Privacy Policy

1. Who we are

Northdev ("we", "us", "our") operates this website and related services. We are the data controller for the personal data we collect through our website and services. If you have questions about this policy, contact us at the details in Section 13.

2. Data we collect

We may collect:

• Information you give us: Name, email address, phone number, and any message or CV you submit via our contact or careers forms.
• Sign-in and profile data (OAuth): If you sign in with a third-party provider (e.g. Google, Meta/Facebook), we may receive your name, email address, profile picture, and other profile information that the provider shares with us according to your permissions. We use this to create or link your account and to provide our services.
• Technical and usage data: IP address, browser type, device information, and how you use our website (e.g. pages visited). We may use cookies and similar technologies as described in Section 9.

3. How we use your data

We use your data to:

• Respond to enquiries and process job applications.
• Provide, secure, and improve our website and services.
• Authenticate you and manage your account when you use sign-in with Google, Meta, or other OAuth providers.
• Send you service-related or marketing communications where you have agreed or where we have a legitimate interest, and where required by law.
• Comply with legal obligations and protect our rights.

We do not use any personal data obtained through Google Workspace APIs or any other third-party APIs to develop, improve, or train generalised artificial intelligence or machine learning models. Data received from these APIs is used solely to provide and improve the specific services you have requested from us.

4. Legal basis

We process your data on the basis of: (a) your consent, (b) performance of a contract with you, (c) our legitimate interests (e.g. improving our services, security), or (d) compliance with legal obligations. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

5. Data sharing

We may share your data with: (a) OAuth providers (e.g. Google, Meta) to enable sign-in and as governed by their policies; (b) service providers who process data on our behalf (e.g. hosting, email, analytics), under strict confidentiality; (c) authorities when required by law. We do not sell your personal data. We do not transfer or disclose data obtained from Google Workspace APIs to third parties except as necessary to provide the services you requested, comply with applicable law, or as part of a merger, acquisition, or asset sale with prior notice to you.

6. Data security and protection

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Sensitive personal data stored in our systems is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. We use role-based access controls and multi-factor authentication to secure internal systems.
• Secure infrastructure: Our services are hosted on reputable cloud infrastructure providers that maintain rigorous physical and network security certifications (e.g. SOC 2, ISO 27001).
• OAuth token handling: Authentication tokens received from third-party sign-in providers (e.g. Google, Meta) are stored securely and are never exposed to other users or third parties. We request only the minimum scopes necessary to provide our services.
• Regular reviews: We periodically review our security practices and update them as needed to address new threats and vulnerabilities.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals as required by applicable law.

7. Retention

We keep your data only as long as needed for the purposes above (e.g. responding to enquiries, managing accounts, legal obligations). When we no longer need it, we delete or anonymise it.

8. Your rights

Depending on where you live, you may have the right to: access your data, correct it, delete it, restrict or object to processing, data portability, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us using the details in Section 13.

9. Cookies and similar technologies

We use cookies and similar technologies to run our website, remember preferences, and analyse usage. You can control cookies through your browser settings. Some features may not work fully if you disable cookies.

10. International transfers

Your data may be processed in countries outside your residence. We ensure appropriate safeguards (e.g. standard contractual clauses or adequacy decisions) where required by law.

11. Children

Our services are not directed at children. We do not knowingly collect personal data from children under the age required by applicable law (e.g. 13 or 16). If you believe we have collected such data, please contact us so we can delete it.

12. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and indicate the last updated date. Continued use of our services after changes constitutes acceptance of the updated policy where permitted by law.

13. Contact

For privacy-related requests or questions, contact us via the Contact Us form on our website or at the contact details provided there.