Andmetöötlusleping

Updated: 28.10.2026

This Data Processing Agreement between the Client and Bord shall stipulate how Personal Data submitted by the Partners is Processed by Bord on behalf of the Client. This Data Processing Agreement establishes the principles for Processing of the Data Subjects’ Personal Data, which is provided to Bord by the Partners or otherwise becomes available to Bord in connection with the Client’s use of the Platform, Website and Service.

Please read this DPA carefully to understand the practices that Bord applies regarding Processing of Personal Data. This DPA constitutes an integral part of the agreement between the Client (as Controller of Personal Data) and Bord (as Processor of Personal Data) in the meaning of article 28 of GDPR. By using the Platform and the Service, the Client confirms that it has familiarized itself with this DPA, understood it, and agrees to its terms. Upon initial registration of a Client Account on the Website, the Client (via its authorized representative) also declares its acceptance of and consent to the processing of Personal Data as described in this DPA and the Privacy Policy.

Bord has drafted this DPA in cooperation with its legal advisers in accordance with the requirements of GDPR. Bord does its best to ensure that the Processing of Personal Data is in full compliance with applicable legal requirements.

Bord shall be entitled to unilaterally review and amend this DPA from time to time. Therefore, Bord advises to periodically review the DPA in the case of any changes to it. If the Client or any of its users do not agree with any or all terms of this DPA or any possible changes to it, then they should immediately close the Website and cease using the Platform and the Service. Continued use of the Platform, Website or Service by the Client shall mean its consent to any such changes.

1. General Definitions

2. Object of the Data Processing Agreement

2.1 The Client acknowledges that the nature of the Service requires that Bord access and Process Personal Data of the Client’s Partners, who are invited by the Client to perform KYC/AML and verification procedures on the Platform and who do not have any legal relationship with Bord. In cases where the Client’s use of the Platform and/or the Services under the Terms predisposes or encompasses the Processing of any Personal Data by Bord on behalf of the Client, Bord shall have the right to process Personal Data on behalf of the Client in accordance with and to the extent laid down in this DPA and the documented instructions of the Client.

2.2 Bord can only provide the Service to the Client and legally process the Personal Data of its Partners if the Client as the data Controller authorizes Bord as the data Processor, by accepting and adhering to the terms of the DPA. Under this DPA, the parties shall agree on the Personal Data Processing requirements in order to secure that the Processing complies with applicable data protection legislation and to ensure the protection of Data Subjects’ rights.

2.3 Bord Processes the Personal Data of such Data Subjects upon

2.3.1 usage of the Platform and the Services by the Client and its authorized users, including when they submit to Bord information about their Partners;

2.3.2 processing the verification and KYC/AML information provided by the Partners via the Service;

2.3.3 ongoing monitoring of the Partner’s information retained in the Platform.

2.4 The Personal Data of your Partners shall be Processed in accordance with this Data Processing Agreement. The object of this DPA is to define the subject-matter and duration of the Processing of Personal Data, the nature and purpose of the Processing, the types of Personal Data being Processed and the categories of Data Subjects (hereinafter “Details of Processing”) and the Personal Data Processing related rights and obligations of the parties concerning any Personal Data Processing that the Processor performs on behalf of the Controller under the DPA. The DPA shall apply to any Processing of Personal Data carried out by the Processor on behalf of the Controller.

2.5 The types of such Personal Data are not restricted and depend on the decision of the Client on how it wants to use the Service and generally include the identification data (full name, date of birth or personal identification code, home address), identity verification data (data retrieved from the copy of a passport, such as document number, issue date, expiry date and issuing entity, photo, video footage or verification process), PEP (politically exposed person) status, media/PEP/sanctions screening results, organization details (position in and/or affiliation with the Partner’s organisation), contact information (telephone number, email address) of the Data Subject, but may also include financial information etc.

2.6 Any Personal Data of the Client and users in the Client’s organization, including any data of the Client’s authorized representatives and personnel, which is provided to Bord by the Data Subject directly via the Platform, the Website or Service, will be Processed and used in accordance with the Privacy Policy. For the avoidance of doubt, this DPA does not regulate the Processing of Personal Data of Data Subjects who use the Platform and the Service on behalf of the Client and provide their Personal Data to Bord directly.

