Privacy Policy

The controller responsible for personal data processed through the North Motion website and our own business operations is:

• North Motion, Matej Radovan s.p.
• Podbreznik 15, 8000 Novo mesto, Slovenia
• Email: [privacy@north-motion.com]
• Website: [north-motion.com]

Where North Motion processes personal data on behalf of a business customer through an AI agent or other service, the customer may act as the data controller and North Motion may act as the data processor.

Those relationships may additionally be governed by a Data Processing Agreement.

Depending on how you interact with us, we may process the following categories of personal data.

Contact information

This may include:

• name
• surname
• email address
• phone number
• company name
• job title

Information submitted through forms

When you request a consultation, agent deployment, demo, or other service, we may collect information such as:

• company information
• communication tools used
• software and platforms used
• intended agent use case
• project requirements
• workflow information
• information included in free-text fields

Communication data

If you communicate with North Motion through email, Slack, Microsoft Teams, Discord, Telegram, meetings, or other channels, we may process:

• your contact details
• message contents
• files you provide
• meeting information
• communication history

Website and technical data

When you use our website, certain technical information may be collected automatically, such as:

• IP address
• browser type
• device information
• operating system
• pages visited
• referral source
• timestamps
• interaction and analytics data

The exact information collected depends on the analytics and cookie preferences enabled on the website.

AI agents deployed for customers may process information from systems connected by the customer.

This may include:

• business documents
• emails
• advertising information
• analytics data
• CRM records
• customer support information
• source code
• project information
• internal communications
• files and media
• operational data
• personal data contained within connected systems

The specific data processed depends on the customer's configuration and the permissions granted to the agent.

Where we process this information solely according to a customer's instructions, North Motion generally acts as a processor rather than determining the purpose of processing itself.

We may process personal data for the following purposes:

• responding to enquiries
• providing consultations
• onboarding customers
• providing and operating our services
• deploying and maintaining AI agents
• communicating with customers
• providing customer support
• managing contracts and billing
• maintaining service security
• detecting abuse or security incidents
• troubleshooting technical issues
• improving our website and services
• measuring website usage
• complying with legal obligations
• establishing, exercising, or defending legal claims

We do not process personal data for unrelated purposes without an appropriate legal basis.

Depending on the situation, we process personal data under one or more of the following legal bases.

Contract

Processing may be necessary to enter into or perform a contract with you.

For example:

• onboarding
• service delivery
• billing
• customer support

Legitimate interests

We may process information where necessary for legitimate business interests, provided those interests do not override your rights and freedoms.

Examples may include:

• securing our infrastructure
• improving services
• responding to business enquiries
• preventing fraud or abuse
• maintaining business records

Consent

Where required, we may rely on your consent.

This may apply to:

• certain analytics
• marketing cookies
• some direct marketing activities

You may withdraw consent at any time.

Legal obligation

We may process information where required to comply with applicable laws, tax obligations, accounting requirements, regulatory obligations, or lawful requests.

North Motion provides services involving artificial intelligence and automated agents.

AI systems may be used to:

• analyse information
• prepare content
• summarise documents
• execute workflows
• operate connected tools
• classify or organise information
• support business processes
• assist users with decisions

AI-generated outputs may contain errors and should not automatically be treated as factually correct.

Where processing could materially affect individuals, appropriate human oversight and safeguards should be used.

We do not intend to use website visitor data for solely automated decisions producing significant legal or similarly significant effects unless this is explicitly disclosed.

Our services may use third-party AI model providers.

Depending on the deployment, these may include providers such as:

• OpenAI
• Anthropic
• Google
• other customer-approved AI providers

Information sent to an AI provider is limited where reasonably possible to what is necessary to complete the relevant task.

Different providers may have different:

• retention policies
• processing locations
• contractual arrangements
• model training policies
• security controls

For customer deployments, the specific provider may be selected according to the customer's requirements.

North Motion does not use customer confidential data to train a North Motion general-purpose AI model unless explicitly agreed otherwise.

Whether information submitted to an external AI provider may be retained or used by that provider depends on:

• the provider
• product used
• API or subscription type
• contractual agreement
• account configuration

For sensitive deployments, we aim to use provider configurations and commercial arrangements appropriate for business data.

