[sheet: Cover]

[sheet: Cover]
Field | Value
Document Title | Records of Processing Activities (Article 30 GDPR) — Controller — EU Subsidiaries
Document Reference | NTP-ROPA-EU-v1.0
Engagement Reference | SC/NTP/2023-0213/PDS
Prepared By | Priscilla Wynn, Associate, Calderwood & Harkness LLP
Reviewed By | Sara Hendricks, Lead Associate, Calderwood & Harkness LLP
Supervised By | Kevin Ostrowski, Partner, Calderwood & Harkness LLP
Client Contact | Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC
Version | 1.0
Date Delivered | 19 May 2023
Classification | Confidential — Legal Privileged
Controller (Group Parent) | Northgate Telecommunications PLC
Registered Office (Parent) | 140 Queensway Place, Reading, Berkshire RG1 4QT, UK
Principal Office (Parent) | Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, UK
Company Number (Parent) | 04837291
DPO Contact | Sanjay Mehta, dpo@northgatetelecom.example.com
Lead Supervisory Authority (EU) | Data Protection Commission (Ireland)
ICO Registration Number | ZA482917
Total EU Processing Activities | 58
Data Mapping Consultant | Ashdown Consulting Group Ltd (Sundial Solutions platform configuration)
Phase | Phase 2 — ROPA & Data Mapping
Next Scheduled Review | May 2024 (annual review cycle)
[sheet: EU Entities]
Entity Full Legal Name | Short Name | Entity Type | Jurisdiction | Registration Number | Registered Office Address | Employees | Processing Activities Count | Local Supervisory Authority | EU Establishment Head
Northgate Ireland Ltd | NTP Ireland | Private limited company | Ireland | CRO: 587214 | Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland | 340 | 18 | Data Protection Commission (Ireland) | Marcus Engström, Head of EU Operations
Northgate GmbH | NTP Germany | GmbH | Germany (Berlin) | HRB 214503 B (AG Charlottenburg) | Friedrichstraße 91, 10117 Berlin, Germany | 185 | 16 | Berliner Beauftragte für Datenschutz und Informationsfreiheit | —
Northgate B.V. | NTP Netherlands | Besloten Vennootschap | Netherlands | KvK: 72841936 | Herikerbergweg 44, 1101 CM Amsterdam, Netherlands | 120 | 11 | Autoriteit Persoonsgegevens | —
Northgate France SAS | NTP France | Société par Actions Simplifiée | France | SIREN: 891 247 503 | 27 Rue de Berri, 75008 Paris, France | 95 | 8 | CNIL | —
Northgate Iberia S.L. | NTP Spain | Sociedad Limitada | Spain | CIF: B-91847263 | Calle de Serrano 41, 28001 Madrid, Spain | 70 | 5 | AEPD | —
TOTAL | 810 | 58
[sheet: ROPA — NTP Ireland]
Activity ID | Processing Activity Name | Description of Processing | Controller Entity | Purposes of Processing | Categories of Data Subjects | Categories of Personal Data | Special Category Data | Special Category Details | Lawful Basis — Art. 6 | Lawful Basis — Art. 9 (if applicable) | Legitimate Interest Description | Recipients / Categories of Recipients | International Transfers | Transfer Destination Country | Transfer Mechanism | Retention Period | Technical & Organisational Measures | Data Source | Automated Decision-Making / Profiling | DPIA Required | DPIA Reference | Date Added | Last Reviewed | Business Unit Owner
IE-001 | NorthCloud EU Customer Account Management | Processing of enterprise client account data for contract administration, billing, and service delivery on the NorthCloud SaaS platform for EU customers | Northgate Ireland Ltd | Contract performance — provision of NorthCloud SaaS services to EU enterprise clients | Enterprise clients (contact persons, administrators, end users) | Name, email, phone number, job title, company name, account credentials, billing address, payment details, service usage data | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | Pinnacle Cloud Services Ltd (hosting — Dublin data centre); NTP PLC (group administration) | No | N/A | N/A | Duration of contract + 6 years (Limitation Act) | AES-256 encryption at rest; TLS 1.3 in transit; role-based access controls; MFA; regular penetration testing | Directly from data subjects at onboarding | No | No | N/A | 3 April 2023 | 19 May 2023 | EU Commercial Operations
IE-002 | NorthCloud EU Customer Support & Ticketing | Processing of support tickets, chat transcripts, and call recordings for customer support services for EU NorthCloud users | Northgate Ireland Ltd | Contract performance — provision of customer support under service agreements | Enterprise clients (contact persons, end users) | Name, email, phone number, support ticket content, chat logs, call recordings, service issue details | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | Pinnacle Cloud Services Ltd (hosting); internal NTP support teams | No | N/A | N/A | Duration of contract + 3 years | Encrypted storage; access restricted to support staff; call recording notice provided | Directly from data subjects via support channels | No | No | N/A | 3 April 2023 | 19 May 2023 | EU Customer Support
IE-003 | NorthCloud EU Usage Analytics & Product Improvement | Aggregated and pseudonymised analysis of NorthCloud usage patterns to improve product features and service reliability | Northgate Ireland Ltd | Legitimate interest — product improvement and service optimisation | Enterprise client end users | Pseudonymised user IDs, feature usage logs, session duration, error logs, device/browser metadata | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Improving and optimising NorthCloud platform features, identifying service issues, and enhancing user experience. Balanced against minimal impact on data subjects due to pseudonymisation. | Laura Dearden, VP Product & Engineering (NTP PLC); Pinnacle Cloud Services Ltd (hosting) | No | N/A | N/A | 24 months from collection, then anonymised | Pseudonymisation of user identifiers; aggregation of analytics; access restricted to product team | Automatically collected via NorthCloud platform | No | No | N/A | 3 April 2023 | 19 May 2023 | Product & Engineering
IE-004 | EU Employee Records Management | Processing of employee personal data for employment administration, payroll, benefits, and statutory compliance for Northgate Ireland Ltd staff (340 employees) | Northgate Ireland Ltd | Performance of employment contract; compliance with Irish employment and tax law | Employees of Northgate Ireland Ltd | Name, address, date of birth, PPS number, bank details, salary, employment history, performance records, emergency contacts, next of kin | No | N/A | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(c) — Legal obligation | N/A | N/A | Revenue Commissioners (statutory); internal HR (Philippa Crane, Head of People & HR, NTP PLC); payroll provider | No | N/A | N/A | Duration of employment + 7 years (Revenue requirements) | HR system access controls; encrypted payroll data; audit logging | Directly from employees at onboarding and during employment | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Ireland)