3. Processing of Personal Data on behalf of the Controller

3.1 Bord Processes the Personal Data according to documented instructions from the Client. The Client inserts these instructions by using the Service (e.g. setting up the KYC/AML questionnaire, inserting command to send link to a Partner to invite the Partner to perform KYC/AML and verification procedures on the Website) and by agreeing with the DPA, Privacy Policy and Terms. The instructions of the Client for Processing of Personal Data must always comply with the applicable laws and Bord reserves itself the right to refuse to fulfill the instructions that are in the opinion of Bord unlawful.

3.2 In accordance with Article 4 (7) of GDPR, the Client is the Controller of the Personal Data submitted to Bord by the Client and the Client’s Partners via the Service for the purpose of Processing on behalf and in the interest of the Client, including the Personal Data regarding the Client’s Partners submitted by the Client and its Partners. According to Article 4 (8) of the GDPR, Bord acts as the Processor on the Client’s behalf when Processing the Personal Data submitted by the Client or its Partners. Therefore, the Client:

3.2.1 is fully responsible for the Processing of Personal Data that the Client or its Partners submit to Bord;

3.2.2 guarantees to Bord explicitly that in order to use the Platform, Website and Service, the Client has all the necessary consents from Data Subjects and/or other legal grounds for lawful processing of Personal Data in accordance with this DPA;

3.2.3 obliges to inform Bord immediately of the expiry of legal grounds for the processing, modification, inaccuracy, or change to the Personal Data that Bord is Processing on behalf of the Client.

3.3 Bord and the Client undertake to comply with all obligations arising from any applicable data protection legislation, including the GDPR. The parties shall refrain from any action which could result in the other party’s failure to comply with its obligations under applicable data protection legislation.

3.4 Taking into account the nature of the Processing, Bord shall assist the Client with appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Client’s obligation to respond to requests for exercising of Data Subject’s rights laid down in the GDPR, including the right of access to Personal Data by Data Subjects, right to rectification, right to be forgotten, right to restriction of processing, etc. Bord shall accept instructions for the fulfillment of the rights of Data Subjects only from the Client. Should the Data Subjects approach Bord with the requests for the fulfillment of their rights, Bord shall inform the Client and act according to instructions from the Client. The obligation to delete the data of Data Subjects shall always remain with the Client and Bord shall not undertake deletion for and on behalf of the Client, unless otherwise explicitly stipulated in the DPA, Privacy Policy or Terms.

3.5 Bord shall assist the Client in ensuring compliance with the obligations of guaranteeing security of the Processing of Personal Data as established by the GDPR while taking into account the nature of Processing and the information available to Bord. Inter alia Bord undertakes the obligations detailed in Appendix I.

3.6 In the course of providing the Service and access to the Platform and Website, Bord uses different third-party service providers, to whom it may also transfer Personal Data (“Third Parties”). Where Bord subcontracts its obligations under the DPA to a Third Party, then it shall agree on data processing agreement imposing at least the same obligations on the Third Party as are imposed on Bord under the DPA. If Bord wishes to transfer the Personal Data to Third Parties located outside of the European Economic Area (EEA), then Bord shall ensure the application of the appropriate safeguards by such Third Party, including applying the measures detailed in Appendix I. The Third Parties who Bord transfers Personal Data to for the purposes of providing the Service are listed in Appendix II “List of Sub-Processors”.

4. Guarantees for Personal Data Processing

4.1 Bord shall Process the Personal Data provided by the Client only to the extent and in such a manner as is necessary for the provision of the Service.

4.2 Bord confirms that it shall not Process the Personal Data for any other purpose which is not necessary for the provision of the Service. To ensure this, Bord shall:

4.2.1 refrain from any personal use, including commercial use, of the Personal Data processed for the provision of the Service;

4.2.2 comply with this DPA and any applicable data protection legislation and ensure that its own employees or any third party used by it for Personal Data Processing complies with the same;

4.2.3 process the Personal Data only on behalf of the Client and in compliance with its instructions and the DPA.

4.3 Bord shall take all appropriate technical and organizational security measures to prevent the destruction, loss or alteration, unauthorized disclosure of Personal Data or unauthorized access to such data, either accidentally or unlawfully.

