Data Processing Agreement

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person as defined in GDPR Article 4(1).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Subject" means the individual to whom Personal Data relates.
• "Supervisory Authority" means an independent public authority responsible for monitoring GDPR application.

2. Roles and responsibilities

Controller: You (the customer) are the Controller of the Personal Data processed through PortalPilot. You determine the purposes and means of processing your HubSpot portal data.

Processor: NordScope acts as a Processor on your behalf, processing your data only according to your instructions and this DPA.

3. Scope of processing

3.1 Data categories

• Account information: Email addresses, names, authentication data
• HubSpot portal metadata: Property names, types, descriptions, usage statistics
• Record sample data: During analysis, we transiently process a sample of property values (up to 1,000 records per object type — contacts, companies, deals, tickets) to compute fill rates, value distributions, and data quality scores. This data is processed in memory and not stored beyond the analysis session. Only aggregate statistics are retained.
• Analysis data: Health scores, recommendations, action history (aggregate only)

3.2 Processing purposes

• Provide the PortalPilot analysis service
• Generate property health reports and data quality scores
• Enable property creation, update, and deletion operations
• Generate AI-powered property suggestions and descriptions
• Maintain audit trails of write operations
• Send service-related communications

3.3 Data minimization

• Record samples are processed transiently in memory and discarded after analysis
• Only aggregate statistics (fill rates, distributions, scores) are stored
• AI processing sends only property metadata (names, descriptions, types), not individual record values
• OAuth scopes are limited to the minimum necessary for service functionality

3.4 Records of processing

NordScope maintains records of processing activities carried out on behalf of the Controller in accordance with GDPR Article 30(2). These records are available to the Controller and supervisory authorities upon request.

4. Sub-processors

4.1 Authorised sub-processors

4.2 Sub-processor changes

We will notify you of any intended changes to sub-processors at least 30 days in advance. You may object in writing within 14 days. If we cannot accommodate your objection, you may terminate the service.

4.3 Third-party platforms accessed on your behalf

PortalPilot connects to your HubSpot portal via OAuth 2.0 as your authorised integration. HubSpot is your own platform — not a sub-processor engaged by NordScope. We access it solely on your instruction to provide the analysis service.

• Data flows: PortalPilot reads property metadata and record samples from your portal for analysis, and writes property changes back to your portal on your instruction.
• Data residency: Where HubSpot processes API requests depends on your portal's data residency setting. If your portal uses HubSpot's EU data hosting (Frankfurt), API traffic may remain within the EEA. If your portal is hosted in the US, see Section 10 (International transfers).
• Your responsibility: You are responsible for ensuring your use of HubSpot complies with your own data protection obligations. PortalPilot accesses only the data you authorise through the OAuth consent flow.

4.4 Sub-processor agreements

All sub-processors are bound by data processing agreements that provide protection at least equivalent to this DPA.

5. Security measures

5.1 Technical measures

• Encryption in transit: All data transmitted via TLS 1.2+
• Encryption at rest: Database encryption using AES-256
• Access control: Role-based access, principle of least privilege
• Authentication: Multi-factor authentication for admin access
• API security: OAuth 2.0, token encryption, secure storage
• Network security: Firewall protection, DDoS mitigation
• Audit logging: Comprehensive logs of all write operations

5.2 Organizational measures

• Regular security training for personnel
• Access limited to authorized personnel only
• Confidentiality agreements with all staff
• Regular security assessments and penetration testing
• Incident response procedures documented and tested

5.3 Data center security

Our primary infrastructure is hosted in EU data centers (Hetzner, Finland) with ISO 27001 certification, physical access controls, and 24/7 monitoring. AI processing is handled by Mistral AI (Paris, France) — no data leaves the EU for AI processing.

6. Data subject rights

We will assist you in responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection. We will respond to your assistance requests within 5 business days.

If a Data Subject contacts us directly, we will promptly redirect them to you unless legally required to respond directly.

7. Data breach notification

In the event of a Personal Data breach, we will notify you without undue delay and in any case within 72 hours of becoming aware. Our notification will include the nature of the breach, affected data categories, likely consequences, and remedial measures.

We will cooperate with you and any Supervisory Authority in investigating and remediating the breach. We maintain records of all breaches, including facts, effects, and remedial actions taken.

8. Audit rights

Upon reasonable request, we will provide information necessary to demonstrate compliance. You may conduct audits with 30 days' notice, during business hours, maximum once per 12-month period (unless a breach has occurred). Our infrastructure providers maintain ISO 27001 certification.

9. Data retention and deletion

Upon termination, we delete all Personal Data within 30 days. Backup copies within 90 days. You can request a certificate of deletion. Self-service deletion is available via dashboard, portal disconnection, or email to privacy@portalpilot.io.

10. International transfers

10.1 EU-based infrastructure

All core infrastructure and processing occurs within the EEA:

• Application and database: Hetzner, Finland (EU)
• AI processing: Mistral AI, Paris, France (EU)
• Payments: Mollie B.V., Netherlands (EU)

10.2 HubSpot API access

PortalPilot accesses your HubSpot portal via API on your instruction (see Section 4.3). Whether this constitutes an international transfer depends on your portal's data residency:

• EU-hosted portals: If your HubSpot portal uses EU data residency (Frankfurt), API traffic may remain within the EEA. No international transfer occurs in this case.
• US-hosted portals: If your portal is hosted in the US, API requests constitute a transfer to HubSpot, Inc. (US). This transfer is covered by the EU-US Data Privacy Framework, under which HubSpot is certified.

We conduct Transfer Impact Assessments for transfers outside the EEA and implement supplementary measures where necessary. NordScope is prepared to execute Standard Contractual Clauses (EU Commission Implementing Decision 2021/914) as a supplementary transfer mechanism should the DPF adequacy decision be invalidated or suspended.

11. Confidentiality

All personnel with access to Personal Data are bound by confidentiality obligations. We will not disclose Personal Data except as instructed by you, to authorized sub-processors, or as required by law (with advance notice where permitted).

12. Termination

Upon termination of this DPA or the underlying service agreement, we will cease all processing and delete data per Section 9. Upon request within 30 days of termination, we will provide a copy of your data in JSON format.

13. Liability

Each party shall indemnify the other for damages arising from breach of this DPA, GDPR, or applicable data protection laws. Our total liability shall not exceed the amounts paid by you for the service in the 12 months preceding the claim.

14. Amendments

We may update this DPA to reflect changes in law or our practices. Material changes will be notified 30 days in advance. Continued use of the service after the effective date constitutes acceptance.

15. Governing law

This DPA is governed by the laws of Finland. Disputes shall be resolved in Finnish courts, without prejudice to Data Subject rights to bring claims in their jurisdiction of residence.

16. Contact

For questions about this DPA or data protection matters:
NordScope Data Protection
Email: privacy@portalpilot.io
Address: Finland