Customer Data Processing

Nordstack Limited, CRO 824512, may process personal data while delivering process analysis, workflow design, automation, integration and related services.

For website enquiries and our own business administration, we normally act as controller, as explained in the Privacy Notice. For customer datasets handled solely on documented instructions, we normally act as processor.

If our customer is itself a processor, we may act as its subprocessor, subject to the required authorisation chain. The actual activity determines the role; a label alone does not.

Before processing that requires an Article 28 GDPR agreement, the parties must agree a binding contract covering:

• The subject matter, duration, nature and purposes of processing.
• Personal-data categories and the types of individuals concerned.
• The customer's rights and obligations and documented instructions, including transfer instructions.
• Confidentiality and technical and organisational measures appropriate to the risks.
• Subprocessor authorisation, equivalent flow-down duties and change notifications.
• Assistance with individuals' rights, security, breach handling, impact assessments and prior regulatory consultation where applicable.
• Information and audit arrangements, and notification of instructions that infringe applicable data-protection law.
• Return or deletion at the customer's choice on exit, including backups and legally required retention.
• International transfers and applicable safeguards.

A public privacy notice, website visit or enquiry is not a substitute for that agreement or its customer-specific acceptance.

We use Celonis and monday.com in delivering our services. For each engagement, their role depends on who contracts with them, who controls the tenant, which datasets they receive and whose instructions govern processing.

Where Nordstack appoints a provider to process customer data on its behalf, the required customer authorisation and appropriate written obligations must be in place. Where the customer contracts with a provider directly, that provider agreement and Nordstack's authorised access must be documented separately.

The engagement documents must identify the applicable provider arrangements, purposes, data categories, authorised access, processing locations where relevant and safeguards. A brand name or an “EU region” label alone is not a complete transfer assessment. We have data-protection agreements and overseas-transfer safeguards in place with relevant providers; customer-specific authorisations and instructions still need to be agreed.

Make forwards website contact submissions. Whether it or another provider also processes customer engagement data must be recorded for that engagement. Website enquiries must not be presumed to flow into Celonis and monday.com merely because we use those platforms in service delivery.

Engagement documentation must cover hosting, communications and other providers receiving the relevant customer data. It must not silently add AI tools or other recipients outside agreed instructions and authorisations.

The parties should identify the minimum information needed and use anonymised or appropriately pseudonymised data where suitable. Special-category data, criminal-offence data, children's data and consequential automated decisions must not be introduced without a specific assessment and agreement.

Authorisation to use Celonis or monday.com is not permission to use unrestricted datasets, enable every AI feature or train models on customer information.

The agreed processing agreement and security particulars must describe applicable protections and responsibilities. If Nordstack becomes aware of a personal-data breach involving data it processes for a customer, it must notify the relevant controller without undue delay and provide the information and assistance required by law and the agreement.

The controller's possible 72-hour deadline for notifying a supervisory authority is not a standard waiting period for a processor to notify its customer.

Return, deletion and restricted retention must follow the agreement and documented instructions. Immediate deletion from every provider or backup must not be promised unless supported in practice.

One available starting standard is the unmodified Bonterms Data Protection Addendum, Version 1.0 (opens in a new tab), with its required setup information and schedules. Its authorship and CC BY 4.0 licence (opens in a new tab) notice must be preserved; it applies only when expressly adopted by the parties.

A customer-specific package must identify the services agreement, parties, effective date, roles and authorised contacts; processing particulars and instructions; approved subprocessors and change procedures; appropriate security measures; rights and audit assistance; breach communications; exit; and applicable transfer safeguards.

Where Standard Contractual Clauses are required, the correct modules, parties and annexes must be completed and any required assessments performed. A generic DPA is not automatically a complete transfer mechanism. Mandatory SCC text must not be silently modified.

Customer-specific processing particulars, security, suppliers, transfer arrangements and exit instructions must be completed before the relevant processing starts. This public page does not execute or replace those terms.

• Celonis legal and data-protection documents (opens in a new tab).
• monday.com customer Data Processing Addendum (opens in a new tab).
• Make legal and data-protection documents (opens in a new tab).
• Replit Data Processing Addendum (opens in a new tab).

These links are informational and do not themselves incorporate provider terms into a customer engagement. Nordstack has relevant supplier data-protection agreements and overseas-transfer safeguards in place; engagement-specific documents must still describe the applicable processing and authorisations.

Contact contact@nordstack.ltd to request a relevant DPA, processing particulars or supplier information. Our Business Services Terms explain the services-contract framework.