Data Processing Agreement

Subject, duration and instructions

NorthDNS processes personal data transmitted through authoritative DNS, reverse proxy, tunnel and related support services only to provide, secure and diagnose the service, for the duration of the customer relationship and according to the customer’s documented configuration and instructions.

Nature, purpose and data categories

Processing consists of receiving, routing, caching, storing hosted email when enabled, recording limited technical events, aggregating service metrics and deleting data. Data may include source IP addresses in transient processing, truncated one-way IP hashes, hostnames, paths without query strings, methods, response codes, latency, DNS query type and result, technical headers, customer configurations, mailbox addresses, messages and attachments, delivery metadata and identifiers contained in requests.

Data subjects are visitors and users of the customer’s domains. Customers must not deliberately route special-category or criminal-conviction data unless it is strictly necessary, lawful and agreed in advance.

Security and confidentiality

• Access controls, least-privilege roles and confidentiality obligations for authorised personnel.
• Encryption in transit, encrypted backups and per-account keys for protected account identifiers.
• Monitoring, audit trails, retention limits and incident-response procedures proportionate to risk.
• Assistance with data-subject requests, security incidents and impact assessments, taking into account the nature of processing.

Retention, return and deletion

Detailed retention periods are published in the Privacy Policy. On termination or a valid deletion request, active account data is deleted and the account encryption key is destroyed. Encrypted backups are retained for no more than 30 days. A signed, minimised erasure record is retained for up to 400 days and replayed after a restore so that deleted accounts are removed again before normal operation resumes.

Subprocessors, transfers and audits

Current providers and their functions are listed on the subprocessors page. NorthDNS imposes consistent data-protection obligations and uses GDPR-recognised transfer safeguards where required. Customers may request information reasonably necessary to demonstrate compliance, subject to confidentiality and security restrictions.

Execution

This page is an informational framework and is not a signed DPA. To execute an agreement containing the parties’ full details, roles, safeguards and technical schedules, contact [email protected].