General Privacy Notice

Full notice

Version 22 August 2026. Written for data subjects and affected persons. It follows EDPB Guidelines on transparency (WP260 rev.01), GDPR Articles 12 to 14, and the matching UK GDPR / DPA 2018 duties.

• Who we are
• What this notice covers
• Purposes and legal bases
• Special category data
• Categories of personal data
• Who we share data with
• International transfers
• How long we keep data
• Where we get data
• Your rights
• Automated decisions and AI
• Children
• Cookies
• How to complain
• Updates to this notice

Who we are

Northbridge Analytics Ltd (demo) operates this Data Protection Officer portal. For personal data processed on this site, we are the controller.

• Controller: Northbridge Analytics Ltd (demo)
• Data Protection Officer: Jordan Hale
• Email: dpo@aidpo.online
• Telephone: +44 20 7946 0123

We do not publish a home address. More contact options are on the Data Protection Officer page.

If you use this portal to reach a customer organisation (your employer, a supplier, or another controller), that organisation’s own notice covers their processing. This page does not replace it.

What this notice covers

It covers personal data we process when you:

• create or use an account on this portal
• submit a data-subject request, complaint, consent withdrawal, breach report, or FOI request
• contact the Data Protection Officer
• use the site (security logs and strictly necessary cookies)
• use public training or course pages (LMS / course registration), if you choose to

It does not cover customer-organisation files they keep outside this portal, or third-party websites we only link to.

Purposes and legal bases

We pair each purpose with a GDPR Article 6 legal basis. Where we rely on legitimate interests, we say what the interest is.

Special category data

We do not ask for special category data (Art. 9) to open a portal account. Please do not send health, biometric, or similar data unless it is needed for your request.

If you include special category data in a request, complaint, or incident report, we process it only to handle that file. The extra condition is usually Art. 9(2)(f) (legal claims) or Art. 9(2)(a) (your explicit consent). Art. 9(2)(c) (vital interests) applies only in a true emergency.

Criminal-offence data (Art. 10) is not a purpose of this portal. If a report must mention it, we keep it to the minimum and restrict access.

Categories of personal data

• Identity and contact: name, email, telephone, account identifier
• Account data: login, email-confirmation status, role
• Request and complaint content: what you tell us, and files you upload
• Consent records: purpose, receipt, withdrawal
• Technical data: IP address, user agent, date and time, security logs
• Cookie choices, if you use the cookie banner

Who we share data with

We share personal data only where needed:

• the Data Protection Officer and authorised portal staff
• processors: Host Africa (website hosting in South Africa), email delivery, and the font files this template loads
• a customer organisation, if your request is about their processing — they are a separate controller
• a supervisory authority, a court, or another body if the law requires it

Processors act on our written instructions. They may not use your data for their own purposes.

International transfers

Some processing happens outside the EEA and the UK. We do not invent extra countries.

• EU → UK The United Kingdom is a third country. Transfers to the UK may rely on the European Commission’s adequacy decision for the UK.
• UK → EU Transfers from the UK to the EU may rely on the UK’s adequacy regulations for the EEA, where they apply.
• This website is hosted by Host Africa in South Africa. South Africa is outside the EU and the UK and has no EU or UK adequacy decision. That is an international transfer. Transfers are subject to appropriate safeguards, such as the European Commission’s standard contractual clauses and a UK International Data Transfer Agreement or UK addendum. The Data Protection Officer can provide a copy of the safeguards in use. We do not publish a signature date here.
• The site template may load the Inter font from Google Fonts (United States). The US is a third country. That transfer uses the EU–US Data Privacy Framework and/or SCCs, as published by Google.

If an Art. 49 (or UK equivalent) exception is the only tool for a rare transfer, we will say so at the time.

How long we keep data

We keep data by purpose, not “as long as we need it” alone.

• Account profile: while the account is open, then up to 12 months after you close it (unless a request or legal hold is still open).
• Data-subject requests and complaints: 3 years after we close the file (accountability and legal claims).
• Consent and withdrawal records: for as long as that processing lasts, then 3 years.
• Security and access logs: 12 months.
• Cookie consent log: 12 months.
• FOI files (UK only): 3 years after we close the file.
• Backups: a short backup cycle on top of the limits above, then they expire.

