Privacy and Data Processing Notice
Version 1.0 · Last updated [date] · Controller: Northbound Legal Ltd, company number 17402564, registered office Unit 82a James Carter Road, Bury St. Edmunds, England, IP28 7DE · hello@northboundlegal.co.uk
This notice explains how we handle personal data in two distinct capacities: as a controller of data about our website visitors, prospective clients and business contacts, and as a processor of personal data contained in client firm matters. It is written to answer the questions a law firm's COLP or data protection lead will ask before instructing us.
Part A: Data we control
A1. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, firm, role, email, phone, correspondence when you contact us or book a call | Responding to enquiries, providing services, account administration | Legitimate interests; performance of a contract |
| Payment confirmation data for pilot fees (processed by Stripe; we do not receive card numbers) | Taking payment, accounting, fraud prevention | Performance of a contract; legal obligation |
| Business contact details of prospective client firms compiled from public sources (firm websites, professional directories, published registers) | Business-to-business outreach relevant to the recipient's role | Legitimate interests; you may object at any time and we will stop |
| Basic technical logs (IP address, pages requested) generated by our hosting provider | Security and service operation | Legitimate interests |
This website does not use advertising or analytics cookies. Payment pages operated by Stripe set cookies necessary for payment processing and fraud prevention; Stripe's own privacy notice applies to those pages.
A2. Retention
Enquiry and correspondence records are kept for [24] months after last contact, contractual and accounting records for [6] years plus the current year as required by law, and outreach records until you object or [12] months after last engagement, whichever is sooner.
A3. Your rights
You have the rights under UK GDPR to access, rectify and erase your personal data, to restrict or object to processing (including an absolute right to object to direct marketing), and to data portability. Contact hello@northboundlegal.co.uk. You may complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern first.
Part B: Data we process for client firms
B1. Our role
When delivering paralegal and legal support services, we act as a processor on the documented instructions of the client firm, which remains the controller (or a processor for its own clients). We process only the matter data the firm assigns, only for the purpose of delivering the contracted services, and only through personnel assigned to that firm.
B2. The Data Processing Agreement
Every engagement is governed by our written Data Processing Agreement, which includes: subject matter, duration, nature and purpose of processing; obligations of confidentiality on all personnel; assistance with data subject rights and security incidents; breach notification without undue delay and in any event within [48] hours of becoming aware; audit and information rights; and return or deletion of data at the end of the engagement, at the firm's election. A copy is available on request before instruction.
B3. International transfers
Delivery is performed by our team in Pretoria, South Africa. South Africa is not covered by UK adequacy regulations, so restricted transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment available to client firms on request. Our delivery operations additionally comply with South Africa's Protection of Personal Information Act 2013 (POPIA). Where a firm prefers, work can be performed entirely within the firm's own systems under scoped access, so that matter data is not transferred to our systems at all.
B4. Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| [BridgePoint Legal (Pty) Ltd] | Delivery team engagement and supervision | South Africa |
| Railway Corp. | Website and application hosting | [EU West region] |
| Resend (Plus Five Five, Inc.) | Transactional email for enquiry and payment confirmations | [EU region] |
| Stripe Payments Europe Ltd | Payment processing (pilot fees) | EU/UK |
| [Google Workspace / Microsoft 365] | Email and document collaboration | [EU/UK region] |
We will give client firms at least [30] days' notice of any intended change to sub-processors, with the right to object on reasonable grounds.
The sub-processors above support our website, enquiry handling and pilot payments. They do not receive client matter data, which is handled as described in Part B and, where a firm prefers, never leaves the firm's own systems.
B5. Security measures
- Access to matter data restricted to the individuals assigned to the relevant firm, on a need-to-know basis, revoked on reassignment.
- Encryption in transit (TLS) and at rest for data held on our systems; client-system-only working available on request.
- Written confidentiality undertakings from every team member, with firm-specific undertakings available.
- Multi-factor authentication on all accounts with access to matter data; centrally managed devices with disk encryption and screen locking.
- No use of matter data for training, marketing, benchmarking or any purpose other than the contracted services. Use of AI tools on matter data only where and as the client firm instructs in writing.
- Incident response procedure with notification to the client firm without undue delay.
B6. Questions
Data protection enquiries, DPA requests, transfer risk assessments and audit requests: hello@northboundlegal.co.uk, marked "Data protection". We respond within [5] business days.