP processes your usage data and inferred interest categories for the purpose of delivering targeted advertising within the NorthCloud freemium tier.
Profiling logic: NTP uses behavioural segmentation techniques to assign you to interest categories based on your usage of the NorthCloud platform. The segmentation process considers the following factors:
•  Platform feature usage patterns (e.g., frequency of voice calls, video calls, messaging, file sharing);
•  Content interaction data (e.g., types of content accessed or shared through the platform);
•  Demographic inferences drawn from the above usage data (e.g., inferred age range, professional or personal use patterns, geographic region); and
•  Data received from third-party advertising partners, where applicable and where you have consented.
Impact on you: Marketing profiling on the freemium tier determines the advertising content displayed to you within the NorthCloud platform. It does not affect your access to NorthCloud features or services, does not produce legal effects concerning you, and does not similarly significantly affect you.
Your rights: You may object to this profiling or withdraw your consent to marketing profiling and targeted advertising at any time. See Sections 5.3 and 10 for details on how to exercise these rights. Upon withdrawal of consent, NTP will cease processing your data for marketing profiling purposes and will no longer serve targeted advertising to you on the NorthCloud freemium tier. You will instead receive non-targeted, contextual advertising.
7. Who We Share Your Personal Data With
NTP does not sell your personal data. We share your personal data only with the categories of recipients described below and only to the extent necessary for the purposes identified in this Privacy Notice.
7.1 NTP Group Companies
NTP shares personal data with the following NTP Group companies in connection with the delivery, support, and operation of NorthCloud services:
Data sharing within the NTP Group is governed by an intra-group data processing agreement and, where applicable, intra-group data transfer agreements incorporating EU Standard Contractual Clauses or the UK International Data Transfer Agreement, as appropriate. All NTP Group companies are bound by NTP's group data protection policies and standards.
7.2 Data Processors
NTP engages the following third-party data processors to process personal data on its behalf in connection with the NorthCloud platform. Each data processor operates under a written data processing agreement that complies with the requirements of Article 28 GDPR / UK GDPR:
Pinnacle Cloud Services Ltd
Apex House, 24 Victoria Embankment, London EC4Y 0DZ, United Kingdom Company Number: 09142837
Pinnacle Cloud Services Ltd ("Pinnacle") is NTP's primary cloud infrastructure and hosting provider for the NorthCloud platform. Pinnacle operates data centres in London, Frankfurt, Amsterdam, Dublin, and Stockholm, and provides infrastructure-as-a-service, platform hosting, storage, and related managed services to NTP.
Pinnacle engages the following sub-processors in connection with its provision of services to NTP:
•  Pinnacle India Pvt Ltd (Gurugram, Haryana, India) — Provides infrastructure support services, including infrastructure monitoring, patch management, and incident response support. See Section 8.2 for details on the applicable international transfer safeguards.
•  Pinnacle APAC Pte Ltd (Singapore) — Provides network monitoring and incident response services. See Section 8.3 for details on the applicable international transfer safeguards.
NTP has approved Pinnacle's engagement of each sub-processor and has ensured that appropriate data processing agreements and international transfer safeguards are in place throughout the sub-processing chain.
Caldwell Analytics Inc.
2700 Technology Drive, Suite 400, San Jose, CA 95134, United States of America
Caldwell Analytics Inc. ("Caldwell") provides AI-driven network analytics and predictive maintenance services to NTP. Caldwell processes pseudonymised subscriber analytics data, including subscriber metadata, location data, and device identifiers, for the purpose of generating network performance insights, identifying infrastructure issues, and enabling predictive maintenance of the NorthCloud platform. Caldwell's services are provided under a Master Services Agreement dated 1 June 2021, which incorporates a data processing agreement compliant with Article 28 GDPR / UK GDPR. See Section 8.1 for details on the applicable international transfer safeguards.
Sunderland-Hayes Payroll Services Inc.
New York, United States of America
Sunderland-Hayes Payroll Services Inc. provides cross-border payroll administration services to NTP. This processor is relevant only to the extent that your personal data is processed in connection with NTP employee interactions (e.g., where NTP employee data and consumer subscriber data intersect in the context of customer support interactions). Sunderland-Hayes is not a primary processor of NorthCloud consumer subscriber data.
Moritaka Systems K.K.
