NorthstarLegal and regulatory
Data Processing Agreement
Standard processing terms between Northstar and its business customers.
1. Roles and scope
The customer is the controller or organization responsible for processing instructions; Northstar is the processor or service provider for applicant verification, deposit operations, support, security, and reporting. The order form defines duration and data categories.
2. Customer instructions
Northstar processes personal data only on documented lawful instructions, unless law requires otherwise. The customer must have a valid basis, give required notices, and avoid submitting unnecessary sensitive information.
3. Confidentiality and security
Authorized personnel are bound by confidentiality. Measures include encryption, access controls, MFA, environment separation, secrets management, backups, audit logging, monitoring, and incident response appropriate to risk.
4. Sub-processors
Current categories include Supabase (database and authentication), Vercel (hosting), Plaid (authorized bank connection), Resend or the configured email provider, and payment-network participants. Locations and residency impact are shown in Security settings. We will provide notice of material sub-processor changes as agreed.
5. Incidents and requests
Northstar will notify the customer without undue delay after confirming a personal-data breach and aims to provide an initial notice within 72 hours where feasible. We will reasonably assist with access, correction, deletion, objection, and regulator requests, subject to law.
6. Return, deletion, and audits
At termination, Northstar will return or delete customer data on request, except required retained copies, which remain protected and isolated. We will provide relevant independent assurance materials and reasonable audit cooperation under confidentiality and scope controls.
7. Liability and law
Liability follows the governing service agreement. Ontario law governs unless the applicable order form states otherwise. This template requires review and countersignature by authorized representatives before it becomes an executed DPA.