Last updated August 2026. This is a working draft prepared for launch and has not yet had a final legal review — it should be reviewed by qualified legal counsel before the site's forms go live at scale, and translated into Portuguese and Spanish for those versions of the site. It is written to be read alongside our Code of Conduct & Terms of Reference.
TrueNorth Quality Partners is the trading name under which PIE — Pizarro Integrity & Excellence ("we", "us") provides GxP auditing, AI governance, data protection, and regulatory consulting and training services. We operate as an individual professional practice, so — unlike a registered company — there is a single data controller: the practice principal.
We try to keep this summary short and specific. We keep to a minimum the information we hold about you; we use it to deliver our services, respond to enquiries, manage our relationship with you, meet our legal obligations, and improve this website; we delete it when it is no longer needed; we generally do not share it with third parties; and you have rights over it, set out below.
As a client, we may hold: your name, job title, business address, email and phone number; your service and modality preferences; correspondence and documents relating to an engagement; and billing and payment information.
To enter into and deliver the contracted engagement as set out in the Terms of Reference agreed with you, and to bill and track payment for that work. The legal basis is that this is necessary to perform a contract with you (GDPR Art. 6(1)(b)).
For the duration of our relationship, plus any period required by Portuguese tax and accounting obligations, after which we review and delete data we no longer have a contractual or legal reason to hold.
When you use the Contact form or the Training waitlist, or email us directly, we hold what you choose to provide: name, company, job title, email, phone number, and the content of your enquiry.
To respond to your enquiry and, where relevant, to prepare a proposal or Terms of Reference. Where you have ticked the consent box, we may also follow up about relevant services. The legal basis is your consent (Art. 6(1)(a)) and, where you are enquiring about a specific engagement, taking steps prior to a contract (Art. 6(1)(b)).
We review enquiry data periodically and keep it only as long as we have a legitimate interest in following up or a contractual reason to retain it.
This site uses one strictly necessary storage item (a browser localStorage entry remembering your cookie-banner choice and light/dark theme preference) that does not require consent. It does not currently load any analytics or advertising cookies. If privacy-friendly analytics are added in future, they will only load after you accept them in the cookie banner — see our Cookie Policy for details.
The site is hosted by Netlify, Inc., which processes standard server logs (e.g. IP address, browser type, pages requested) as part of providing hosting and security. We use this, where we look at it at all, to keep the site secure and understand which pages are useful — under our legitimate interest in running a secure, functioning website.
If you are a supplier or an associate consultant we work with on client engagements, we may hold your name, contact details, and information relating to invoices and the work carried out. We use this to manage the relationship and to pay you or be paid, under our contractual and legitimate-interest basis. Where an associate is involved in client work, we ensure they are bound by the same confidentiality standards set out in our Code of Conduct.
Where we need to transfer personal data to organisations outside the European Economic Area (EEA) — for example, our hosting or email providers — we only do so where the recipient is covered by an EU adequacy decision, or where a transfer mechanism such as Standard Contractual Clauses is in place, in line with GDPR Chapter V.
Under the GDPR, you have the right to: request a copy of the personal data we hold about you; ask us to correct it; ask us to delete it where we no longer need it; ask us to restrict or object to our processing of it; and ask us to move it electronically to another organisation. To exercise any of these, use our Contact form.
You also have the right to lodge a complaint with your national data protection authority, or with the supervisory authority in your own EU member state.
We keep the amount of personal data we hold to a minimum, rely on established, security-conscious providers (Netlify for hosting and form processing) rather than running our own servers, and review access to client information periodically. If you have specific security requirements for an engagement, tell us during scoping and we will address them in the Terms of Reference.
Questions about this summary or how we handle your data: use our Contact form. See also our Cookie Policy and Terms and Conditions.
