Privaatsuspoliitika

See dokument on saadaval ainult inglise keeles.

Updated 28.10.2026

The privacy of your personal data is important to us. This Policy has the purpose of providing an overview of the acts of processing of Personal Data you provide that may be carried out by Bord through our Website.

1. General Definitions

Platform	the SaaS KYC and AML platform operated by Bord available on the Website
Website	www.bord.eu
Bord, we, us or our	Bord OÜ, with commercial registry code 16738896 and address at Kungla tn 17a, 50403 Tartu, Estonia
Service	the KYC and AML process management service provided by Bord via the Platform
GDPR	regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data
Client	any legal entity who is using Bord’s Service to manage their KYC/AML processes and has therefore registered a Client Account on the Platform and uses it and the Service according to these Terms
Data Subject	an identified or identifiable natural person. Within the meaning of this Policy, the term “Data Subject” refers to any natural person whose Personal Data is made available to Bord via the Platform, Website and Service.
Client Account	the user account registered by the Client to use the Platform and the Service
Partner	any natural or legal person who is invited by a Client via a link to perform verification and KYC/AML procedures on the Platform
Personal Data	any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing	any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
Controller	a person who alone or jointly with others, determines the purposes and means of the Processing of Personal Data
Processor	a person who Processes Personal Data on behalf of the Controller
Pseudonymisation	the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person
Policy	this privacy policy
Terms	the bord.eu Terms of use available at https://bord.eu/legal/terms-of-service
Data Processing Agreement or “DPA”	the data processing agreement ancillary to the Terms, which is entered into between the Client and Bord in conjunction with the Terms for the purpose of enabling the Client to use the Service that entails processing of the Partners’ Personal Data by Bord (as the data processor) on behalf of the Client (as the data controller)

2. Objectives of Processing of Personal Data

2.1 For the purpose of providing and enabling the use of the Platform, Website and Service, Bord Processes the Personal Data, which the Client and its Partners provide about the Data Subjects upon using the Services.

2.2 The types of Personal Data Processed are not restricted and depend on the decision of the Clients and users on how they want to use the Service and generally include the name, identification data, organizational information, contact info, PEP/media/sanctions screening data, but may also include financial data, country, addresses, etc. The categories of Personal Data Processed by Bord under this Policy are described in detail in clause 6.2 below.

2.3 This Policy regulates the Personal Data Processing activities which are solely performed by Bord with regard to the categories of Data Subjects specified in this Policy.

2.4 While using the Service, the Client and authorized users may provide or request that their Partners provide Bord with Personal Data of third-party Data Subjects, such as the Partners’ legal and/or authorized representatives, workers, affiliated persons and other natural persons who are not users of the Platform, with the purpose to perform KYC/AML screening of such Data Subjects via the Service. The Personal Data of such Data Subjects shall be Processed by Bord (as the data processor) for the purpose of providing the Service to the Client (as the data controller). The specific terms and conditions applicable to the Processing of such Data Subjects’ Personal Data by the Bord are set out in the Data Processing Agreement.

3. The Controller of Data Subject’s Personal Data

3.1 Bord as the owner and operator of the Platform and the Website and provider of the Service is considered as a Controller in relation to any Data Subjects’ Personal Data collected and Processed via the Website and Services.

3.2 Taking into consideration that the Client is able to perform Personal Data Processing activities in its Client Account, including add, change, and delete the Personal Data of Data Subjects, each Client is also considered as a Controller in relation to any Personal Data in their Client Accounts.

3.3 Bord is Processing the Partners’ Personal Data solely on behalf of the Client for the purpose of providing the Service to the Client.

3.4 Therefore, with regard to the Partners’ Personal Data provided to Bord (either by the Partners or by the Client), the Client shall be considered as the Controller and Bord shall be considered as the Processor. Bord and the Client shall enter into a separate Data Processing Agreement, which further regulates Bord’s data Processing activities with regard to the Processing of the Partners’ Personal Data and enables the Client to give Bord instructions on the Processing of Personal Data of Partners.