Tokyo, Japan
Moritaka Systems K.K. ("Moritaka") is NTP's IoT analytics partner. Moritaka processes data from approximately 12,000 IoT device endpoints for connected-vehicle telemetry and related IoT analytics purposes. If you use NorthCloud IoT connectivity features (for example, connected-vehicle or smart device services), your data may be processed by Moritaka in connection with those features. See Section 8.4 for details on the applicable international transfer safeguards.
7.3 Other Third Parties
In addition to the NTP Group companies and data processors described above, NTP may share your personal data with the following categories of third-party recipients:
•  Credit reference agencies: NTP shares account and identity data, billing and financial data, and related information with credit reference agencies for the purpose of conducting credit assessments and for ongoing fraud detection. These agencies may use your data in accordance with their own privacy notices.
•  Fraud prevention agencies: NTP shares data with fraud prevention agencies and databases for the purpose of detecting and preventing fraud. Information shared with fraud prevention agencies may be used by those agencies to assist other organisations in their fraud prevention activities.
•  Law enforcement agencies and regulators: NTP may disclose personal data to law enforcement agencies, regulatory authorities, courts, and other public bodies where required or permitted by law, including in response to valid legal process (such as court orders, warrants, or subpoenas), in connection with the prevention or detection of crime, or in compliance with regulatory obligations.
•  Professional advisers: NTP may share personal data with its professional advisers, including Whitmore Kendall LLP (NTP's statutory auditors), legal advisers, and other consultants, to the extent necessary for the provision of audit, legal, accounting, or compliance services. Such sharing is subject to professional obligations of confidentiality.
•  Advertising partners (freemium tier): Where you have provided your consent, NTP may share limited personal data (such as advertising identifiers and interest categories) with third-party advertising partners for the purpose of delivering targeted advertising within the NorthCloud freemium tier. NTP does not share your name, email address, telephone number, or other direct identifiers with advertising partners without your explicit consent.
8. International Transfers of Your Personal Data
NTP operates data centres in London, Frankfurt, Amsterdam, and Dublin, and processes the majority of NorthCloud consumer subscriber data within the United Kingdom and the European Economic Area ("EEA"). However, in connection with certain processing activities described in this Privacy Notice, your personal data may be transferred to, and processed in, countries outside the United Kingdom and the EEA.
NTP ensures that all international transfers of personal data are protected by appropriate safeguards in accordance with Chapter V of the GDPR (Articles 44–49) and the equivalent provisions of the UK GDPR, as supplemented by the Data Protection Act 2018 and guidance issued by the ICO and the European Data Protection Board ("EDPB").
The specific international transfers, the recipients involved, and the applicable transfer safeguards are described below.
8.1 Transfers to the United States
Caldwell Analytics Inc. — Network analytics data, including pseudonymised subscriber metadata, location data, and device identifiers, is transferred from NTP (acting as controller) to Caldwell Analytics Inc. in San Jose, California, United States of America, for the purposes of AI-driven network analytics and predictive maintenance (see Sections 5.2 and 7.2).
This transfer is protected by the following safeguards:
•  EU Standard Contractual Clauses ("SCCs"): NTP and Caldwell have executed the European Commission's Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), dated 17 July 2023.
•  UK International Data Transfer Agreement ("IDTA"): NTP and Caldwell have executed the UK International Data Transfer Agreement issued by the ICO under Section 119A of the Data Protection Act 2018, also dated 17 July 2023.
•  Supplementary measures: In addition to the contractual safeguards, the following supplementary technical, organisational, and contractual measures have been implemented:
•  Encryption at rest using AES-256 encryption for all personal data stored in Caldwell's systems;
•  Encryption in transit using TLS 1.3 for all personal data transmitted between NTP and Caldwell;
•  Pseudonymisation of direct identifiers (such as subscriber names and email addresses) prior to transfer, such that Caldwell processes only pseudonymised subscriber metadata;
•  Contractual audit rights, enabling NTP to conduct or commission audits of Caldwell's data processing facilities and practices;
•  Data localisation requirements for certain categories of data, ensuring that specified data elements are not transferred outside defined geographic boundaries; and
•  Access controls limiting Caldwell personnel who may access the transferred data to those with a demonstrable business need.
•  Transfer Impact Assessment ("TIA"): NTP has completed a Transfer Impact Assessment in accordance with the EDPB's Recommendations 01/2020 and the ICO's guidance on international data transfers. The TIA assessed the legal framework of the United States, with particular reference to the Foreign intelligence Surveillance Act ("FISA") Section 702, Executive Order 12333, and the Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"). The TIA concluded that, in light of the supplementary measures described above—particularly the pseudonymisation of direct identifiers and the application of strong encryption—the transfer does not undermine the level of protection guaranteed by the GDPR and the UK GDPR.
