Board Platform
Privacy Policy

The General Data Protection Regulation (“GDPR”), which came into force on 25 May 2018, the UK GDPR, and the Swiss Federal Act on Data Protection aim to guarantee that the personal data of physical persons is processed in compliance with the rights, fundamental freedoms and dignity of persons, with particular reference to confidentiality and personal identity. Board International SA and its subsidiaries (“Board” or the “Data Controller”), pay particular attention to the way in which personal information is used and shared and it is therefore important to inform you of the adopted privacy policy.

Processing of personal data means collection, recording, organisation, conservation, processing, alteration, selection, retrieval, comparison, use, disclosure, erasure, distribution, interconnection and any other processing which is useful for the performance of the specific service requested.

1. Personal data we collect

1.1 Board collects the personal information provided by users:

  1. for delivering its services, including the provision of the Board platform (the “Platform”);
  2. for product support;
  3. for cloud computing services;
  4. for additional features or add-on services, such as AI Agents (the activities from point 1. to point. 4, the “Services”);
  5. for managing contractual relationships, such as billing and invoicing,
  6. for ensuring Platform security.

1.2 In particular, the personal data processed by Board includes, inter alia, the following data: name, surname, and job title or contact information including the e-mail address and telephone number.

This information falls under the definition of personal data, i.e. any information concerning an identified or identifiable physical person (the “Data Subject”); identifiable refers to physical persons who can be identified, directly or indirectly, with particular reference to data such as the name, identification number, data concerning their location, an online ID or one or more characteristic elements of his or her physical, physiological, genetic, mental, economic, cultural or social identity (the “Personal Data”).

1.3 The Platform e uses cookies, as described in more detail in the Cookies Policy  https://www.board.com/platform-cookie-policy (the “Cookies Policy”).

1.4 With particular reference to the Platform, in addition to the services already provided through the latter, it is also available Board Agents, an AI-based agent provided by Board and developed using OpenAI technology (“Board Agents”).

Board Agents is an automated system based on generative artificial intelligence designed to respond to requests from Platform users. It has been implemented by Board with functional and operational limitations that restrict its use exclusively to the analysis, querying, and processing of business intelligence data present on the Platform.

In this context, Board processes the following Personal Data through Board Agents:

  • data related to the user’s account interacting with Board Agents (e.g. e-mail, name, etc.) ;
  • interactions with Board Agents and related content.

Please note that the user’s Personal Data and related interactions will not be used by Board Agents and the underlying technology provided by OpenAI for the training of the Artificial Intelligence system. 

2. Purposes of the processing

2.1 The Personal Data provided by you at the time of providing the Services may be processed, for purposes linked to the provisions of the Service and, for example, to create named users, to provide the Platform, to provide technical support, to deliver add-on services, to comply with legal and regulatory obligations.

2.2 The Personal Data provided by you may be processed also to provide security for Board Platform and Services, and to comply with the applicable laws, regulations, court orders, government, and law enforcement requests, to investigate security and privacy incidents, and to manage any customer disputes.

2.3 With specific regard to the Personal Data processed through Board Agents, such Personal Data will be processed in order to: (i) provide to the user the access to Board Agents; (ii) ensure the proper functioning of the service offered through Board Agents; (iii) allow Board Agents to generate and display the outputs; (iv) maintain the service continuity, the security of Board Agents; (v) if required, provide technical support.

3. AI Agents and Automated Features

  • Where AI Agents or other automated features are enabled:
  • Personal data may be processed to generate outputs, automate workflows, or provide analytical insights;
  • Processing is limited to the purposes defined by the customer configuration and applicable agreements;
  • AI outputs are generated based on input data and system logic; customers remain responsible for validating outputs before use;
  • Board implements appropriate safeguards to protect personal data used in AI-based services.

4. Methods of processing

4.1 Your Personal Data is collected by the parties set forth in clause 6 of this Privacy Policy, and the related processing is carried out using manual or computerised automated instruments with logics strictly linked to the purposes described above and, in any case, to guarantee the security and confidentiality of the Personal Data.

