Privacy Policy

The controller of personal data is:

• North Motion, Matej Radovan s.p.
• Podbreznik 15, 8000 Novo mesto, Slovenia
• Registration number: 7595085000 (Slovenian Business Register, AJPES)
• Tax number: 95236732 (not registered for VAT)
• Email: tim@north-motion.com

We have not appointed a data protection officer because, given the nature and scale of our processing, one is not required under Article 37 GDPR and Article 45 ZVOP-2. For any data protection question, email tim@north-motion.com.

We only process the data we need for the purposes below.

2.1 Visiting the website

• Data: IP address, browser and operating system, pages visited, referring page and time of the request.
• Purpose: serving the website, keeping it secure and preventing abuse.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Retention: the hosting provider keeps log records for no longer than 30 days.

2.2 Website analytics (only with your consent)

• Data: pages visited, referring page, approximate location (country and city), device, browser and operating system, interactions on the website, and pseudonymous identifiers stored in Google Analytics cookies. Google Analytics 4 does not store IP addresses.
• Purpose: understanding how the website is used so we can improve it.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 225 of the Slovenian Electronic Communications Act, ZEKom-2). You can withdraw it at any time under “Cookie settings” in the footer.
• Retention: no longer than 14 months.

2.3 “Build your agent” form

• Data: name, work email, company, communication channel, intended use cases, tools you use and first priority.
• Purpose: preparing for the call and replying to your enquiry.
• Legal basis: legitimate interest in replying to a business enquiry (Article 6(1)(f) GDPR); if you enquire as a sole trader, also steps taken at your request before entering into a contract (Article 6(1)(b)).
• Retention: no longer than 12 months after our last communication if no contract is concluded.

2.4 Contact form and booking a call

• Data: name, email, company, the workflow description you enter, the selected time slot and anything else you enter in the booking form. The contact and “Build your agent” forms pass your details to the booking calendar so you don’t have to type them again.
• Purpose: organising and holding the call, and sending confirmations and reminders.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR); for sole traders also pre-contractual steps (Article 6(1)(b)).
• Retention: no longer than 12 months after our last communication if no contract is concluded.

2.5 Communication

• Data: contact details, message contents, files and meeting information exchanged by email, Slack, Microsoft Teams, Discord, Telegram, video calls or other channels.
• Purpose: answering questions and conducting business communication.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR); for communication about a contract, performance of the contract (Article 6(1)(b)).
• Retention: as long as needed for the purpose, as a rule no longer than 12 months after the communication ends. Correspondence that forms part of business records is kept as long as the law requires.

When you use third-party channels such as Slack or Microsoft Teams, their providers also process your data as independent controllers under their own privacy policies.

2.6 Customers and contracts

• Data: names, job titles and work contact details of customer contact persons, and invoicing details.
• Purpose: concluding and performing contracts, onboarding, support and invoicing.
• Legal basis: performance of a contract and legitimate interest (Article 6(1)(b) and (f) GDPR), and legal obligations such as keeping accounting records (Article 6(1)(c)).
• Retention: for the duration of the relationship and afterwards as long as the law requires (accounting records generally 10 years).

2.7 Display preferences

If you switch between light and dark mode, your choice is stored in your browser. See our Cookie Policy

Where processing is based on legitimate interest, these interests are: keeping the website secure and reliable, replying to business enquiries, organising calls, conducting business communication and managing customer relationships. You provide the data in a business context and can reasonably expect us to use it this way.

Providing data is not a statutory or contractual requirement. Without a name, email and company, however, we cannot handle your enquiry, and without the booking details we cannot confirm a call.

We do not make decisions about website visitors or enquirers based solely on automated processing, and we do not carry out profiling (Article 22 GDPR).

Our services use artificial intelligence. AI-generated outputs can contain errors, so actions that matter are subject to human oversight and approval.

We do not sell personal data or pass it to third parties for their marketing. Access is limited to providers who perform services for us under a data processing agreement (Article 28 GDPR):

• Vercel Inc. (USA): website hosting.
• Google Ireland Limited and Google LLC (USA): Google Analytics, only with your consent.
• Plus Five Five, Inc. (Resend) (USA): sending notifications about form submissions.
• Cal.com, Inc. (USA): booking calendar.
• The email hosting provider of our mailboxes.

For customer projects we also use cloud and AI model providers, which are listed in the data processing agreement with each customer (see section 9). We may disclose data to public authorities where the law requires it.

Some providers are based in the USA, so data may be transferred there. Transfers rely on:

• the European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), for providers certified under it (Vercel, Google, Resend, Cal.com), and
• the European Commission Standard Contractual Clauses (Article 46(2)(c) GDPR) in the data processing agreements, as an additional safeguard and for providers that are not certified.

You can request a copy of the relevant safeguards at tim@north-motion.com

Retention periods are listed for each purpose in section 2. When a period ends, we delete or anonymise the data. Backups may keep deleted data for a short additional period until the backup cycle ends. We review retention periods regularly.

When we deploy and operate AI agents for a business customer, the agents may process data from systems the customer connects, such as emails, documents, CRM records, support requests, advertising and analytics data or source code. The exact data depends on the customer’s configuration and the permissions granted to the agent.

For this data, the customer is the controller and North Motion acts as a processor: we process it only on the customer’s instructions and under a data processing agreement (Article 28 GDPR), which lists the sub-processors used, including the AI model providers (for example OpenAI, Anthropic or Google) chosen with the customer.

We do not use customers’ confidential data to train our own general-purpose AI models unless agreed otherwise. Whether an external AI provider may retain inputs depends on its terms and account configuration; for business data we aim to use configurations intended for business use.

If an agent processes your data on behalf of a company, please direct privacy requests to that company. If you send the request to us, we will forward it and help the customer respond.

Regarding your personal data, you have the right to:

• access (Article 15 GDPR),
• rectification of inaccurate data (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability (Article 20),
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).

Right to object

Where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). We will stop unless we demonstrate compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons.

Send requests to tim@north-motion.com

We reply without undue delay and within one month at the latest; for complex requests this may be extended by up to two further months, and we will tell you if so. Exercising your rights is free of charge. To protect your data, we may ask you to confirm your identity.

You may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, +386 1 230 97 30, www.ip-rs.si, or with the supervisory authority of the EU country where you live or work.

We use appropriate technical and organisational measures, including encryption in transit, access controls, least-privilege permissions and human approval for sensitive actions. More in our Security, Data & AI Usage Statement

Cookies and similar technologies are described in our Cookie Policy

We only send marketing communications where the law allows it and, where required, with your consent. You can unsubscribe at any time. Service messages for an active customer relationship may still be sent.

The website and our services are intended for businesses and are not directed at children under 15. We do not knowingly collect their data.

If a breach affects personal data we are responsible for, we notify the Information Commissioner within 72 hours where required (Article 33 GDPR), and affected individuals where the breach is likely to result in a high risk (Article 34 GDPR). If customer data is affected, we notify the customer without undue delay.

The website links to and embeds services of other providers. Where they act as independent controllers, their own privacy policies apply.

We may update this policy when our services, providers or the law change. The current version, with its last-updated date, is always published on this page. If we wanted to use data for a new purpose, we would inform you beforehand (Article 13(3) GDPR).