8.2 Transfers to India
Pinnacle India Pvt Ltd (Gurugram, Haryana, India) — Infrastructure support data is transferred from Pinnacle Cloud Services Ltd (acting as processor on behalf of NTP) to Pinnacle India Pvt Ltd (acting as sub-processor) for the purpose of providing infrastructure monitoring, patch management, and incident response support services.
This transfer is protected by:
•  EU Standard Contractual Clauses ("SCCs"): Pinnacle Cloud Services Ltd and Pinnacle India Pvt Ltd have executed the European Commission's SCCs, Module 3 (Processor to Sub-processor).
•  UK Addendum: The UK Addendum to the EU SCCs (as approved by the ICO) has been executed to ensure compliance with the UK GDPR.
•  Supplementary measures: Additional technical and organisational measures have been implemented, including encryption, access controls, and data minimisation protocols.
•  Transfer Impact Assessment: A TIA has been completed assessing the legal framework in India, including the Information Technology Act 2000 (and its amendments), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and government surveillance powers under Indian law. The TIA concluded that, taking into account the nature of the data transferred and the supplementary measures applied, the level of protection is not undermined.
8.3 Transfers to Singapore
Pinnacle APAC Pte Ltd (Singapore) — Network monitoring and incident response data is transferred from Pinnacle Cloud Services Ltd (acting as processor on behalf of NTP) to Pinnacle APAC Pte Ltd (acting as sub-processor) for the purpose of providing network monitoring, alerting, and incident response services.
This transfer is protected by:
•  EU Standard Contractual Clauses ("SCCs"): Pinnacle Cloud Services Ltd and Pinnacle APAC Pte Ltd have executed the European Commission's SCCs, Module 3 (Processor to Sub-processor).
•  UK Addendum: The UK Addendum to the EU SCCs has been executed.
•  Transfer Impact Assessment: A TIA has been completed assessing the legal framework in Singapore, including the Personal Data Protection Act 2012 (as amended) and related surveillance and access powers. The TIA concluded that, in light of the applicable supplementary measures, the transfer provides an adequate level of protection.
8.4 Transfers to Japan
Moritaka Systems K.K. (Tokyo, Japan) — IoT platform analytics data is transferred from NTP to Moritaka for the purpose of IoT analytics in connection with NorthCloud IoT connectivity features (see Section 7.2).
This transfer relies on:
•  EU Adequacy Decision for Japan: The European Commission adopted an adequacy decision for Japan on 23 January 2019, finding that Japan ensures an adequate level of protection for personal data transferred from the EU. Accordingly, transfers of personal data to Moritaka benefit from this adequacy decision.
•  Additional contractual and technical measures: Notwithstanding the adequacy decision, NTP and Moritaka have implemented additional contractual provisions and technical safeguards, including data encryption and access controls, to further protect the transferred data.
•  Transfer Impact Assessment: A TIA has been completed, supplementing the adequacy decision with an assessment of the specific processing activities and the data categories involved.
8.5 Obtaining a Copy of Transfer Safeguards
You may request a copy of the relevant transfer safeguards, including the Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum, and summaries of the supplementary measures applied, by contacting the DPO using the contact details set out in Section 2. Certain information may be redacted to protect commercial confidentiality, but the redacted copy will provide sufficient detail to enable you to understand the safeguards in place.
9. How Long We Keep Your Personal Data
NTP retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. We have established specific retention periods for each category of personal data, which are set out in NTP's internal Data Retention Schedule and summarised in the table below.
Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with NTP's Data Retention Schedule and its documented deletion and anonymisation protocols. NTP maintains audit logs of all data deletion and anonymisation activities. Where personal data has been shared with third-party data processors, NTP requires those processors, by contract, to delete or return the data upon the expiry of the relevant retention period or upon termination of the processing relationship, in accordance with Article 28(3)(g) GDPR / UK GDPR.
In certain exceptional circumstances, NTP may retain personal data beyond the standard retention periods specified above—for example, where retention is necessary for the establishment, exercise, or defence of legal claims, or where NTP is required by law to retain specific data for a longer period.
10. Your Data Protection Rights
Under the GDPR and the UK GDPR, you have a number of rights in relation to your personal data. These rights are subject to certain conditions and exceptions as set out in the applicable legislation. NTP is committed to respecting and facilitating the exercise of your data protection rights in a transparent and timely manner.
