BordrThis document has not been reviewed by a lawyer
It was drafted to describe accurately how Bordr actually works, and Nigerian counsel should read it before anyone relies on it contractually. Where it describes a technical control, that description is accurate as at the date above.
Data processing addendum
Last updated 17 October 2026 · forms part of the terms of service
This addendum applies where Korevra processes personal data on your behalf in Bordr. You are the controller; Korevra is the processor.
1. Subject matter and duration
We process personal data in order to provide Bordr, for the duration of your account, and afterwards only as long as needed to return or delete it and to meet our own legal retention obligations.
2. Nature and purpose
Hosting and making available a board governance record: meetings, agendas, board papers, resolutions, votes, minutes, statutory registers, declarations of interest, compliance obligations and risks, together with the audit trail of all of it.
3. Categories of data and data subjects
- Data subjects: directors, the company secretary, board observers, other members you invite, and shareholders you record.
- Data: names, email addresses, roles and appointment dates, attendance, votes and recusals, declared interests, shareholdings, and whatever appears in the documents and minutes you put into Bordr.
- Special categories: not required by Bordr and not requested by it. If you place such data in a document or a minute, you remain the controller of it.
4. Our obligations
- Process personal data only on your documented instructions, which these terms and your use of the product constitute.
- Keep it confidential, and ensure our personnel are bound to do the same.
- Apply the technical and organisational measures described at getbordr.com/security, including a default-deny database with no client write path, a single audited write path, a hash-chained audit trail, per-recipient watermarking, short-lived signed document links, malware scanning on upload, and two-factor authentication available on every plan.
- Notify you without undue delay on becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.
- Assist you with data subject requests, data protection impact assessments and regulator enquiries.
- Delete or return your data on termination, on your instruction. Note that the audit chain is append-only: individual entries cannot be deleted without destroying the integrity property it exists to provide, so it is deleted as a whole with the account.
5. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase (Google LLC) | Hosting, database, authentication, file storage, AI model inference | europe-west1 (Belgium) |
| Google (email delivery) | Sign-in links, invitations, account notices | EU / US |
We will tell account owners by email before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds.
6. International transfers
Your data is stored and processed in the European Union and not in Nigeria. This is a cross-border transfer under Part VIII of the NDPA 2023, relying on the adequacy of the destination regime together with our contractual arrangements with Google. If your regulator requires Nigerian residency we cannot meet that today, and you should not subscribe on the assumption that we can.
7. Our own access to your data
Korevra personnel do not browse customer boards. Support access must be requested, must be granted by you, expires on a clock, is limited to named fields, returns no document bytes, and is recorded on your own board’s audit chain where your directors can read it.
8. Audits
On reasonable notice we will provide the information needed to demonstrate compliance with this addendum. There is currently no third-party audit report or certification to provide, and we will not imply otherwise.