1. Who we are
This Privacy Policy describes how Envoy Services Ltd, trading as Northpeak ("we", "us", "our"), collects and processes personal data. We are a company registered in England and Wales (Company No. 08629734) with registered office at Ground Floor, Kings House, 101-135 Kings Road, Brentwood, Essex, United Kingdom, CM14 4DR.
For the purposes of the UK GDPR and EU GDPR, we are the data controller of the personal data we collect about you. If you have any questions about this policy or our use of your personal data, contact us at hello@northpeak.com.
2. What data we collect
We collect the following categories of personal data:
- Identity and contact data: name, email address, business name, phone number, country.
- Account and billing data: subscription tier, billing address and VAT number where applicable. Payment card details are collected and processed directly by our payment processor; we do not see or store full card numbers.
- Onboarding and service data: website URL, target markets, CMS, goals and any other information you submit through our onboarding form or in correspondence with us.
- Technical access data: read-access credentials or tokens you grant us to your analytics, Search Console or SEO tools.
- Usage data: information about how you interact with our website, including IP address, browser type, device type, pages visited and referrer. This is collected via cookies and analytics tools.
- Communications: records of emails, calls and messages exchanged with us.
3. How we use your data and our lawful bases
We process your personal data on the following lawful bases under UK GDPR / EU GDPR Article 6:
- Performance of a contract — to provide the Services you have subscribed to, manage your account, take payment, deliver work, and provide support.
- Legitimate interests — to operate and improve our business, secure our website, prevent fraud, send service updates, and (for existing partners only) communicate occasional offers related to services you have already purchased. You may object to processing on this basis at any time.
- Consent — for marketing emails to prospective partners, non-essential cookies, and any other processing requiring explicit opt-in. You may withdraw consent at any time.
- Legal obligation — to comply with UK tax, accounting and other applicable laws.
4. Who we share your data with
We share personal data only with the following categories of recipients, and only as necessary for the purposes set out above:
- Stripe — our payment processor, for handling subscription payments. Stripe's privacy policy is available at stripe.com/privacy.
- Cloud and software providers — including hosting, email, customer relationship management, project management, analytics and SEO tooling vendors, all engaged under appropriate data processing agreements.
- Professional advisers — including lawyers, accountants and auditors, where required.
- Authorities — where required by law or to protect our legal rights.
We do not sell your personal data to third parties under any circumstances.
5. International transfers
Some of our service providers are located outside the UK and EEA. Where we transfer personal data internationally, we ensure an adequate level of protection through approved mechanisms such as UK adequacy regulations, the EU–US Data Privacy Framework, or Standard Contractual Clauses.
6. How long we keep your data
We retain personal data only for as long as necessary for the purposes for which it was collected. In particular:
- Active partner data: for the duration of your subscription and up to twenty-four (24) months after cancellation, to handle any post-engagement questions.
- Billing and tax records: for at least six (6) years following the end of the relevant accounting period, as required by UK tax law.
- Prospect and enquiry data: up to twenty-four (24) months from last interaction, unless you ask us to delete it sooner.
7. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request erasure of your data ("right to be forgotten");
- Restrict or object to certain processing;
- Request portability of data you provided to us;
- Withdraw consent at any time where processing is based on consent;
- Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, contact us at hello@northpeak.com. We will respond within one month.
8. Cookies
We use a small number of cookies on this website. Strictly necessary cookies are used to keep the site functioning. With your consent, we also use analytics cookies to understand how visitors use the site, so we can improve it. You can change your cookie preferences at any time by clearing your browser's storage for this domain.
9. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. Access to partner data is restricted to authorised personnel, all production systems require strong authentication, and sensitive data is encrypted in transit and at rest. No method of transmission over the internet is fully secure, but we work to industry-recognised standards.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be available on this page with its last-updated date. If we make a material change, we will notify you by email or a prominent notice on the website.
11. Contact
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at hello@northpeak.com.