We may use trusted third-party providers to operate our business and deliver our services.

These may include providers for:

• cloud hosting
• databases
• AI models
• email
• analytics
• monitoring
• automation
• authentication
• storage
• communication
• payment processing

Such providers may process personal data only where necessary for the services they provide.

A separate Subprocessor List may be maintained for services involving customer data.

Some providers used by North Motion may process information outside Slovenia or the European Economic Area.

Where personal data is transferred outside the EEA, appropriate safeguards should be used where required.

These may include:

• an adequacy decision
• Standard Contractual Clauses
• other transfer mechanisms recognised under applicable data-protection law

The European Commission specifically provides Standard Contractual Clauses as one mechanism for protecting transfers of personal data outside the EEA.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.

Retention may depend on:

• the type of information
• contractual requirements
• legal obligations
• security requirements
• the customer's instructions

For example:

Contact enquiries

May be retained while the enquiry remains relevant and for a reasonable period afterwards.

Customer and contractual information

May be retained for the duration of the customer relationship and afterwards where required for legal, accounting, tax, or contractual purposes.

Technical and security logs

May be retained for a limited period necessary for security, diagnostics, and monitoring.

Agent data

Retention depends on the customer's deployment and agreed configuration.

Backups may retain deleted information for a limited additional period until the relevant backup cycle expires.

We apply reasonable technical and organisational measures designed to protect personal information.

Depending on the deployment, measures may include:

• isolated customer environments
• access controls
• least-privilege permissions
• encryption in transit
• protected credential storage
• logging
• monitoring
• scoped API credentials
• authentication controls
• restricted administrative access
• human approval for sensitive actions

Further information is available in our Security, Data & AI Usage Statement

Our website may use cookies or similar technologies.

Some may be necessary for the website to operate.

Others may be used for:

• analytics
• performance measurement
• advertising attribution
• marketing

Where consent is legally required, non-essential tracking should not be activated until consent has been provided.

You can change or withdraw your cookie preferences through the website's cookie controls.

Further information will be provided in our Cookie Policy once published.

We may send business or marketing communications where permitted by applicable law.

Where consent is required, we will request it before sending such communications.

You can unsubscribe from marketing communications at any time.

Service-related messages necessary for an active customer relationship may still be sent.

Depending on applicable law and the circumstances, you may have the right to:

• access your personal data
• correct inaccurate personal data
• request deletion
• restrict processing
• object to certain processing
• receive certain information in a portable format
• withdraw consent
• lodge a complaint with a supervisory authority

These rights are subject to conditions and exceptions under applicable law.

To exercise a privacy right, contact: [privacy@north-motion.com]

We may need to verify your identity before processing certain requests.

If your personal data is processed by an AI agent operated by North Motion for one of our customers, the customer may be the controller responsible for that processing.

For example, this may occur when an agent processes:

• a customer's CRM records
• customer support requests
• employee information
• advertising leads
• emails
• internal company records

In these situations, privacy requests should generally be directed to the organisation that controls the relevant data.

North Motion will assist its customers with relevant data-protection requests where required by our contractual or legal obligations.

Our services are designed primarily for businesses and professional users.

We do not intentionally collect personal data from children through our business services unless this is specifically required for an authorised customer use case and appropriate legal safeguards are in place.

If we become aware of a personal-data breach affecting information for which we are responsible, we will investigate and take appropriate measures.

Where required by applicable law, affected customers, individuals, or supervisory authorities will be notified.

Our website and services may contain links or integrations with third-party platforms.

North Motion is not responsible for the independent privacy practices of third parties acting as separate controllers.

We recommend reviewing the privacy policies of services you use.

We may update this Privacy Policy when:

• our services change
• providers change
• processing activities change
• legal requirements change
• security practices evolve

The latest version will be published on this page together with the date of the most recent update.

Material changes may be communicated separately where appropriate.

Questions about privacy or personal-data processing can be sent to:

• North Motion, Matej Radovan s.p.
• Podbreznik 15, 8000 Novo mesto, Slovenia
• Email: [privacy@north-motion.com]
• Website: [north-motion.com]

For complaints regarding data protection, individuals may also contact the competent supervisory authority.