4.4 If requested by the Client and within the time frames as reasonably determined by the Client, Bord shall supply the Client with full details of the technical and organizational measures in place to safeguard the security of the Personal Data and compliance with the Appendix I “Technical and Organisational Security Measures Applied by Bord”. Bord shall enable the Client to carry out security audits and take all necessary steps to verify the implementation of the technical and organizational security measures. All costs related to the fulfilment of the obligations specified herein, incl. costs related to the organization of an audit shall be borne by the Client.

4.5 Bord shall notify the Client without undue delay if it becomes aware of any Personal Data Breach. The notification provided to the Client shall describe the nature of the Personal Data Breach and any relevant details.

5. Liability

5.1 The Client shall assume liability for damage, administrative fines or any other claims arising with regard to the Client’s violation of the DPA or requirements of the applicable law.

6. Safety Measures for Protection of Personal Data

6.1 Bord takes the appropriate legal, organizational, and technical measures to protect Personal Data consistent with applicable privacy and data security laws. Security measures shall be applied to protect Personal Data from involuntary or unauthorized processing, disclosure, or destruction and are detailed in Appendix I.

7. Retention Periods

7.1 Bord shall preserve the Personal Data as long as it is required for the use of the Platform, Website and Service by the Client and its users, but no longer than applicable law permits preservation.

7.2 The Client confirms that it agrees with the provided retention periods and guarantees to inform and obtain necessary approvals from its Partners for application of such retention periods.

8. Contact Information

8.1 Should the Client have any questions regarding this DPA or the processing of Personal Data, it is welcome to contact Bord with all such requests, inquiries or any complaints via e-mail: info@bord.eu.

APPENDIX I – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organizational measures implemented to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, and the risks to the rights and freedoms of natural persons.

1. Bord stores all Personal Data on secured servers. The security measures include:

(a) Access to the servers is protected with individual accounts, usernames, and passwords for each authorized person (employees/subcontractors);

(b) Bord is keeping track and a log of all activities on the servers;

(c) Bord can immediately close access to the servers to any authorized persons;

(d) Access to the servers is restricted in terms of (a) persons, who have access to it, (b) information, to which authorized persons have access according to the essence of their working duties, (c) actions that authorized persons can perform with Personal Data stored on the servers;

(e) Bord keeps reviewing, who of the authorized persons are actually required to have access to Personal Data and, if access is not required, will withdraw the right of access.

2. In addition, Bord shall:

(f) periodically monitor its internal processes and the technical and organizational measures to ensure that the processing of Personal Data is in accordance with the applicable law. Bord shall also monitor the processing of Personal Data conducted by Third Parties as much as possible;

(g) notify the Clients in the most expedient time possible under the circumstances and without unreasonable delay and, where feasible, not later than 72 hours after having become aware of any accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, Personal Data (herein: Security Breach). In consultation with the Clients, Bord shall take appropriate measures to secure the data and limit any possible detrimental effect on the Data Subjects;

(h) cooperate with the Clients and provide them with information and assistance, where reasonably possible, in connection with Security Breaches, including in communication with supervisory authorities and Data Subjects;

(i) cooperate and assist the Clients in conducting processing impact assessments, if applicable.

3. Access for the Clients to the Client Accounts on the Platform is protected with individual usernames and passwords. The Clients are responsible for keeping passwords confidential. The Clients are obliged not to share passwords with anyone. In case of suspicion of unauthorized access to personal cabinets of the Clients and/or Personal Data, the Clients are obliged to immediately inform Bord thereof.

4. Bord shall ensure that all its employees, contractors, agents, suppliers and consultants, who have access to the Personal Data are fully aware of and abide by their legal duties and responsibilities.

5. Employees and other contractors of Bord are obliged by binding agreements not to disclose or make available for use to anyone other than Bord during their agreement with Bord and eternally after its termination any Personal Data that they may have access to during their agreements with Bord.

6. Bord has door locks and/or door access cards in offices from where Personal Data can be accessed.

APPENDIX II – LIST OF SUB-PROCESSORS

Bord uses the following service providers for the purpose of providing the Service and Processing the Data Subjects’ Personal Data:

ComplyAdvantage Ltd. – AML, media, PEP and sanctions screening service provider;

eID Easy OÜ – Qualified Electronic Signature (QES) solution provider;

Veriff OÜ – identity verification platform;

Amazon Web Services EMEA SARL – cloud hosting provider (servers, databases, file storage, e-mail and SMS delivery); data is stored in the EU (Frankfurt, Germany).