3.5 This Policy regulates the Personal Data Processing activities which are solely performed by Bord. This Policy does not establish Personal Data Processing rules applicable for the Processing activities carried out by the Client. Each Client shall be solely liable for the fulfilment of the obligations set forth in GDPR, incl. the obligation to provide information to the Data Subjects.

3.6 For avoidance of doubt, Bord shall not be liable in any case for any violation of GDPR by the Client.

4. Categories of Data Subjects

In the course of providing Services to Clients, Bord Processes the data that the Clients or Partners have provided to Bord directly. The data provided by the Clients and Partners may include Personal Data of the following Data Subjects:

Clients’ representatives, employees, workers (incl. current and former personnel), director and any other Data Subject authorized by the Client to access the Platform and use the Service on behalf of the Client;
third-party Data Subjects whose Personal Data is submitted to Bord by the Partners who are invited by the Client to perform verification and KYC/AML procedures on the Platform. This includes the Partners’ legal and/or authorized representatives, workers, affiliated persons and any other natural persons who are not the Client’s authorized users and whose Personal Data is provided by the Partner and Processed by Bord in the course of provision of the Service.

5. Sources of Personal Data collection

We are processing mainly the Personal Data which is submitted to us directly by the Data Subject, in particular, by the Client’s authorized representatives who are using or intending to use the Service as well as the Partner’s authorized representatives who are performing KYC/AML and verification processes on the Platform.

Bord works closely with third parties (including, for example, business partners, sub-contractors in technical and payment services, analytics providers, search information providers, screening and verification service providers, credit reference agencies) and may receive Personal Data from them.

The Personal Data collected from the Client and third parties shall be combined with the Personal Data collected directly from the Data Subject and that combined information shall be treated as set forth in this Policy.

6. Personal Data Processing Purposes and Legal Ground

6.1 We are processing the Data Subjects’ Personal Data on the following legal grounds:

6.1.1 Processing is necessary for the performance of the agreement (GDPR article 6 (1) (b));

6.1.2 Processing is necessary for compliance with a legal obligation to which we are subject to (GDPR article 6 (1) (c));

6.1.3 Processing is necessary for the purposes of the legitimate interests pursued by us (GDPR article 6 (1) (f));

6.1.4 The Data Subject has granted consent to the Processing of his Personal Data (GDPR article 6 (1) (a)).

6.2 The categories of Personal Data, Processing purposes and legal ground for the Processing activity is described more specifically in the schedule below.

