Privacy Notice

BoardLink is a board and committee governance platform operated by DomTM Company for Geospatial Information System Applications and Web Services ("DomTM", "we", "us", "our"), commercial registration 1010754834, Riyadh, Kingdom of Saudi Arabia.

DomTM is the data controller for personal data collected through board-link.com and the BoardLink platform. Our technology delivery partner, AL Amari and Her Partner Co. ("BankCube"), operates the platform under contract as a data processor, acting only on our documented instructions.

This notice explains what personal data we collect, why, how long we keep it, and the rights you have under the Personal Data Protection Law (M/19) 1443H and its Implementing Regulations.

Account and contact data: your name, work email address, telephone number, organization, role and login credentials.

Profile data: professional background, board and committee experience, skills and any curriculum vitae you choose to upload.

Governance content: the meetings, agendas, minutes, resolutions, votes, evaluations and documents your organization records in the platform.

Audit trail data: a time-stamped record of actions taken in the platform. This is the core evidentiary feature of the product.

Billing data: subscription tier, invoices, and the payment reference returned by our payment provider. We do not hold your card number.

Technical data: internet protocol address, device and browser type, and data collected through essential cookies.

Support data: the content of enquiries you send us through the contact form or by email.

Directly from you when you register, configure your organization, use the platform, or contact us.

From your organization, where an administrator creates an account or uploads content on your behalf.

Automatically as you use the platform, through system logs and essential cookies.

To provide your account and the platform's governance features. Legal basis: performance of the contract with you or your organization.

To operate, secure and improve the platform, and to prevent misuse. Legal basis: our legitimate interest, where it does not override your rights.

To issue invoices and process subscription payments. Legal basis: performance of the contract and compliance with a legal obligation.

To respond to your enquiries and provide support. Legal basis: performance of the contract, or your consent where you contacted us before any contract existed.

To send service notices about changes to the platform, these terms or this notice. Legal basis: performance of the contract.

To comply with legal, regulatory and tax obligations in the Kingdom. Legal basis: compliance with a legal obligation.

We do not sell personal data, and we do not use it for third-party marketing. Where we rely on your consent, you may withdraw it at any time.

BankCube, our technology delivery partner, under contract and on our instructions only.

Service providers that support the platform, including our payment provider and our hosting, error monitoring and email delivery providers. Each is engaged as a processor under contract. We maintain a register of these providers, available on request, and we give notice before engaging a new provider that processes your content.

Regulators, courts and law enforcement, where required by law or a valid order.

We do not share your personal data with anyone else, and never for another party's own marketing, without your explicit consent.

We apply encryption in transit and at rest, role-based access control, and logical isolation between organizations so that no organization can access another's data.

Access to personal data is restricted to those who need it to provide the service, and our staff and providers are bound by confidentiality obligations.

If a personal data breach is likely to cause harm to your rights, we notify the Saudi Data and Artificial Intelligence Authority within the period required by the Personal Data Protection Law, and we notify you where the law requires it.

Account and profile data: while the account is active, and for ninety days after it closes.

Governance content: while your organization's subscription is active. On expiry or suspension we retain it for at least ninety days so that you can export it, and we do not delete it without giving you at least thirty days written notice.

Audit trail records: retained for the period your organization's own retention policy requires, and not less than the period required by applicable law.

Billing and invoice records: for the period required by Saudi tax law.

Support enquiries: twelve months.

When a retention period ends we securely delete or anonymize the data, including in backups.

Some BoardLink features use artificial intelligence to assist your governance work, for example summarising a document, extracting action items from minutes, or comparing a committee's skills profile against its mandate.

Artificial intelligence output is a suggestion and never a decision. BoardLink does not exercise governance judgement, does not vote, and does not determine the outcome of any matter before your board or committee. A person in your organization reviews and accepts or rejects every output before it forms part of your record.

No decision producing legal effects for any individual is taken by automated means alone.

Content generated or materially assisted by artificial intelligence is identified as such within the platform.

Where an artificial intelligence service provider is involved, that provider is engaged as a processor under contract, appears in the register referred to in Section F, and is subject to the same transfer conditions as any other processor.

You may ask us how a particular output was produced, and you may ask us not to apply artificial intelligence features to your organization's content.

We apply the principles set out in the National AI Ethics Principles issued by the Saudi Data and Artificial Intelligence Authority, in particular transparency and explainability, human oversight, privacy and security, and accountability.

Under the Personal Data Protection Law you have the right to be informed, the right of access, the right to obtain a copy of your data in a readable format, the right to rectification, the right to erasure where the data is no longer required, the right to restrict or object to processing, and the right to withdraw consent where processing is based on it.

These rights are not absolute and may be limited where another law requires us to retain the data. We respond to requests within the period prescribed by the Law.

To exercise any right, contact us using the details in Section O.

If you believe we have processed your personal data in a way that breaches the Personal Data Protection Law, we encourage you to contact us first so that we can resolve the matter.

You may at any time lodge a complaint directly with the Saudi Data and Artificial Intelligence Authority through its official channels.

BoardLink is intended for organizations and governance professionals. It is not directed at children and we do not knowingly collect their personal data.

We use cookies that are strictly necessary to operate the platform, maintain your session and keep it secure. Where we use any cookie that is not strictly necessary, we ask for your consent first and you may withdraw it at any time.

We may update this notice as the platform or the law changes. The current version is always published on board-link.com with the date it was last updated. Where a change materially affects your rights, we will tell you before it takes effect.

Privacy enquiries and rights requests: support@board-link.com.

DomTM Company for Geospatial Information System Applications and Web Services, commercial registration 1010754834, [registered address], Riyadh, Kingdom of Saudi Arabia.

This notice is published in Arabic and English. In the event of any discrepancy between the two versions, the Arabic version prevails.