Data Processing Agreement

If you process personal data of EU / EEA residents through your GTM container, and you use GTM Composer to compose or deploy that container, you are the data controller and we are a data processor. A signed DPA documents that relationship and our security commitments.

For NND consulting clients the DPA is bundled with the master services agreement. For all other users we sign a standalone DPA on request — no charge.

• Subject matter + duration — the compose + deploy service for as long as your account is active.
• Nature + purpose of processing — encrypting credentials at rest, calling the GTM API with your OAuth grant, writing non-live workspaces, persisting compose + deploy history.
• Categories of data subjects — your employees who sign in to the tool, plus your end-users whose tracking the composed container will collect once you publish.
• Sub-processors — Vercel (hosting), Neon (Postgres), Google (Tag Manager API + OAuth). Listed in detail on the privacy notice.
• Technical + organisational measures — AES-256-GCM at rest, TLS in transit, OAuth-scoped access, HMAC-signed session cookies, principle-of-least-privilege admin access.
• Sub-processor notification— 30 days' notice before adding or replacing a sub-processor.
• International transfers — Standard Contractual Clauses (SCCs) plus the EU-US Data Privacy Framework where applicable.
• Audit + cooperation rights — annual audit on reasonable notice, plus cooperation with your data-subject requests within the timelines GDPR sets.
• Incident notification — written notice within 72 hours of becoming aware of a personal-data breach affecting your data.
• Return + deletion — your data is exportable via GET /api/account/export and erased within 14 days of an /api/account/delete call or an email deletion request.

Email hello@newnorth.nl with the subject line “DPA request — GTM Composer” and include your legal entity name + signing party. We'll send a countersigned PDF within five business days.

New North Digital, the Netherlands. hello@newnorth.nl.