10.1 Right of Access (Article 15)
You have the right to request confirmation of whether NTP processes your personal data and, where we do, to obtain access to that personal data together with certain supplementary information. This is commonly known as a "data subject access request" or "DSAR."
Upon receipt of a valid access request, NTP will provide you with a copy of your personal data, together with information about the purposes of processing, the categories of data concerned, the recipients or categories of recipients to whom the data has been disclosed, the envisaged retention periods, and your rights in relation to the data.
NTP will respond to valid access requests within one (1) calendar month of receipt of the request. This period may be extended by a further two (2) months where requests are complex or numerous, in which case NTP will inform you of the extension and the reasons for it within the initial one-month period.
10.2 Right to Rectification (Article 16)
You have the right to request the correction of inaccurate personal data that NTP holds about you and to request the completion of incomplete personal data. NTP will take reasonable steps to ensure that inaccurate data is corrected without undue delay.
Where NTP has shared the inaccurate data with third-party recipients, we will inform those recipients of the rectification, unless doing so proves impossible or involves disproportionate effort.
10.3 Right to Erasure — "Right to Be Forgotten" (Article 17)
You have the right to request the deletion of your personal data in certain circumstances, including:
•  Where the data is no longer necessary for the purpose for which it was originally collected or processed;
•  Where you withdraw your consent (and consent was the lawful basis for processing);
•  Where you exercise your right to object and there are no overriding legitimate grounds for the processing;
•  Where the data has been unlawfully processed; or
•  Where deletion is required for compliance with a legal obligation.
This right is subject to certain exceptions. NTP may refuse a request for erasure where processing is necessary for:
•  Compliance with a legal obligation (for example, communications data retention under the Investigatory Powers Act 2016);
•  The establishment, exercise, or defence of legal claims;
•  Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where erasure would seriously impair the processing; or
•  The exercise of the right to freedom of expression and information.
10.4 Right to Restriction of Processing (Article 18)
You have the right to request that NTP restricts the processing of your personal data in certain circumstances, including:
•  Where you contest the accuracy of your personal data, for a period enabling NTP to verify accuracy;
•  Where processing is unlawful and you oppose erasure, requesting restriction instead;
•  Where NTP no longer needs the data but you require it for the establishment, exercise, or defence of legal claims; or
•  Where you have objected to processing pending verification of whether NTP's legitimate grounds override your own.
Where processing is restricted, NTP will store the data but will not process it further (except with your consent, for the establishment, exercise, or defence of legal claims, for the protection of another person's rights, or for reasons of important public interest) until the restriction is lifted.
10.5 Right to Data Portability (Article 20)
You have the right to receive the personal data that you have provided to NTP in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to transmit that data to another controller without hindrance from NTP, where:
•  The processing is based on your consent (Article 6(1)(a)) or on a contract (Article 6(1)(b)); and
•  The processing is carried out by automated means.
Where technically feasible, you may also request that NTP transmit your data directly to another controller. This right applies only to personal data that you have directly provided to NTP and does not extend to data that NTP has generated or derived through its own processing activities.
10.6 Right to Object (Article 21)
You have the right to object to the processing of your personal data where the processing is based on NTP's legitimate interests (Article 6(1)(f)) or on the performance of a task carried out in the public interest (Article 6(1)(e)), including profiling based on those provisions.
Upon receipt of a valid objection, NTP will cease processing the relevant data unless NTP demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.
Direct marketing: You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time, including profiling to the extent that it is related to direct marketing. Where you exercise this right, NTP will cease processing your data for direct marketing purposes without exception.
10.7 Rights Related to Automated Decision-Making (Article 22)
Where decisions are made solely by automated means (including profiling) that produce legal effects concerning you or similarly significantly affect you, you have the right to:
•  Request human intervention in the decision-making process;
•  Express your point of view regarding the decision; and
•  Contest the decision.
For details on NTP's automated decision-making activities, including the logic involved, the significance, and the envisaged consequences of such processing, please see Section 6 of this Privacy Notice. In particular, if you are affected by an automated credit scoring decision (see Section 6.2), you may exercise the rights described above by contacting the DPO.
10.8 Right to Withdraw Consent
Where NTP's processing of your personal data is based on your consent (see Section 5.3), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
You may withdraw your consent through the following means:
•  Through the "Privacy Settings" section of your NorthCloud account dashboard;
•  Through the cookie management platform for non-essential cookies;
•  By contacting the DPO using the details set out in Section 2; or
•  By using the unsubscribe link included in marketing communications sent by NTP.