IE-005 | EU Employee Health & Safety Records | Processing of employee health and safety data including occupational health assessments, workplace injury reports, and COVID-19 vaccination status (where voluntarily provided) | Northgate Ireland Ltd | Compliance with Irish Safety, Health and Welfare at Work Act 2005; legitimate interest in workplace safety | Employees of Northgate Ireland Ltd | Name, employee ID, occupational health assessment results, injury reports, first aid records, vaccination status (voluntary) | Yes | Health data (Article 9(2)(b) — employment and social security law obligations) | Art. 6(1)(c) — Legal obligation | Art. 9(2)(b) — Employment, social security and social protection law | N/A | Occupational health provider; Health and Safety Authority (statutory reporting) | No | N/A | N/A | Duration of employment + 10 years (statutory) | Restricted access (HR and occupational health only); encrypted storage; physical file security | Directly from employees; occupational health provider | No | Yes | DPIA-009 | 3 April 2023 | 19 May 2023 | People & HR (Ireland)
IE-006 | Network Analytics Data Transfer to Caldwell Analytics (US) | Transfer of pseudonymised subscriber analytics data (subscriber metadata, location data, device identifiers) to Caldwell Analytics Inc. in the US for AI-driven network analytics and predictive maintenance | Northgate Ireland Ltd | Legitimate interest — network optimisation, predictive maintenance, and service quality improvement | Consumer subscribers (Irish and EU NorthCloud users) | Pseudonymised subscriber IDs, network usage metadata, cell tower location data, device identifiers (IMEI hash), session logs, data throughput metrics | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Optimising network infrastructure, enabling predictive maintenance to prevent service outages, improving quality of service for subscribers. Pseudonymisation applied to minimise impact on data subjects. | Caldwell Analytics Inc. (processor — 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA) | Yes | United States | EU Standard Contractual Clauses (Module 2 — Controller to Processor), executed 17 July 2023; supplementary measures: AES-256 encryption at rest, TLS 1.3 in transit, pseudonymisation of direct identifiers, contractual audit rights | 12 months from collection, then deleted at Caldwell | AES-256 encryption at rest; TLS 1.3 in transit; pseudonymisation; contractual audit rights; access controls at Caldwell; TIA-001 completed | Automatically collected from NTP network infrastructure | Yes — profiling for predictive analytics | Yes | DPIA-011 | 3 April 2023 | 19 May 2023 | Network Operations (Ireland)
IE-007 | NorthCloud EU Hosting Infrastructure Operations | Processing of technical operational data by Pinnacle Cloud Services Ltd as processor for hosting NorthCloud EU platform infrastructure in Dublin data centre | Northgate Ireland Ltd | Legitimate interest — ensuring availability, security, and performance of NorthCloud platform infrastructure | Enterprise client end users; NTP employees using internal systems | IP addresses, system logs, access logs, performance metrics, error logs | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Ensuring platform uptime, security monitoring, and performance optimisation. Minimal impact on data subjects; data is technical and operational in nature. | Pinnacle Cloud Services Ltd (processor — Apex House, 24 Victoria Embankment, London EC4Y 0DZ, UK); Pinnacle India Pvt Ltd (sub-processor — infrastructure support); Pinnacle APAC Pte Ltd (sub-processor — network monitoring) | Yes | India (Pinnacle India Pvt Ltd); Singapore (Pinnacle APAC Pte Ltd) | EU SCCs Module 3 (Processor to Sub-processor); supplementary measures per TIA-002 and TIA-003 | 90 days rolling for logs; aggregated metrics retained 24 months | AES-256 encryption; TLS 1.3; network segmentation; SOC 2 Type II certified; DPA amended 28 June 2023 | Automatically generated by NorthCloud infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | IT Infrastructure (Ireland)
IE-008 | EU Marketing Communications & Newsletters | Sending marketing emails and newsletters to opted-in enterprise client contacts regarding NorthCloud product updates and EU events | Northgate Ireland Ltd | Consent (opt-in) for direct marketing communications | Enterprise client contacts (marketing contacts) | Name, email address, company, job title, marketing preferences, email engagement metrics (opens, clicks) | No | N/A | Art. 6(1)(a) — Consent | N/A | N/A | Email marketing platform (internal); NTP PLC marketing team | No | N/A | N/A | Until consent withdrawn + 30 days for suppression list | Consent management platform; unsubscribe mechanism; preference centre; suppression list maintenance | Directly from data subjects via opt-in forms | No | No | N/A | 3 April 2023 | 19 May 2023 | EU Marketing
IE-009 | EU Recruitment & Candidate Management | Processing of job applicant data for recruitment purposes across EU operations coordinated from Ireland | Northgate Ireland Ltd | Legitimate interest — recruitment and talent acquisition; pre-contractual steps at request of data subject | Job applicants and candidates | Name, email, phone, CV/resume, cover letter, interview notes, assessment results, references | No | N/A | Art. 6(1)(b) — Pre-contractual steps; Art. 6(1)(f) — Legitimate interests | N/A | Recruitment and talent acquisition to fill open positions; minimal privacy impact given applicants' expectation of data processing | Internal HR team; recruitment platform provider; hiring managers | No | N/A | N/A | 6 months from end of recruitment process (unsuccessful candidates); successful candidates — transferred to employee records | ATS access controls; encrypted storage; limited access to hiring panel | Directly from data subjects via application forms and recruitment portals | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Ireland)
IE-010 | EU Supplier & Vendor Management | Processing of supplier and vendor contact data for procurement, contract management, and payment processing | Northgate Ireland Ltd | Contract performance — supplier and vendor contract administration | Supplier and vendor contacts | Name, business email, business phone, job title, company, bank details (for payment), contract details, invoice data | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | Internal finance team; NTP PLC group procurement; banking provider | No | N/A | N/A | Duration of contract + 6 years | Access controls; encrypted payment data; audit logging | Directly from suppliers and vendors | No | No | N/A | 3 April 2023 | 19 May 2023 | Finance & Procurement (Ireland)
IE-011 | CCTV Surveillance — Dublin Office & Data Centre | Processing of CCTV footage for security and safety monitoring at Northgate Ireland's Dublin office and co-located data centre | Northgate Ireland Ltd | Legitimate interest — security and safety of premises, employees, and assets | Employees, contractors, visitors | CCTV footage, timestamps, location within premises | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Security of office and data centre premises; prevention and detection of crime; proportionate to risks associated with critical infrastructure | Internal security team; physical security contractor | No | N/A | N/A | 30 days (standard); up to 90 days if incident under investigation | CCTV signage; restricted access to footage; encrypted storage; periodic audits | Automatically captured by CCTV cameras | No | No | N/A | 3 April 2023 | 19 May 2023 | Facilities & Security (Ireland)
