Privacy policy
How North52 handles personal data collected through www.north52.com and support.north52.com.
Effective date: 13 October 2026
1. Who we are
North52 Software Applications Limited ("North52", "we", "us") is the controller of the personal data collected through our website, www.north52.com, and our support portal, support.north52.com. We are a company registered in Ireland under company number 515532, with our registered office at Barryscourt, Carrigtwohill, Co. Cork, Ireland.
We process personal data in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011), which govern cookies and electronic marketing.
For any question about this policy or your personal data, contact us at:
- Email: support@north52.com
- Post: Data Protection, North52 Software Applications Limited, Barryscourt, Carrigtwohill, Co. Cork, Ireland
We are not required to appoint a Data Protection Officer, and have not done so. Requests sent to the address above are handled by a named member of our management team.
2. What this policy covers
This policy covers personal data collected through both of our websites:
- www.north52.com, our marketing website, including its contact form;
- support.north52.com, our support portal, including portal accounts, help desk requests, software downloads, licence key requests, training courses and the ideas forum.
The same policy is published on both sites.
It does not cover:
- Data our customers process using North52 software. Our rules engine runs inside each customer's own Microsoft Dataverse environment, so that data stays in their tenant and is governed by their own policies.
- Third-party websites we link to. Their own privacy policies apply.
3. What personal data we collect
We collect what you give us through our forms and your portal account, plus limited technical data that any website receives.
| Category | What it includes | Source |
|---|---|---|
| Contact details | Name, company, job title, business email address | You, via our forms or your portal account |
| Your enquiry | The message you write on the contact form | You |
| Portal account | Your name, email address, and an identifier from the account you sign in with (Microsoft, Google or a North52 portal account). We never receive your password | You and your sign-in provider |
| Support requests | Case descriptions, attachments, trace logs and other technical detail you send, and our replies | You |
| Download and licence key requests | Company or end-customer name, Dataverse organisation ID, number of active users (as a band), online or on-premises deployment, environment purpose, and your acceptance of our licence terms | You |
| Training records | Courses started and completed, and badges earned | Your use of the portal |
| Ideas forum | Ideas, comments and votes you post | You |
| Source attribution | The page you submitted from, the page or site that referred you, and campaign tags in the link you followed (for example utm_source) | Your browser, when you submit a form |
| Technical and security data | IP address, browser type, date and time of requests, recorded in server and security logs | Your browser, on every request |
| Analytics data | Pages viewed, time on page, approximate location (country or city), device type | Analytics cookies, only if you accept them |
| Marketing preferences | Whether you have asked to receive product news, and any unsubscribe | You |
Please do not include sensitive personal data, such as health information, in a form or support request. Trace logs and attachments can contain personal data from your own systems, so please remove or mask it before sending. Where it cannot be removed, we use it only to resolve your request and handle it under our agreement with your organisation.
Our websites are aimed at businesses and are not directed at children under 16. We do not knowingly collect their personal data.
4. How we use it and our lawful basis
GDPR requires a lawful basis for each use of personal data. Ours are set out below.
| Purpose | Data used | Lawful basis (GDPR Article 6(1)) |
|---|---|---|
| Reply to your enquiry and, where you ask, arrange a demo, quote or trial | Contact details, enquiry | Steps you have asked us to take before entering a contract (6(1)(b)); otherwise our legitimate interest in answering business enquiries (6(1)(f)) |
| Create and run your portal account, and give you access to the knowledge base, training and ideas forum | Portal account, training records, ideas forum | Performance of the portal terms of use you accept (6(1)(b)) |
| Resolve support requests | Contact details, portal account, support requests | Performance of our contract with you or your organisation (6(1)(b)); otherwise our legitimate interest in supporting people who use our software (6(1)(f)) |
| Send download links, issue licence keys, and check that licences are used within their terms | Contact details, download and licence key requests | Performance of the licence agreement you accept (6(1)(b)); legitimate interest in protecting our software (6(1)(f)) |
| Record enquiries and requests in our sales system and follow up on them | Contact details, enquiry, download and licence key requests, source attribution | Legitimate interest in managing our sales pipeline (6(1)(f)) |
| Understand which pages and campaigns bring enquiries | Source attribution | Legitimate interest in measuring our marketing (6(1)(f)) |
| Send product news and event invitations by email | Contact details, marketing preferences | Your consent (6(1)(a)), or, for existing customers, our legitimate interest in telling them about similar products, as S.I. No. 336 of 2011 permits (6(1)(f)) |
| Measure and improve our websites | Analytics data | Your consent to analytics cookies (6(1)(a)) |
| Keep our websites and forms secure and block spam and abuse | Technical and security data | Legitimate interest in protecting our systems (6(1)(f)) |
| Comply with the law, respond to lawful requests, and establish or defend legal claims | Any of the above, as needed | Legal obligation (6(1)(c)); legitimate interest in defending our rights (6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 11).