10.9 How to Exercise Your Rights
To exercise any of the rights described above, please contact NTP's Data Protection Officer:
Sanjay Mehta Data Protection Officer Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN, United Kingdom Email: dpo@northgatetelecoms.com
Identity verification: NTP will verify your identity before processing any data subject request. We may ask you to provide additional information to confirm your identity, such as your account number, registered email address, or a copy of a government-issued identification document. This is a security measure to ensure that personal data is not disclosed to any person who is not entitled to receive it.
Fees: No fee is charged for the exercise of your data protection rights, except where requests are manifestly unfounded or excessive (in particular, where requests are repetitive). In such cases, NTP may charge a reasonable fee based on administrative costs, or may refuse to act on the request, and will inform you of the reasons.
Response times: NTP will respond to all valid data subject requests within the timeframes required by applicable law—ordinarily within one (1) calendar month of receipt of the request, extendable by a further two (2) months for complex or numerous requests.
11. Right to Lodge a Complaint with a Supervisory Authority
If you are dissatisfied with how NTP handles your personal data or the exercise of your data protection rights, you have the right to lodge a complaint with the relevant data protection supervisory authority. NTP encourages you to contact our DPO in the first instance so that we may seek to resolve your concern, but this does not affect your right to complain directly to a supervisory authority at any time.
UK Subscribers.  If you are based in the United Kingdom, the relevant supervisory authority is:
Information Commissioner's Office ("ICO") Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF United Kingdom Website: ico.org.uk Telephone: 0303 123 1113
Ireland / EU Subscribers (Lead Supervisory Authority)
NTP's lead EU supervisory authority, by virtue of Northgate Ireland Ltd's establishment in Dublin, is:
Data Protection Commission ("DPC") 21 Fitzwilliam Square South Dublin 2, D02 RD28 Ireland Website: dataprotection.ie
Other EU/EEA Subscribers
If you are based in another EU/EEA member state, you may also lodge a complaint with the supervisory authority of the member state of your habitual residence, place of work, or place of the alleged infringement, in accordance with Article 77 GDPR. Relevant supervisory authorities include, but are not limited to:
•  BfDI — Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Germany)
•  Autoriteit Persoonsgegevens — Dutch Data Protection Authority (Netherlands)
•  CNIL — Commission Nationale de l'Informatique et des Libertés (France)
•  AEPD — Agencia Española de Protección de Datos (Spain)
A full list of EU/EEA supervisory authorities is available from the European Data Protection Board at edpb.europa.eu.
12. Cookies and Similar Technologies
NTP uses cookies and similar tracking technologies on the NorthCloud platform to provide essential functionality, to analyse how the platform is used, and—where you have given your consent—to deliver targeted advertising.
Essential cookies are strictly necessary for the operation of the NorthCloud platform and are placed automatically when you access the platform. These cookies do not require your consent and cannot be disabled without impairing the functionality of the platform.
Non-essential cookies, including analytics cookies and advertising cookies, are placed on your device only with your prior consent, obtained via our consent management platform ("CMP"). The CMP is displayed to you when you first access the NorthCloud platform and is accessible at any time through the cookie settings icon within the platform. You may modify or withdraw your consent to non-essential cookies at any time through the CMP.
For comprehensive information regarding the types of cookies and similar tracking technologies used on the NorthCloud platform, the specific cookies deployed, the purposes for which they are used, their durations, and the third parties that set them, please refer to our separate Cookie Policy, which is available on the NorthCloud platform and is incorporated by reference into this Privacy Notice.
13. Changes to This Privacy Notice
NTP may update this Privacy Notice from time to time to reflect changes in our processing activities, changes in applicable legal or regulatory requirements, changes in our business operations, or improvements to our data protection practices.
The current version of this Privacy Notice will always be available on the NorthCloud platform. We encourage you to review this Privacy Notice periodically to stay informed about how NTP protects your personal data.
Where changes to this Privacy Notice are material—for example, where we introduce new categories of personal data processing, new purposes of processing, new categories of recipients, or changes that may affect your rights—NTP will notify affected subscribers via email or in-platform notification prior to the changes taking effect, to provide you with an opportunity to review the updated notice.