IE-012 | EU Cookie & Website Analytics | Processing of website visitor data through cookies and analytics tools on northgatetelecom.eu and related EU marketing sites | Northgate Ireland Ltd | Consent — cookie consent for non-essential cookies; legitimate interest for strictly necessary cookies | Website visitors | IP address (truncated), browser type, device type, pages visited, session duration, referral source, cookie identifiers | No | N/A | Art. 6(1)(a) — Consent (analytics/marketing cookies); Art. 6(1)(f) — Legitimate interests (strictly necessary cookies) | N/A | Website performance monitoring and security (strictly necessary only); analytics and marketing cookies rely on consent | Website analytics provider; internal marketing team | No | N/A | N/A | Session cookies: browser session; persistent cookies: max 13 months (CNIL/EDPB guidance) | Cookie consent management platform; IP anonymisation; opt-out mechanism; cookie policy | Automatically collected from website visitors | No | No | N/A | 3 April 2023 | 19 May 2023 | EU Marketing
IE-013 | EU Fraud Detection & Security Monitoring | Real-time monitoring and analysis of NorthCloud platform access patterns and user behaviour for fraud detection and security incident response | Northgate Ireland Ltd | Legitimate interest — detection and prevention of fraud, security incidents, and unauthorised access | Enterprise client end users; NTP employees | User IDs, IP addresses, login timestamps, access patterns, anomalous behaviour flags, device fingerprints | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Detection and prevention of fraud, security threats, and unauthorised access to protect both NTP and client data. Proportionate given critical infrastructure context. | Internal security operations centre (Thomas Okoye, CISO); SIEM platform provider | No | N/A | N/A | Security logs: 12 months; incident records: 5 years | SIEM integration; access restricted to security team; encrypted logs; incident response procedures | Automatically collected from NorthCloud platform and network infrastructure | Yes — automated anomaly detection | Yes | DPIA-013 | 3 April 2023 | 19 May 2023 | Information Security (Ireland)
IE-014 | EU Employee Training & Development Records | Processing of employee training records, certifications, and professional development data for compliance and skill development tracking | Northgate Ireland Ltd | Legitimate interest — employee development and regulatory compliance training tracking | Employees of Northgate Ireland Ltd | Name, employee ID, training courses completed, certifications, assessment scores, development plans | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Tracking employee training for compliance requirements and professional development; minimal privacy impact | Internal HR; LMS platform provider; NTP PLC group training team | No | N/A | N/A | Duration of employment + 3 years | LMS access controls; role-based permissions | Directly from employees and LMS platform | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Ireland)
IE-015 | EU Employee Whistleblowing Hotline | Processing of reports and related personal data submitted through the confidential whistleblowing hotline in compliance with the EU Whistleblowing Directive (Directive (EU) 2019/1937) and Irish Protected Disclosures Act 2014 | Northgate Ireland Ltd | Legal obligation — compliance with EU Whistleblowing Directive and Irish Protected Disclosures Act 2014 | Reporting persons (employees, contractors); persons concerned (subjects of reports) | Reporter identity (if disclosed), report content, names of individuals mentioned, investigation notes, outcomes | Yes | Data may include allegations relating to criminal offences (Art. 10 GDPR) | Art. 6(1)(c) — Legal obligation | Art. 10 — Processing relating to criminal convictions and offences (under appropriate safeguards) | N/A | Internal compliance team; external investigation counsel (if escalated); NTP PLC group compliance | No | N/A | N/A | Duration of investigation + 5 years; anonymous reports: 2 years | Confidentiality safeguards; restricted access (compliance team only); encrypted storage; anonymisation where possible | Directly from reporting persons via secure hotline/portal | No | No | N/A | 3 April 2023 | 19 May 2023 | Legal & Compliance (Ireland)
IE-016 | EU Business Continuity & Disaster Recovery Testing | Processing of test data including employee contact details and system recovery data for business continuity and disaster recovery exercises | Northgate Ireland Ltd | Legitimate interest — ensuring business continuity and disaster recovery preparedness | Employees; key stakeholders | Name, phone number, email, emergency contact details, system access credentials (test environment) | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Business continuity planning to maintain critical services; minimal personal data processed | Internal IT; business continuity team; Pinnacle Cloud Services Ltd (DR site) | No | N/A | N/A | DR test records: 3 years; contact lists: updated annually | Test environment segregation; encrypted contact lists; restricted access | Directly from employees and internal systems | No | No | N/A | 3 April 2023 | 19 May 2023 | IT Infrastructure (Ireland)
IE-017 | EU Regulatory & Compliance Reporting | Processing of personal data required for regulatory reporting to ComReg (Commission for Communications Regulation) and other EU telecoms regulators | Northgate Ireland Ltd | Legal obligation — compliance with Irish Communications Regulation Act 2002 and EU Electronic Communications Code | Consumer subscribers; enterprise clients | Aggregated subscriber statistics, complaint records, quality of service metrics, individual complaint details where required | No | N/A | Art. 6(1)(c) — Legal obligation | N/A | N/A | ComReg (statutory); BEREC (aggregated data); NTP PLC group regulatory affairs | No | N/A | N/A | 7 years (regulatory retention requirements) | Aggregation and anonymisation where possible; restricted access; audit trails | Internal systems; subscriber databases; complaint management system | No | No | N/A | 3 April 2023 | 19 May 2023 | Regulatory Affairs (Ireland)
IE-018 | EU Employee Diversity & Inclusion Monitoring | Voluntary collection and processing of employee diversity data for equality monitoring and inclusion programme development | Northgate Ireland Ltd | Consent — voluntary participation in diversity monitoring surveys | Employees of Northgate Ireland Ltd (voluntary respondents) | Anonymised/aggregated data on gender, ethnicity, disability status, age band, sexual orientation (all voluntary and anonymised at collection where possible) | Yes | Racial/ethnic origin, health data (disability), sexual orientation — Article 9 data collected on voluntary, anonymised basis | Art. 6(1)(a) — Consent | Art. 9(2)(a) — Explicit consent | N/A | Internal HR; diversity & inclusion committee; NTP PLC group D&I team | No | N/A | N/A | Aggregated results: indefinite; individual responses: deleted after aggregation (within 30 days) | Anonymisation at point of collection where possible; explicit consent mechanism; aggregated reporting only; no individual-level analysis | Directly from employees via anonymous survey | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Ireland)