Where we get data

Most data comes from you (Art. 13).

If we did not get it from you (Art. 14), the source is usually:

• your device (security and technical logs)
• a person or organisation who names you in a request, complaint, or breach report
• a customer organisation that invites you to use this portal

The categories, purposes, rights, and retention on this page still apply. We tell you when we can, unless the law says we must not (for example a confidential investigation).

Your rights

You have these GDPR rights. You do not have to name an article. The first copy of your data is free and is usually sent electronically.

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Portability (Art. 20)
• Objection, including to legitimate interests and to direct marketing (Art. 21)
• Withdraw consent, where we rely on consent (Art. 7(3)). Withdrawal does not undo processing that was lawful before you withdrew.
• Human review of a solely automated decision that has legal or similarly significant effects (Art. 22)

Use the Data Subject Request form for access, correction, erasure, restriction, portability, objection, or automated-decision review.

To stop a consent-based purpose (for example marketing or a named AI system), use Withdraw consent.

You can also email the Data Protection Officer at dpo@aidpo.online.

We usually reply within one month after we can verify who you are.

Automated decisions, profiling, and AI

We do not make solely automated decisions that produce legal or similarly significant effects about you on this site. Data-subject requests, complaints, and consent withdrawals are handled with human review.

This portal can record AI systems, take complaints about them, and record consent for a named AI system. Those tools do not, by themselves, decide your legal rights. If a customer organisation uses AI about you, read their notice.

If a solely automated decision with legal or similarly significant effects ever applied, Art. 22 (and the UK equivalent) would apply. You could ask for meaningful information about the logic and for a human review.

EU only Art. 86 (public access to official documents versus data protection) is an EU rule. It is not UK GDPR.

UK The UK uses Art. 22. The ICO’s explaining-AI guidance may also apply. That is UK guidance. We do not treat it as EU Art. 86.

EU extra The EU AI Act (Regulation 2024/1689) can add transparency duties for some AI systems. Those duties are extra and EU-only. The United Kingdom is not bound by the AI Act.

If a customer organisation uses AI about you, read their notice. This page covers the portal operator.

Children

This portal is for adults — data subjects, staff, and DPO users. We do not knowingly offer information-society services to children.

EU Art. 8: where an information-society service is offered directly to a child and the basis is consent, the child must be at least the age set by the Member State (between 13 and 16). Below that age, a holder of parental responsibility must consent.

UK For information-society services, the UK treats under 13 as a child for this consent rule. That UK line is separate from EU Art. 8.

Cookies

Cookies on this site are covered by the ePrivacy Directive (EU) and PECR (UK), and by GDPR / UK GDPR where a cookie processes personal data.

We use strictly necessary cookies to run the session, keep the site secure, and remember your cookie choice. Those do not need consent. Optional preference cookies are used only if you consent in the Privacy Manager banner (Necessary / Preferences). Analytics and marketing categories are off on this site.

You can accept, reject, or change Preferences in the banner. Withdrawal is as easy as giving consent: open the banner again and save a new choice. Continuing to browse is not treated as consent.

The named cookies, duration, and parties are in the Cookie Notice.

How to complain

Please contact the Data Protection Officer first if you can. You can always complain to a supervisory authority as well.

EU Complain to the competent supervisory authority in your Member State, or to the lead authority if one-stop-shop applies. One-stop-shop and lead-authority rules are EU-only. Find your authority via the EDPB members list.

UK If UK GDPR applies, you can complain to the Information Commissioner’s Office. Use the ICO’s make a complaint page. The ICO is not the EU supervisory authority and is not a substitute for the EDPB list.

Updates to this notice

We update this page when our processing or the law changes. Each version has a date. This version is 22 August 2026.

The new text replaces the old text on this URL. If a change is material, we note it on the portal home page and, where we have your email for an account, we may also email you.