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that happened before it.
We do not sell personal data. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
5. What happens when you use our forms and portal
Contact form on www.north52.com
Your enquiry goes straight into our own customer relationship management system. It is not passed to a marketing platform or a third-party form service.
- You enter your name, company, email address and message. An optional, unticked box lets you ask for product news by email.
- The form includes a hidden field that people do not see but automated scripts tend to fill in. Submissions that fill it in are discarded. This check uses no third-party service and sets no cookie.
- Your browser sends the form, with the source attribution described in section 3, over an encrypted (HTTPS) connection to a small server-side function we run on Microsoft Azure.
- That function creates a Lead record in our Microsoft Dataverse environment, hosted by Microsoft in its West Europe region (the Netherlands). The function does not keep a copy of your message after the Lead is created.
- A member of our team reviews the Lead and replies, usually by email.
- If you become a customer, the Lead is converted into an account and contact record and is then kept under our customer terms. If not, it is kept for the period set out in section 9.
Only North52 staff who handle sales and support can see Leads in Dataverse.
Support portal at support.north52.com
The portal is built on Microsoft Power Pages and stores everything you submit in our Dataverse environment, in Microsoft's West Europe region (the Netherlands), the same environment that receives the contact form.
- You sign in with a Microsoft account, a Google account or a North52 portal account. Your sign-in provider confirms who you are and passes us your name and email address. We never see your password.
- When you open a help desk request, request a download or ask for a licence key, the form writes directly into Dataverse as a record linked to your contact details. If you are signed in, you do not need to retype them.
- Download links and licence keys are sent only to business email addresses. Requests from free email providers are not approved.
- Portal forms are protected by a hidden field that automated scripts tend to fill in, and by an image check that runs on the portal itself. Neither uses a third-party service.
- Ideas, comments and votes you post in the ideas forum can be seen by other portal users, together with your name.
6. Cookies and analytics
We use only the cookies needed to run our sites unless you choose to accept analytics cookies. Non-essential cookies are not set until you agree in the cookie banner.
| Type | Purpose | Needs your consent? |
|---|---|---|
| Strictly necessary | Remember your cookie choice. On the portal, Microsoft Power Pages also sets cookies that keep you signed in, protect forms against cross-site attacks, route requests to the right server and remember your language, plus one (Dynamics365PortalAnalytics) that Microsoft uses to tell visitors apart for service reliability without storing personal data | No |
| Analytics | Google Analytics measures visits and page use so we can improve the site and see which content brings enquiries. It sets the _ga and _ga_<ID> cookies, which last up to 2 years | Yes |
You can change your choice at any time using the "Cookie settings" link in the footer of every page. You can also block or delete cookies in your browser settings; the site will still work.
We do not use advertising or cross-site tracking cookies. Our analytics also measures visits that continue onto support.north52.com, so we can see which pages lead to downloads and trials. This happens only if you have accepted analytics cookies.
7. Who we share it with
We share personal data only with service providers that process it on our instructions, and with others where the law requires. Each service provider acts as our processor under a written contract that meets GDPR Article 28.
| Recipient | Role | What they receive |
|---|---|---|
| Microsoft (Microsoft Ireland Operations Limited) | Hosts both websites, the form function, the portal and our Dataverse system; provides our email | All the personal data described in section 3 except analytics data |
| Google Analytics (Google Ireland Limited) | Website analytics, only with your consent | Analytics data |
If you sign in to the portal with a Microsoft or Google account, that provider acts as a separate controller for the sign-in itself, under its own privacy policy. It shares only your name, email address and an account identifier with us.