[sheet: ROPA — NTP Germany]
Activity ID | Processing Activity Name | Description of Processing | Controller Entity | Purposes of Processing | Categories of Data Subjects | Categories of Personal Data | Special Category Data | Special Category Details | Lawful Basis — Art. 6 | Lawful Basis — Art. 9 (if applicable) | Legitimate Interest Description | Recipients / Categories of Recipients | International Transfers | Transfer Destination Country | Transfer Mechanism | Retention Period | Technical & Organisational Measures | Data Source | Automated Decision-Making / Profiling | DPIA Required | DPIA Reference | Date Added | Last Reviewed | Business Unit Owner
DE-001 | German Enterprise Client CRM & Sales Management | Processing of enterprise client contact data for sales pipeline management, relationship management, and contract administration in the German market | Northgate GmbH | Contract performance — sales and customer relationship management for managed network services and NorthCloud | Enterprise client contacts (decision-makers, technical contacts, procurement contacts) | Name, business email, business phone, job title, company name, meeting notes, proposal history, contract details | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | NTP PLC (group CRM system); Pinnacle Cloud Services Ltd (hosting — Frankfurt data centre) | No | N/A | N/A | Duration of business relationship + 6 years (HGB retention requirements) | CRM access controls; role-based permissions; encrypted database; audit trails | Directly from data subjects during business interactions | No | No | N/A | 3 April 2023 | 19 May 2023 | Sales (Germany)
DE-002 | German Employee Records & Payroll Administration | Processing of employee personal data for employment administration, payroll processing, social security contributions, and compliance with German employment law (185 employees) | Northgate GmbH | Performance of employment contract; compliance with German employment, tax, and social security law (EStG, SGB) | Employees of Northgate GmbH | Name, address, date of birth, Steueridentifikationsnummer, Sozialversicherungsnummer, bank account details, salary, tax class, employment history, performance evaluations, sick leave records | No | N/A | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(c) — Legal obligation | N/A | N/A | Finanzamt (statutory); Krankenkasse (statutory); internal HR (Philippa Crane, NTP PLC); payroll service provider | No | N/A | N/A | Duration of employment + 10 years (AO §147, HGB §257) | HR system access controls; encrypted payroll; separation of HR and operational data; Works Council consultation | Directly from employees | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-003 | Frankfurt Data Centre Physical Access Control | Processing of employee and authorised visitor biometric data (fingerprint) and access badge data for physical security at the Frankfurt data centre | Northgate GmbH | Legitimate interest — physical security of data centre infrastructure; compliance with industry security standards | Employees, contractors, authorised visitors | Name, employee/visitor ID, access badge number, fingerprint template, access timestamps, CCTV footage | Yes | Biometric data for unique identification (fingerprint templates) — Article 9 | Art. 6(1)(f) — Legitimate interests | Art. 9(2)(b) — Employment obligation (Arbeitsschutzgesetz); explicit consent for visitors | Securing critical telecommunications infrastructure housing personal data of millions of subscribers; proportionate to high-security environment of a data centre | Physical security provider; internal IT security team (Thomas Okoye, CISO) | No | N/A | N/A | Access logs: 12 months; CCTV: 30 days; biometric templates: until deregistration + 30 days | Biometric templates stored encrypted on-premises; no cloud storage of biometrics; CCTV with restricted access; DPO oversight | Directly from data subjects at registration | No | Yes | DPIA-005 | 3 April 2023 | 19 May 2023 | Facilities & Security (Germany)
DE-004 | German Subscriber Analytics Data Transfer to Caldwell Analytics (US) | Transfer of pseudonymised German subscriber analytics data to Caldwell Analytics Inc. in the US for network performance analytics and predictive maintenance | Northgate GmbH | Legitimate interest — network performance optimisation and predictive maintenance for German network infrastructure | Consumer subscribers (German NTP customers) | Pseudonymised subscriber IDs, network performance metadata, approximate location (cell sector level), device type identifiers, data throughput metrics | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Network performance monitoring and predictive maintenance to ensure service quality and prevent outages. Pseudonymisation applied; legitimate interest balanced against subscriber expectations. | Caldwell Analytics Inc. (processor — San Jose, CA, USA) | Yes | United States | EU Standard Contractual Clauses (Module 2 — Controller to Processor), executed 17 July 2023; supplementary measures per TIA-005: AES-256 encryption at rest, TLS 1.3 in transit, pseudonymisation, contractual audit rights, data localisation for certain categories | 12 months from collection | AES-256 encryption at rest; TLS 1.3 in transit; pseudonymisation of direct identifiers; TIA-005 completed; contractual audit rights | Automatically collected from NTP German network infrastructure | Yes — profiling for predictive analytics | Yes | DPIA-011 | 3 April 2023 | 19 May 2023 | Network Operations (Germany)
