Data processing addendum

Last updated 27 September 2026. Applies to northwebservices.com and the client area.

Roles

For personal data contained in content you host (websites, mailboxes, databases), you are the controller and Elarion Global Group LLC is your processor under UK GDPR Art 28 / EU GDPR Art 28. For account and billing data we are an independent controller (see the privacy notice).

Processing instructions

We process hosted personal data only on your documented instructions: storing, serving, backing up, restoring, migrating and securing it, plus steps required by law. This addendum is your standing instruction.

What we do

• Confidentiality: staff bound by confidentiality; access on need-to-know for support or security.
• Security: TLS in transit, encrypted backups off-site, patching, rate-limited and monitored access, incident response.
• Sub-processors: data-centre and network providers in the region you select (UK, EU or US); backup storage in-region with an optional second encrypted copy in the EU; transactional email delivery; payment processing via SpicePay. Current list available on request; 30 days' notice of new sub-processors with a right to object and terminate.
• Assistance: we help you answer data-subject requests affecting hosted content, and with breach notification, DPIAs and security obligations.
• Deletion: on termination we delete hosted personal data within 30 days unless law requires retention.
• Audits: on reasonable notice you may audit our compliance or accept our current third-party certifications.

Transfers

Regions: UK, Germany, Netherlands, United States. Transfers outside the UK/EEA rely on adequacy or the UK IDTA / EU SCCs.

Breach notification

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting hosted content, with the information you need for your own notification duties.