Compliance overview
When a company uses Boardroom, it is the controller of the personal data in its workspace and Boardroom acts as its processor. That processing is governed by our Data Processing Addendum, which forms part of every customer agreement and is available on request.
For personal data we process for our own purposes, such as account administration, billing and our website, Boardroom is the controller. That processing is governed by our Privacy Policy.
Where this page and those documents differ, the documents prevail.
Key facts
- Company: Boardroom Sweden AB, organisation number 559592-6659, Stockholm, Sweden (EU)
- Supervisory authority: Swedish Authority for Privacy Protection (IMY)
- Breach notification: customers notified without undue delay
- Data retention: customer data deleted 30 days after a workspace is closed; backup copies expire within 90 days; activity records are deleted on a published schedule
- Sub-processors: engaged on Article 28 terms, with 30 days' notice of changes
- International transfers: in accordance with Chapter V of the GDPR, under the Standard Contractual Clauses
- Hosting: customer data hosted in the European Union
Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | Ireland |
| Amazon Web Services EMEA SARL | AI document processing, OCR and backups | European Union |
| Vercel, Inc. | Application hosting | Ireland |
| Resend, Inc. | Email delivery | Ireland (sending); United States (storage) |
| Stripe Payments Europe, Ltd. | Payments and billing | European Union; United States |
We notify customers at least 30 days before adding or replacing a sub-processor. A customer may object on reasonable data protection grounds, as set out in the Data Processing Addendum.
Data subject rights
Individuals have the rights set out in Chapter III of the GDPR, including the rights of access, rectification, erasure, restriction, data portability and objection.
Where Boardroom processes data on behalf of a company, requests should be made to that company as controller; we will assist it in responding. Other requests may be sent to contact@helloboardroom.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Security
Boardroom maintains technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR. These include hosting in the European Union, encryption in transit and at rest, role-based access control enforced at the database level, identity confirmation for sensitive actions, audit logging and regular backups.
Contact
Boardroom Sweden AB
Gjutargatan 4A, 112 48 Stockholm, Sweden
contact@helloboardroom.com