DE-005 | Works Council Consultation Records | Processing of records relating to Works Council (Betriebsrat) consultations, including employee grievances, consultation minutes, and co-determination documentation as required under the Betriebsverfassungsgesetz (BetrVG) | Northgate GmbH | Legal obligation — compliance with German Works Constitution Act (BetrVG); legitimate interest in maintaining good employee relations | Employees involved in grievances or consultations; Works Council members | Name, employee ID, grievance details, consultation minutes, co-determination records | No | N/A | Art. 6(1)(c) — Legal obligation | N/A | N/A | Works Council members; external labour law counsel (if applicable) | No | N/A | N/A | Duration of matter + 5 years | Restricted access to HR and Works Council; physical and digital security controls | Employees, Works Council, management | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-006 | German Recruitment & Applicant Tracking | Processing of job applicant data for recruitment processes in Germany, including compliance with AGG (Allgemeines Gleichbehandlungsgesetz) | Northgate GmbH | Pre-contractual steps at request of data subject; compliance with AGG documentation requirements | Job applicants | Name, email, phone, CV, cover letter, interview notes, assessment results, AGG compliance documentation | No | N/A | Art. 6(1)(b) — Pre-contractual steps | N/A | N/A | Internal HR; hiring managers; recruitment platform provider | No | N/A | N/A | 6 months from end of recruitment process (AGG compliance period) | ATS access controls; encrypted storage; restricted access to hiring panel | Directly from applicants via career portal | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-007 | German Employee Health & Occupational Safety | Processing of employee health data for occupational health assessments and workplace safety compliance under Arbeitsschutzgesetz and ArbMedVV | Northgate GmbH | Legal obligation — compliance with Arbeitsschutzgesetz and Arbeitsstättenverordnung | Employees of Northgate GmbH | Name, employee ID, occupational health assessment results, workplace injury reports, fitness-for-duty certifications | Yes | Health data — Article 9(2)(b) employment and social security obligations | Art. 6(1)(c) — Legal obligation | Art. 9(2)(b) — Employment, social security and social protection law | N/A | Betriebsarzt (company physician); Berufsgenossenschaft (statutory accident insurance); internal HR | No | N/A | N/A | Duration of employment + 10 years (statutory) | Restricted access (occupational health and HR only); encrypted storage; physical file security | Directly from employees; company physician | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-008 | German Managed Network Services Delivery | Processing of client network data for delivery of managed network services to German enterprise clients | Northgate GmbH | Contract performance — delivery of managed network services under service agreements | Enterprise client contacts; enterprise client end users (indirect) | Client contact details, network configuration data, incident tickets, performance metrics, IP addresses, service level data | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | NTP PLC network operations centre; Pinnacle Cloud Services Ltd (hosting — Frankfurt) | No | N/A | N/A | Duration of service contract + 6 years (HGB) | Network monitoring access controls; encrypted incident logs; SLA-driven access restrictions | Enterprise client systems and NTP monitoring infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | Managed Services (Germany)
DE-009 | German Supplier & Procurement Management | Processing of supplier contact and payment data for procurement and vendor management in Germany | Northgate GmbH | Contract performance — supplier contract administration and payment processing | Supplier and vendor contacts | Name, business email, business phone, company, bank details, invoice data, contract details | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | Internal finance; NTP PLC group procurement; banking provider | No | N/A | N/A | Duration of contract + 10 years (HGB §257, AO §147) | Access controls; encrypted payment data; audit logging | Directly from suppliers | No | No | N/A | 3 April 2023 | 19 May 2023 | Finance & Procurement (Germany)
DE-010 | CCTV Surveillance — Berlin Office | Processing of CCTV footage for security monitoring at the Northgate GmbH Berlin office premises | Northgate GmbH | Legitimate interest — security of office premises, employees, and assets | Employees, contractors, visitors | CCTV footage, timestamps, location within premises | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Security of office premises; prevention and detection of crime; proportionate and signposted per BDSG §4 | Internal security team; physical security contractor | No | N/A | N/A | 72 hours (BDSG-compliant); up to 10 days for incident investigation | CCTV signage per BDSG §4; restricted access; encrypted storage; Works Council consulted | Automatically captured by CCTV cameras | No | No | N/A | 3 April 2023 | 19 May 2023 | Facilities & Security (Germany)
DE-011 | German Website & Cookie Analytics | Processing of website visitor data through cookies on northgate.de for analytics and marketing purposes | Northgate GmbH | Consent — TTDSG §25 for non-essential cookies; legitimate interest for strictly necessary cookies | Website visitors | IP address (truncated), browser type, device type, pages visited, session duration, cookie identifiers | No | N/A | Art. 6(1)(a) — Consent (analytics cookies) | N/A | Website performance and security monitoring (strictly necessary only) | Website analytics provider; internal marketing team | No | N/A | N/A | Session cookies: browser session; persistent cookies: max 12 months | Cookie consent management platform (TTDSG-compliant); IP anonymisation; opt-out mechanism | Automatically collected from website visitors | No | No | N/A | 3 April 2023 | 19 May 2023 | Marketing (Germany)
DE-012 | German NorthCloud Infrastructure Operations (Frankfurt) | Processing of technical operational data for NorthCloud platform infrastructure operations at Frankfurt data centre | Northgate GmbH | Legitimate interest — ensuring availability, security, and performance of Frankfurt-hosted NorthCloud infrastructure | Enterprise client end users; NTP employees | IP addresses, system logs, access logs, performance metrics, error logs | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Platform uptime and security monitoring; technical data with minimal privacy impact | Pinnacle Cloud Services Ltd (processor); Pinnacle India Pvt Ltd (sub-processor); Pinnacle APAC Pte Ltd (sub-processor) | Yes | India (Pinnacle India Pvt Ltd); Singapore (Pinnacle APAC Pte Ltd) | EU SCCs Module 3 (Processor to Sub-processor); supplementary measures per TIA-002 and TIA-003 | 90 days rolling for logs; aggregated metrics: 24 months | AES-256 encryption; TLS 1.3; network segmentation; SOC 2 Type II certified (Pinnacle) | Automatically generated by NorthCloud infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | IT Infrastructure (Germany)
DE-013 | German Employee Training & Certification Tracking | Processing of employee training records and professional certifications for compliance and professional development | Northgate GmbH | Legitimate interest — employee development and regulatory compliance training | Employees of Northgate GmbH | Name, employee ID, training courses, certifications, assessment scores, development plans | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Tracking mandatory and voluntary training; minimal privacy impact | Internal HR; LMS platform; NTP PLC group training | No | N/A | N/A | Duration of employment + 3 years | LMS access controls; role-based permissions; Works Council informed | Directly from employees and LMS | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-014 | German Employee Diversity Monitoring | Voluntary collection and processing of employee diversity data for equality monitoring in compliance with AGG | Northgate GmbH | Consent — voluntary participation in anonymised diversity surveys | Employees of Northgate GmbH (voluntary respondents) | Anonymised/aggregated data on gender, ethnicity, disability status, age band | Yes | Racial/ethnic origin, health data (disability) — voluntary, anonymised at collection | Art. 6(1)(a) — Consent | Art. 9(2)(a) — Explicit consent | N/A | Internal HR; D&I committee; NTP PLC group D&I team | No | N/A | N/A | Aggregated results: indefinite; individual responses deleted after aggregation (30 days) | Anonymisation at point of collection; explicit consent; aggregated reporting only | Directly from employees via anonymous survey | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Germany)
