Privacy notice

1. Controller

Northline Technologies Ltd, Company No. 17065515, 128 City Road, London EC1V 2NX, United Kingdom.

Address in Mexico for notices: Av. Homero 229, Int. 501, Polanco V Sección, Mexico City, Mexico.

Contact the Northline Technologies Data Protection Office at privacy@northlinetech.uk.

2. Personal data we process

On every platform: identity and contact data (first name, surnames, email, mobile number and username) and access and security data (password stored as an irreversible hash, access logs, IP address and device).

Depending on the platform:

• Crop monitoring (Agronix): growers, agronomists and operators; location of farms, fields and greenhouse bays; device readings and reported field work.
• Microcredit: official ID (front and back), address and proof of address, a photo of the outside of the home, socio-economic profile, two personal references and a bank account for disbursements.
• Factoring: sellers, debtors and investors and their representatives, and the details of their operations.
• Health platforms (Medix): patients, health professionals and staff, including health data.

If you give us data about other people, you confirm you are authorised to share it.

3. Special category, financial and asset data

Health data is special category data.

Microcredit financial and asset data (socio-economic profile and bank account) is given enhanced protection.

We ask for your explicit consent when you set up your access and record which version of this notice you accepted and when.

4. Purposes and lawful bases

• Creating and managing your identity and access, verifying your email and sending invitations and codes — performance of a contract.
• Providing the platform you use (crop monitoring, credit, factoring or health services) — performance of a contract; explicit consent for health and Microcredit financial data.
• Microcredit: assessing, granting, managing and collecting loans — performance of a contract and legal obligations.
• Account security, fraud prevention and audit logs — our legitimate interest in keeping the platforms secure.
• Meeting legal obligations and requests from authorities — legal obligation.

We do not use your data for marketing, advertising or profiling. If that ever changes we will update this notice and ask for your consent first.

5. Consent and withdrawal

You can withdraw your consent at any time by writing to privacy@northlinetech.uk or using the form on this page. Withdrawal does not affect processing carried out before it; where the data is needed for the service, we may no longer be able to provide it.

6. Recipients and international transfers

We use providers of cloud infrastructure, email delivery and artificial-intelligence analysis (agronomic recommendations). They act as processors, only on our instructions and under confidentiality obligations.

We share data with companies in our group that operate the platforms under these same policies (Northline Business Group S.A.P.I. de C.V., Northline Capital and Appmedik). We do not share it with other third parties without your consent, unless the law allows it or a competent authority requires it.

Your data may be processed in the United Kingdom, in Mexico and on our providers’ servers in other countries. Where data leaves the UK we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw consent. Under Mexican law these include the ARCO rights and the right to limit use or disclosure.

Send your request through the form on this page or to privacy@northlinetech.uk. You will receive a reference number; we may ask you to verify your identity and will reply within one month (UK GDPR) or within the terms set by Mexican law.

You can complain to the UK Information Commissioner’s Office (ico.org.uk) or, in Mexico, to the Secretaría Anticorrupción y Buen Gobierno.

8. Security

We apply administrative, technical and physical measures: encrypted connections, irreversibly hashed passwords, AES-256-GCM encryption of bank accounts, role permissions enforced on the server and audit logs. We follow OWASP security practices.

9. Cookies

We only use strictly necessary cookies: those for your session and security, and one that remembers your language. We use no advertising or tracking cookies. To improve the platform we record the screens you visit and the buttons you tap (never what you type), linked to your account when you sign in; they are kept for up to 12 months and are not shared with third parties.

10. Retention

We keep your data while you have access to or a relationship with the platform and afterwards for the periods required by applicable law. We then delete or anonymise it.

11. Changes to this notice

We will publish any change on this page with its version and date. If the purposes that need your consent change, we will ask you again.