This version of the Privacy Notice is Version 2.0, effective 1 September 2023. The previous version (Version 1.0) was effective from 15 March 2022 and has been superseded in its entirety by this version.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Notice, the processing of your personal data by NTP, or the exercise of your data protection rights, please contact:
Data Protection Officer: Sanjay Mehta Address: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom Email: dpo@northgatetelecoms.com
General privacy inquiries can also be directed to Northgate Telecommunications PLC at the above address, marked for the attention of the Data Protection Officer.
NTP will endeavour to respond to all inquiries promptly and in accordance with the requirements of applicable data protection law.
— End of Privacy Notice —
© 2023 Northgate Telecommunications PLC. All rights reserved.
Company Number: 04837291 (England and Wales) ICO Registration Number: ZA482917 Document Reference: NTP-PP-NORTHCLOUD-2023-v2.0
Drafted with the assistance of Calderwood & Harkness LLP, One Moorgate Square, London EC2R 6AN.
Purpose | Categories of Data
Providing and managing your NorthCloud consumer subscriber account, including account creation, authentication, and account maintenance | Account and identity data; service usage and technical data
Processing payments, managing billing cycles, generating invoices, and administering refunds and credits | Billing and financial data; account and identity data
Delivering customer support in response to your queries, complaints, and support tickets | Customer support data; account and identity data; service usage and technical data
Providing communications services through the NorthCloud platform, including voice, video, and messaging services | Communications data (content and metadata); network and connectivity data; service usage and technical data
Administering your subscription tier, including upgrades, downgrades, and renewals | Account and identity data; billing and financial data
Purpose | Legitimate Interest | Categories of Data
Network optimisation and service improvement | NTP's legitimate interest in maintaining, monitoring, and improving network performance and platform functionality to ensure a high-quality service for all subscribers | Service usage and technical data; network and connectivity data
Fraud detection and prevention | NTP's legitimate interest in protecting its business, its subscribers, and the integrity of the NorthCloud platform against fraudulent activity, including account takeover, identity fraud, and payment fraud | Account and identity data; billing and financial data; service usage and technical data; network and connectivity data
Customer credit scoring | NTP's legitimate interest in assessing the creditworthiness of prospective and existing subscribers to manage credit risk. A Legitimate Interest Assessment ("LIA") has been conducted and is documented in NTP's internal records | Account and identity data; billing and financial data; data obtained from credit reference agencies
Network analytics and predictive maintenance | NTP's legitimate interest in ensuring the reliability and resilience of its network infrastructure and the NorthCloud platform, including the use of third-party analytics providers (see Section 7.2 regarding Caldwell Analytics Inc.) | Network and connectivity data; service usage and technical data (pseudonymised)
AI-driven customer churn prediction | NTP's legitimate interest in understanding and reducing customer attrition in order to improve service retention and customer satisfaction. This processing is subject to safeguards including human-in-the-loop review of any retention actions, data minimisation, and model explainability. A Data Protection Impact Assessment ("DPIA-001") has been completed in respect of this processing | Service usage and technical data; billing and financial data; marketing and preferences data
Internal business analytics and reporting | NTP's legitimate interest in understanding business performance, subscriber demographics and trends, and operational efficiency | Service usage and technical data; billing and financial data; account and identity data (aggregated or pseudonymised where possible)
Platform security, including anomaly detection on network traffic | NTP's legitimate interest in detecting and responding to security threats, vulnerabilities, and unauthorised access to the NorthCloud platform and underlying infrastructure | Service usage and technical data; network and connectivity data; account and identity data
Purpose | Categories of Data
Marketing profiling and targeted advertising on the NorthCloud freemium tier — NTP processes your usage data and inferred interest categories for the purpose of delivering personalised advertising within the NorthCloud freemium tier. This processing is carried out only with your prior consent, obtained at the time of account registration or subsequently through the NorthCloud platform's privacy settings | Service usage and technical data; marketing and preferences data
Non-essential cookies and similar tracking technologies — NTP deploys analytics cookies, advertising cookies, and other non-essential tracking technologies on the NorthCloud platform only with your consent, obtained via our cookie management platform (consent management platform or "CMP") | Service usage and technical data; marketing and preferences data
Purpose | Applicable Legal Obligation
Retention of communications data (metadata) as required by law | Investigatory Powers Act 2016 (UK) and equivalent EU member state legislation implementing Directive 2006/24/EC or successor national measures implementing the ePrivacy Directive
Compliance with lawful intercept obligations | Regulation of Investigatory Powers Act 2000 (UK); Investigatory Powers Act 2016 (UK); and applicable EU member state legislation
Tax and financial record-keeping