DE-015 | German Fraud Detection & Security Monitoring | Monitoring of NorthCloud access patterns and user behaviour for fraud detection and security incident response in Germany | Northgate GmbH | Legitimate interest — detection and prevention of fraud and security incidents | Enterprise client end users; NTP employees | User IDs, IP addresses, login timestamps, access patterns, anomalous behaviour flags, device fingerprints | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Detection and prevention of fraud and security threats; proportionate to critical infrastructure risks | Internal security operations centre (Thomas Okoye, CISO); SIEM platform provider | No | N/A | N/A | Security logs: 12 months; incident records: 5 years | SIEM integration; restricted access to security team; encrypted logs; incident response procedures | Automatically collected from NorthCloud platform | Yes — automated anomaly detection | No | N/A | 3 April 2023 | 19 May 2023 | Information Security (Germany)
DE-016 | German Regulatory Reporting (BNetzA) | Processing of data required for regulatory reporting to Bundesnetzagentur (BNetzA) and compliance with German Telecommunications Act (TKG) | Northgate GmbH | Legal obligation — compliance with TKG and BNetzA reporting requirements | Consumer subscribers; enterprise clients | Aggregated subscriber statistics, quality of service metrics, complaint records | No | N/A | Art. 6(1)(c) — Legal obligation | N/A | N/A | Bundesnetzagentur (statutory); NTP PLC group regulatory affairs | No | N/A | N/A | 10 years (AO §147) | Aggregation and anonymisation where possible; restricted access; audit trails | Internal systems; subscriber databases | No | No | N/A | 3 April 2023 | 19 May 2023 | Regulatory Affairs (Germany)
[sheet: ROPA — NTP Netherlands]
Activity ID | Processing Activity Name | Description of Processing | Controller Entity | Purposes of Processing | Categories of Data Subjects | Categories of Personal Data | Special Category Data | Special Category Details | Lawful Basis — Art. 6 | Lawful Basis — Art. 9 (if applicable) | Legitimate Interest Description | Recipients / Categories of Recipients | International Transfers | Transfer Destination Country | Transfer Mechanism | Retention Period | Technical & Organisational Measures | Data Source | Automated Decision-Making / Profiling | DPIA Required | DPIA Reference | Date Added | Last Reviewed | Business Unit Owner
NL-001 | Amsterdam Data Centre Network Operations | Processing of network performance data, system logs, and access records for the Amsterdam data centre operations supporting NorthCloud and managed network services | Northgate B.V. | Legitimate interest — ensuring security, availability, and performance of data centre infrastructure; contractual obligations to clients | NTP employees and contractors; enterprise client end users (indirect — system logs) | Employee/contractor names, access credentials, system access logs, IP addresses, network performance data, error logs | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Maintaining security and operational integrity of critical network infrastructure. Technical data with minimal impact on data subjects. | Pinnacle Cloud Services Ltd (co-location partner); NTP PLC IT operations; Pinnacle APAC Pte Ltd (sub-processor — network monitoring, Singapore) | Yes | Singapore (Pinnacle APAC Pte Ltd) | EU SCCs Module 3 (Processor to Sub-processor); TIA-003 supplementary measures | System logs: 90 days; aggregated metrics: 24 months | Network segmentation; encrypted logs; access controls; SOC 2 Type II certification (Pinnacle) | Automatically generated by network infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | Data Centre Operations (Netherlands)
NL-002 | Dutch Employee Records & Payroll | Processing of employee data for employment administration, payroll, tax withholding, and pension contributions for Northgate B.V. staff (120 employees) | Northgate B.V. | Performance of employment contract; compliance with Dutch employment and tax law (Wet op de loonbelasting, Burgerlijk Wetboek) | Employees of Northgate B.V. | Name, address, BSN (Burgerservicenummer), date of birth, bank details, salary, tax data, pension details, employment contract details | No | N/A | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(c) — Legal obligation | N/A | N/A | Belastingdienst (Dutch tax authority — statutory); pension fund; internal HR (Philippa Crane, NTP PLC) | No | N/A | N/A | Duration of employment + 7 years (fiscal retention) | HR system access controls; encrypted payroll; audit logging; BSN data encrypted separately | Directly from employees | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Netherlands)
NL-003 | Amsterdam Data Centre Physical Access Control | Processing of access badge data and CCTV footage for physical security of the Amsterdam data centre facility | Northgate B.V. | Legitimate interest — physical security of critical infrastructure | Employees, contractors, authorised visitors | Name, badge ID, access timestamps, CCTV footage | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Securing critical data centre infrastructure; proportionate to risk of unauthorised physical access | Physical security provider; internal security team | No | N/A | N/A | Access logs: 12 months; CCTV: 30 days | Encrypted badge system; CCTV retention limits; restricted access to footage | Directly from data subjects and CCTV system | No | No | N/A | 3 April 2023 | 19 May 2023 | Facilities & Security (Netherlands)
NL-004 | Dutch Enterprise Client CRM & Sales | Processing of enterprise client contact data for sales and relationship management in the Benelux market | Northgate B.V. | Legitimate interest — sales pipeline management and business development in Benelux | Enterprise client contacts (decision-makers, procurement, technical) | Name, business email, business phone, job title, company, meeting notes, proposal history, contract details | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Business development and commercial relationship management; limited personal data in business context | NTP PLC (group CRM); Pinnacle Cloud Services Ltd (hosting) | No | N/A | N/A | Duration of business relationship + 5 years | CRM access controls; role-based permissions; encrypted database | Directly from data subjects during business interactions | No | No | N/A | 3 April 2023 | 19 May 2023 | Sales (Netherlands)