Categories of Personal Data	Purpose	Legal Ground	Retention Period
Identification data – full name (surname and given name), date of birth or personal identification code, home address; Identity verification data – data retrieved from the copy of a passport, such as document number, issue date, expiry date and issuing entity, photo, video footage or verification process; Organizational data – Data Subject’s position in and/or affiliation with the Client’s/Partner’s organization;	to verify the identity of the authorized representative of the Client/Partner; to verify the Data Subject’s right to represent the Client/Partner;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Identification data – full name, date of birth or personal identification code; Organizational data - Data Subject’s position in and/or affiliation with the Client’s organization; Contact data – phone number, email address;	to enter into the Terms of Service with the Client; to enable the Client to sign-up for a Client Account on the Website, incl. to process the Client’s registration application; to allow the Client to use their Client Account on the Website; to provide the Service stipulated in the Terms to the Client;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Identity verification data – data retrieved from the copy of a passport, such as document number, issue date, expiry date	to perform ongoing monitoring of the validity of the Partner’s representatives’ documentation and notify the expiry of documents to the Client;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Identification data – full name (surname and given name), date of birth or personal identification code, home address; Screening data – Data Subject’s PEP (Politically Exposed Person)/media/ sanctions screening results	to perform PEP, media and sanctions screening of the Data Subjects affiliated with the Partners’ during onboarding of the Partner; to perform ongoing monitoring and PEP, media and sanctions screening throughout the lifetime of the Partner’s relationship with the Client; to flag any notable screening results to the Client;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Signature data – date, time and method of signature, digital signature certificates	to enable the Client to and Partner to sign documents via the Platform;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Contact data – phone number, email address;	to send the Partner an invitation to perform KYC/AML and identity verification procedures on the Platform; to contact the Data Subject for administrative communications and to handle the Data Subject’s complaints; to inform the Data Subject about changes to the Platform, Website and Service and the Terms;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Identification data – full name (surname and given name), date of birth or personal identification code, home address; Identity verification data – data retrieved from the copy of a passport, such as document number, issue date, expiry date and issuing entity, photo, video footage or verification process;	to comply with anti-money laundering requirements, and combat fraud, ensure the fulfilment of international financial sanctions, comply with the lawful inquiries and orders of public authorities with whom Bord is obligated to cooperate;	Obligation arising from law	Personal Data may be processed in accordance with statutory deadlines
Billing and subscription data – data about the Client’s subscriptions and plans, contact data of recipient, billing address;	to enable the Client and Data Subject to access and use the Platform and the Service;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Payment data – payment method, bank details, credit card information, paypal account information;	to process the Clients’ and Data Subjects’ payments for the Service;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Support data – communication between Bord and the Data Subject (inquiries submitted via the Website or email), complaints of the Data Subject;	to provide the Service to the Data Subject and Client; to address technical or legal issues related to the Service provided, or share updates and notifications about the Service;	Necessary for the performance of the contract	Personal Data may be processed during the course of the contractual relationship and 3 years thereafter
Contact data – email address;	to send promotional information related to the Platform and the Service;	Consent	Personal Data may be processed until the given consent is revoked
Device data - information regarding the device on which the Data Subject is using the Platform, including the device’s model, name or any other identifier and the IP address;	to manage, analyze and improve the Service;	Legitimate interest	Personal Data may be Processed during the course of the contractual relationship; thereafter, Personal Data may only be Processed if it is Pseudonymized
Preference data - Data Subject’s preferences on the Platform and the Website;	to personalize the Service;	Legitimate interest	Personal Data may be Processed during the course of the contractual relationship; thereafter, Personal Data may only be Processed if it is Pseudonymized
Usage data - data about the Data Subject’s interaction on the Platform and the Website;	to manage, analyse and improve the Services;	Legitimate interest	Personal Data may be Processed during the course of the contractual relationship; thereafter, Personal Data may only be Processed if it is Pseudonymized
Website data – anonymized data collected automatically while visiting the Website from browser logs, including log in information, browser type and version, operating system and platform, IP address, browser and session information, cookies, and the requested pages	Bord may Process Website data to improve the Website and the Services and also to understand trends, including: to monitor patterns of usage, such as login dates and volumes of data as to understand how the Website and Service are used; for security reasons, including identification and authentication; for statistical and analytical purposes; to monitor and prevent fraud and abuse.	Legitimate interest	Personal Data may be Processed during the course of the contractual relationship; thereafter, Personal Data may only be Processed if it is Pseudonymized

7. Automated Decision Making

Automated decision making refers to a decision which is taken solely on the basis of automated Processing of Data Subjects’ Personal Data. This means Processing using, for example, software code or an algorithm, which does not require human intervention.

We do not process the Data Subject’s Personal Data within the scope of exclusively automated processing for the purpose of making decisions which have direct legal effect on the Data Subject without human intervention or which significantly affects the Data Subject in a similar way.

Our automated processing of Data Subjects’ data is necessary in order to carry out the tasks outlined in the Terms and enable the Data Subjects to use the Services. If the Data Subject does not agree to the automated processing of his Personal Data, then the Data Subject cannot accept this Policy. In this case, it will be impossible for us to provide the Data Subject with our Service or for the Data Subject to use the Platform, Website or Service.

8. Transfer of the Personal Data

We may transfer the Data Subjects’ Personal Data to third parties, such as:

legal and regulatory authorities;
authentication and verification service providers;
screening service providers who screen the Data Subject’s information via public databases;
server hosts who host our servers;
communication service providers who facilitate e-mails, and other communication between us and the Data Subject;
customer support and customer management service providers;
marketing service provider;
other parties involved with the provision of Bord’s Services (accountants, auditors, lawyers, IT systems suppliers and support, or any other outsourcing providers).