5. Legal basis of the processing of Personal Data

5.1 Pursuant to the GDPR, Board processes your Personal Data:

  • to perform and manage the contract with you. When entering into an agreement with Board, Board processes Personal Data to provide the Services, and to manage the contractual relationship;
  • for legitimate interests (e.g., ensuring Platform security and service reliability);
  • compliance with legal obligations;
  • consent, where required.

5.2 With regard to the effects of the non-acceptance or disabling of the cookies, please refer to the terms of the Cookies Policy.

5.3 With specific regard to the Personal Data processed through Board Agents, the legal basis of this processing activity is art. 6(1)(b) GDPR. Please note that the provision of such data is necessary to ensure the functioning of Board Agents.

6. Categories of persons to whom the Personal Data may be disclosed

6.1 The Personal Data collected for the purpose of the provision of the Service under clause 2 may be disclosed to companies performing activities which are strictly linked and instrumental to the provision of the Service. Such Personal Data may be transferred to associated companies and/or companies within the Board Group or third parties even located outside the European Union, where there are in place the appropriate safeguards (guarantee of an appropriate level of protection) set forth by the European Commission. All subprocessors are contractually bound by appropriate data protection obligations. Board does not sell Personal Data.

7. Controller, Processors and Representatives

7.1 Data Controller or Controller refers to the physical or legal person, public authority, service or other body which, individually or with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of processing are determined by law by the European Union and the Member States, the Controller or the specific criteria applicable to his or her appointment may be established by the law of the European Union and the Member States.

7.2 For the processing activities described in this Privacy Policy, Board International SA, with registered office at Via Maestri Comacini 4, 6830 Chiasso, Ticino, Switzerland, and, where applicable, other companies within the Board Group, may act either as data controller or as data processor, depending on the nature of the processing activity.

Where Board processes personal data for its own purposes (such as account management, billing, and security), Board acts as an independent data controller.

Where Board processes personal data on behalf of its customers in connection with the provision of the Service, Board acts as a data processor in accordance with the applicable Data Processing Agreement and the documented instructions of the customer.

7.3 Board may appoint external data processors to achieve the purposes specified at clause 2. The list of the processors is governed by the relevant agreement between Board and the customer. Nevertheless, it is possible to request a complete list of external processors by sending an e-mail to the e-mail address set forth in clause 8.2 of this policy.

7.4 Board have appointed their own employees and collaborators to process the data.

7.5 Data Subjects may exercise their rights towards Board.

8. Rights of the Data Subjects

8.1 You have the right, at any time, to exercise your rights pursuant to the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection.

8.2 To exercise your rights please write to the specific e-mail address: [email protected] .

8.3 Please note that you also have the right to lodge a complaint with the competent supervisory authority.

9. Period for which the Personal Data is processed

9.1 Your Personal Data will be conserved in hard copy and/or electronic/computerized for the time strictly necessary to meet the purposes indicated at clause 2, in compliance with the applicable laws and/or the contractual relationship. Board has defined the specific duration of the storage of the Personal Data for each type of Personal Data collected. At the end of such periods, Board will definitively erase your Personal Data.

9.2 With specific regard to the Personal Data processed through Board Agents, such data will be retained for the entire duration of the account’s validity and until its deactivation. Personal Data may be stored for a longer period where necessary to

  • comply with legal obligations,
  • establish, exercise or defend legal claims,
  • ensure IT security and fraud prevention

 Please note that all interactions with Board Agents are saved in order to allow users to access previous outputs generated by Board Agents itself. These conversations will be permanently deleted upon the deactivation or deletion of the user’s account. Such information, however, will not be used for the training of the AI system on which Board Agents is based.

10. Amendments

10.1 This Privacy Policy may be subject to amendments. If substantial amendments are made to the use of your Personal Data, Board will notify you by publishing a notice on the Website and/or by sending you an e-mail.

11. Contacts

For any information or request which relates to this Privacy Policy, please contact us (Board International, Via Maestri Comacini 4, Chiasso, Ticino 6830, Switzerland) at the e-mail address [email protected].