NL-005 | Dutch Managed Network Services Delivery | Processing of client network data for delivery of managed network services to Dutch and Benelux enterprise clients | Northgate B.V. | Contract performance — delivery of managed network services | Enterprise client contacts; enterprise client end users (indirect) | Client contact details, network configuration data, incident tickets, performance metrics, IP addresses | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | NTP PLC network operations centre; Pinnacle Cloud Services Ltd (hosting — Amsterdam) | No | N/A | N/A | Duration of service contract + 5 years | Network monitoring tools with access controls; encrypted incident logs | Enterprise client systems and NTP monitoring infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | Managed Services (Netherlands)
NL-006 | Dutch Recruitment & Candidate Management | Processing of job applicant data for recruitment at Northgate B.V. | Northgate B.V. | Pre-contractual steps at request of data subject; legitimate interest — talent acquisition | Job applicants | Name, email, phone, CV, cover letter, interview notes, assessment results, references | No | N/A | Art. 6(1)(b) — Pre-contractual steps | N/A | N/A | Internal HR; hiring managers; recruitment platform provider | No | N/A | N/A | 4 weeks from end of recruitment process (UAVG guideline); 1 year with consent | ATS access controls; encrypted storage; restricted access | Directly from applicants | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (Netherlands)
NL-007 | Dutch Employee Health & Safety Records | Processing of employee occupational health and safety data for compliance with Arbeidsomstandighedenwet (Arbowet) | Northgate B.V. | Legal obligation — compliance with Arbowet | Employees of Northgate B.V. | Name, employee ID, occupational health assessments, workplace incident reports, risk assessment records | Yes | Health data — Article 9(2)(b) employment obligations under Arbowet | Art. 6(1)(c) — Legal obligation | Art. 9(2)(b) — Employment, social security and social protection law | N/A | Arbodienst (occupational health service); internal HR | No | N/A | N/A | Duration of employment + 10 years (Arbowet) | Restricted access (HR and Arbodienst only); encrypted storage | Directly from employees; Arbodienst | No | Yes | DPIA-014 | 3 April 2023 | 19 May 2023 | People & HR (Netherlands)
NL-008 | Dutch Supplier & Procurement Management | Processing of supplier contact and payment data for procurement and vendor management in the Netherlands | Northgate B.V. | Contract performance — supplier contract administration | Supplier and vendor contacts | Name, business email, business phone, company, bank details (IBAN), invoice data, contract details | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | Internal finance; NTP PLC group procurement; banking provider | No | N/A | N/A | Duration of contract + 7 years (fiscal retention) | Access controls; encrypted payment data; audit logging | Directly from suppliers | No | No | N/A | 3 April 2023 | 19 May 2023 | Finance & Procurement (Netherlands)
NL-009 | Amsterdam NorthCloud Infrastructure Operations | Processing of technical operational data for NorthCloud platform infrastructure at Amsterdam data centre | Northgate B.V. | Legitimate interest — ensuring availability, security, and performance of Amsterdam-hosted NorthCloud infrastructure | Enterprise client end users; NTP employees | IP addresses, system logs, access logs, performance metrics, error logs | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Platform uptime and security; technical data with minimal privacy impact | Pinnacle Cloud Services Ltd (processor); Pinnacle India Pvt Ltd (sub-processor) | Yes | India (Pinnacle India Pvt Ltd) | EU SCCs Module 3 (Processor to Sub-processor); TIA-002 supplementary measures | 90 days rolling for logs; aggregated metrics: 24 months | AES-256 encryption; TLS 1.3; network segmentation; SOC 2 Type II (Pinnacle) | Automatically generated by NorthCloud infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | IT Infrastructure (Netherlands)
NL-010 | Dutch Website & Cookie Analytics | Processing of website visitor data through cookies on northgate.nl for analytics purposes | Northgate B.V. | Consent — Telecommunicatiewet for non-essential cookies | Website visitors | IP address (truncated), browser type, device type, pages visited, session duration, cookie identifiers | No | N/A | Art. 6(1)(a) — Consent | N/A | N/A | Website analytics provider; internal marketing team | No | N/A | N/A | Session cookies: browser session; persistent cookies: max 12 months | Cookie consent management platform; IP anonymisation; opt-out mechanism | Automatically collected from website visitors | No | No | N/A | 3 April 2023 | 19 May 2023 | Marketing (Netherlands)
NL-011 | Dutch Fraud Detection & Network Security Monitoring | Monitoring of network access patterns for fraud detection and security incident response for Amsterdam-based infrastructure | Northgate B.V. | Legitimate interest — detection and prevention of fraud and security incidents | Enterprise client end users; NTP employees | User IDs, IP addresses, login timestamps, access patterns, anomalous behaviour flags | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Detection and prevention of fraud and security threats; proportionate to critical infrastructure context | Internal security operations centre (Thomas Okoye, CISO); SIEM platform provider | No | N/A | N/A | Security logs: 12 months; incident records: 5 years | SIEM integration; restricted access; encrypted logs; incident response procedures | Automatically collected from network infrastructure | Yes — automated anomaly detection | No | N/A | 3 April 2023 | 19 May 2023 | Information Security (Netherlands)
[sheet: ROPA — NTP France]
Activity ID | Processing Activity Name | Description of Processing | Controller Entity | Purposes of Processing | Categories of Data Subjects | Categories of Personal Data | Special Category Data | Special Category Details | Lawful Basis — Art. 6 | Lawful Basis — Art. 9 (if applicable) | Legitimate Interest Description | Recipients / Categories of Recipients | International Transfers | Transfer Destination Country | Transfer Mechanism | Retention Period | Technical & Organisational Measures | Data Source | Automated Decision-Making / Profiling | DPIA Required | DPIA Reference | Date Added | Last Reviewed | Business Unit Owner
FR-001 | French Enterprise Client Sales & CRM | Processing of enterprise client contact data for sales, pre-sales, and relationship management in the French market | Northgate France SAS | Legitimate interest — sales pipeline management and business development | Enterprise client contacts (procurement, IT, management) | Name, business email, business phone, job title, company, meeting notes, proposal details | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Business development and management of commercial relationships; limited personal data; business context reduces privacy impact | NTP PLC (group CRM); Pinnacle Cloud Services Ltd (hosting) | No | N/A | N/A | Duration of business relationship + 3 years (CNIL recommendation for commercial prospecting) | CRM access controls; role-based permissions | Directly from data subjects | No | No | N/A | 3 April 2023 | 19 May 2023 | Sales (France)