We have taken steps to ensure that these data recipients protect the confidentiality and security of Personal Data, and to ensure that Personal Data is Processed only for the provision of the Service and in compliance with applicable law.

9. Security

We will take appropriate legal, organizational, and technical measures to protect Personal Data consistent with applicable privacy and data security laws. Security measures shall be applied in order to protect Personal Data from involuntary or unauthorized Processing, disclosure or destruction.

Upon transferring Personal Data to third parties, we will apply the following safeguards:

We will make sure that such third party undertakes to implement appropriate technical and organizational measures ensuring the Processing of Data Subject’s Personal Data in accordance with this Policy and applicable law;
We will make sure that (a) the third party is established in a jurisdiction which the European Commission has recognized as ensuring an adequate level of Personal Data protection, or (b) the Processing of the Data Subject’s Personal Data is subject to other appropriate safeguards stipulated in the GDPR;
We will enter into a data processing agreement with the relevant third party, if necessary.

10. Integrity and retention of the Personal Data

We will retain Personal Data for the period required or permitted by applicable law, but no longer than it is reasonably necessary in order to achieve the purposes for which the Personal Data was collected.

We will take reasonable steps to ensure that the Personal Data we Process is reliable for its intended use, accurate, and complete as necessary to carry out the purposes described herein.

11. The Data Subject’s rights regarding the Processing of Personal Data

The Data Subject has the following rights in relation to the Processing of his Personal Data:

Request Information – all data protection related information which the Data Subject has the right to receive is provided in this Policy. The valid version of the Policy is at all times available on the Website.
Right to Access – the Data Subject has the right to ask us to provide a copy of the Data Subject’s Personal Data which we Process.
Right to Rectification – the Data Subject has the right to ask us to rectify Personal Data in case the data is incorrect or incomplete.
Right to Erasure – the Data Subject has the right to ask us to erase Personal Data, unless we are obliged to continue Processing the Data Subject’s Personal Data under law or under a contract between the Data Subject and us, or in case we have other lawful grounds for the continued Processing of Personal Data.
Right to Restriction – the Data Subject has the right to ask us to restrict the Processing of his Personal Data in case the data is incorrect or incomplete or in case his Personal Data is Processed unlawfully.
Right to Data Portability – the Data Subject has the right to ask us to provide the Data Subject or, in case it is technically feasible, a third party, his Personal Data, which the Data Subject has provided to us and which is Processed in accordance with the Data Subject’s consent or a contract between the Data Subject and us.
Right to Object – the Data Subject has the right to object to Processing his Personal Data in case he has reason to believe that we have no lawful grounds for Processing the Personal Data.
Right to Withdraw Consent for the Processing of Personal Data – the Data Subject is entitled to withdraw the consent granted for the Processing of Personal Data at any time. Withdrawal does not affect the lawfulness of the Processing conducted before the withdrawal.
Right to File Complaints – the Data Subject has the right to file complaints regarding Processing of his Personal Data.

In order to exercise any rights referred herein, the Data Subject is required to submit a written application to us (contact details can be found under Section 13). We have the right to decline this application by justifying the reasons for the refusal. In the event that Bord is acting as a Processor with respect to any Data Subject contacting Bord, Bord will direct the Data Subject’s written application to the appropriate Client as the data Controller.

According to article 12(3) of the GDPR, we are obligated to respond to the application within 1 month. However, we will make our best efforts to respond to the Data Subject’s request within 1 week.

12. Right to Amend This Policy

We are entitled to unilaterally amend this Policy from time to time. Upon amending the Policy, we will notify the Data Subject about the updated terms by e-mail. In case the new terms refer to Processing of the Data Subject’s Personal Data for any new purpose, which requires Data Subject’s consent, then we will not Process Personal Data for such new purpose, before it has received respective consent.

13. Contact Information

Should the Data Subject have any questions regarding this Policy or Processing of Personal Data, they are welcome to contact us with requests, inquiries or any complaints via email info@bord.eu.

Küsimused? Kirjuta info@bord.eu.