We may also disclose personal data:
- to our professional advisers, such as lawyers and accountants, who are bound by confidentiality;
- to courts, regulators, the Gardaí or other authorities where the law requires it, or to establish, exercise or defend legal claims;
- to a buyer or successor if all or part of our business is sold, merged or restructured. The recipient must use your data only for the purposes described in this policy, and we will tell you before your data becomes subject to a different policy.
We do not sell, rent or trade personal data, and we do not share it with other companies for their own marketing.
8. International transfers
We store the personal data you give us in the European Economic Area (EEA). Our websites, portal and Dataverse environment are hosted by Microsoft in its West Europe region (the Netherlands), and Microsoft processes this data under its EU Data Boundary commitments.
Some of our providers, or their support staff, are located outside the EEA, including in the United States. Where personal data is transferred outside the EEA, we rely on one of the following safeguards:
- an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or
- the European Commission's Standard Contractual Clauses, with supplementary measures where needed.
You can ask us for a copy of the relevant safeguards using the contact details in section 1.
9. How long we keep it
We keep personal data only as long as we need it for the purposes in section 4, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a sale | 24 months after our last contact with you |
| Enquiries that become customer records | The life of the customer relationship plus 6 years, the limitation period for contract claims under the Statute of Limitations 1957 |
| Support requests, download and licence key records | For customers, the life of the customer relationship plus 6 years; otherwise 24 months after your last request |
| Portal accounts | Until you ask us to close your account |
| Training records | While your portal account exists |
| Ideas forum posts | While the idea remains published; your name is removed when your account is closed |
| Marketing preferences and unsubscribe requests | Until you change them; an unsubscribe is kept so we do not email you again |
| Server, security and form function logs | 90 days |
| Analytics data | 14 months after your last visit to our websites |
We may keep data longer where the law requires it or where it is needed for a legal claim.
10. Security
We protect personal data with technical and organisational measures suited to the risk. They include:
- encryption in transit (HTTPS) for every page and form submission, and encryption at rest in Microsoft Azure and Dataverse;
- a marketing website with no database or server-side content system, so there is no store of personal data on the web server itself;
- credentials for our sales system held only in one server-side function, never in the website code;
- role-based access to Dataverse, limited to staff who need it, with multi-factor authentication;
- spam and abuse protection on every form, and portal sign-in through Microsoft, Google or our Microsoft-hosted sign-in directory, so we never handle your password.
No transmission over the internet is completely secure. If a personal data breach is likely to result in a risk to you, we will notify the Data Protection Commission within 72 hours, and tell you without undue delay where the risk is high.
11. Your rights
You have the following rights over your personal data. Exercising them is free of charge.
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted where we no longer need it or have no lawful basis to keep it.
- Restriction: ask us to limit how we use your data while a concern is resolved.
- Portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we process it by consent or contract.
- Objection: object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
- Withdraw consent: withdraw consent to marketing emails or analytics cookies at any time, using the unsubscribe link in any email or the "Cookie settings" link on the site.
To make a request, email support@north52.com or write to the address in section 1. We may ask for information to confirm your identity before acting.
We will respond within one month of receiving your request. If a request is complex, or we receive several from you, we may extend this by up to two further months and will tell you why within the first month.
We do not charge a fee. Only where a request is manifestly unfounded or excessive, in particular because it is repetitive, may we charge a reasonable fee based on our administrative costs or refuse to act, as GDPR Article 12(5) allows. We will explain our reasons if we do.
12. Complaints
If you are unhappy with how we handle your personal data, please contact us first so we can try to put it right.
You also have the right to complain to a supervisory authority. Our lead authority is the Data Protection Commission in Ireland:
- Web: www.dataprotection.ie, using the online form at forms.dataprotection.ie/contact
- Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
- Phone: +353 1 765 0100 or 1800 437 737
If you live or work in another EU or EEA country, you can also complain to the authority there. UK residents can contact the Information Commissioner's Office.
13. Changes to this policy
We will update this policy when the way we handle personal data changes, for example when we add a new feature to our websites. The effective date at the top shows when it last changed.
If we make a significant change, such as using your data for a new purpose, we will highlight it on our websites and, where we hold your email address and the change affects you, tell you by email before it takes effect.