FR-002 | French Employee Records & Payroll | Processing of employee data for employment administration, payroll, tax, and social security for Northgate France SAS staff (95 employees) | Northgate France SAS | Performance of employment contract; compliance with French Code du travail, Code général des impôts | Employees of Northgate France SAS | Name, address, numéro de sécurité sociale, date of birth, bank details (RIB), salary, tax data, mutuelle details, employment contract | No | N/A | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(c) — Legal obligation | N/A | N/A | URSSAF (statutory); Direction générale des finances publiques (statutory); mutuelle provider; internal HR (Philippa Crane, NTP PLC) | No | N/A | N/A | Duration of employment + 5 years (Code du travail L.3243-4); payroll records: 5 years | HR system access controls; encrypted payroll; CNIL-compliant retention practices | Directly from employees | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (France)
FR-003 | French Customer Support (Telephone & Email) | Processing of customer service interactions including call recordings and email correspondence for French-speaking enterprise clients | Northgate France SAS | Contract performance — customer support obligations; legitimate interest in service quality monitoring | Enterprise client contacts | Name, email, phone number, support ticket content, call recordings (with consent notification) | No | N/A | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(f) — Legitimate interests (quality monitoring) | N/A | Quality monitoring of support interactions to improve service delivery; call recording preceded by consent notification in compliance with CNIL guidance | Internal support team; NTP PLC group support systems | No | N/A | N/A | Support records: duration of contract + 2 years; call recordings: 6 months | Encrypted call recording storage; access restricted to quality team; consent notifications | Directly from data subjects via support channels | No | No | N/A | 3 April 2023 | 19 May 2023 | Customer Support (France)
FR-004 | French Recruitment & Candidate Management | Processing of job applicant data for recruitment at Northgate France SAS, in compliance with CNIL guidelines on recruitment data processing | Northgate France SAS | Pre-contractual steps at request of data subject; legitimate interest — talent acquisition | Job applicants | Name, email, phone, CV, cover letter, interview notes, assessment results, references | No | N/A | Art. 6(1)(b) — Pre-contractual steps | N/A | N/A | Internal HR; hiring managers; recruitment platform provider | No | N/A | N/A | 2 years from last contact with candidate (CNIL recommendation); or with candidate consent | ATS access controls; encrypted storage; CNIL-compliant data minimisation | Directly from applicants via career portal | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (France)
FR-005 | French Managed Services Delivery | Processing of client network data for delivery of managed network services to French enterprise clients | Northgate France SAS | Contract performance — delivery of managed network services | Enterprise client contacts; enterprise client end users (indirect) | Client contact details, network configuration data, incident tickets, performance metrics, IP addresses | No | N/A | Art. 6(1)(b) — Performance of a contract | N/A | N/A | NTP PLC network operations centre; Pinnacle Cloud Services Ltd (hosting) | No | N/A | N/A | Duration of service contract + 3 years | Network monitoring tools with access controls; encrypted incident logs | Enterprise client systems and NTP monitoring infrastructure | No | No | N/A | 3 April 2023 | 19 May 2023 | Managed Services (France)
FR-006 | French Supplier & Procurement Management | Processing of supplier contact and payment data for procurement and vendor management in France | Northgate France SAS | Contract performance — supplier contract administration | Supplier and vendor contacts | Name, business email, business phone, company, bank details (RIB/IBAN), invoice data, contract details | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | Efficient management of supplier relationships and procurement processes; limited personal data in business context | Internal finance; NTP PLC group procurement; banking provider | No | N/A | N/A | Duration of contract + 10 years (Code de commerce L.123-22) | Access controls; encrypted payment data; audit logging | Directly from suppliers | No | No | N/A | 3 April 2023 | 19 May 2023 | Finance & Procurement (France)
FR-007 | IoT Connected-Vehicle Telemetry (Moritaka Systems Transfer) | Processing and transfer of IoT device telemetry data from connected-vehicle products to Moritaka Systems K.K. in Japan for IoT platform analytics | Northgate France SAS | Legitimate interest — IoT analytics for connected-vehicle telemetry product improvement and service delivery | IoT device endpoints (~12,000 connected vehicles) | IoT device identifiers, vehicle telemetry data, GPS coordinates (pseudonymised), performance metrics, connectivity logs | No | N/A | Art. 6(1)(f) — Legitimate interests | N/A | IoT analytics to improve connected-vehicle product features and service reliability; pseudonymisation of location data; proportionate to business purpose | Moritaka Systems K.K. (processor — 3-14-1 Hamamatsucho, Minato-ku, Tokyo 105-0013, Japan) | Yes | Japan | EU Adequacy Decision (Japan) + supplementary measures per TIA-006 | 18 months from collection | Pseudonymisation of GPS data; encrypted transmission; contractual audit rights; TIA-006 completed | Automatically collected from IoT devices in connected vehicles | No | Yes | DPIA-015 | 3 April 2023 | 19 May 2023 | IoT & Connected Services (France)
FR-008 | French Employee Health & Occupational Safety | Processing of employee health data for occupational health assessments and workplace safety compliance under Code du travail | Northgate France SAS | Legal obligation — compliance with Code du travail regarding occupational health | Employees of Northgate France SAS | Name, employee ID, médecine du travail assessment results, workplace injury reports, fitness-for-duty certifications | Yes | Health data — Article 9(2)(b) employment obligations under Code du travail | Art. 6(1)(c) — Legal obligation | Art. 9(2)(b) — Employment, social security and social protection law | N/A | Médecin du travail (occupational health physician); CPAM (statutory); internal HR | No | N/A | N/A | Duration of employment + 5 years (Code du travail) | Restricted access (HR and médecin du travail only); encrypted storage; physical file security | Directly from employees; médecin du travail | No | No | N/A | 3 April 2023 | 19 May 2023 | People & HR (France)