Privacy Policy

This Privacy Policy explains how LamWorks collects, uses, discloses and protects personal information in connection with BordersHub (the “Service”), a business-to-business platform on which organizations publish trust profiles, keep compliance evidence, establish trust relationships with other organizations and share information with them. It applies to the Service’s website, web application and application programming interface (“API”).

The Service is intended for organizations and the people who act on their behalf. It is not directed at consumers acting for personal, family or household purposes.

1. Who we are and what this policy covers

BordersHub is owned and operated by LamWorks, a business registered in the Province of Alberta, Canada (“LamWorks”, “we”, “us” or “our”). We have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy laws, and who can be reached at privacy@bordershub.com.

In this policy, “Customer” means an organization that has registered for the Service, and “User” means an individual who uses the Service on behalf of a Customer (for example an administrator, contributor or approver), or who visits our public pages. “Personal information” (also called “personal data”) means information about an identified or identifiable individual.

We handle personal information in accordance with applicable privacy laws, which may include Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and U.S. state privacy laws, to the extent each applies.

2. Our role: controller and processor

Our responsibilities depend on the information involved:

• Customer Content. Information that a Customer and its Users enter into or upload to the Service—trust profile declarations, evidence files, contact details of the Customer’s staff, approval notes, trust request messages and support attachments—is controlled by that Customer. For Customer Content, LamWorks acts as a processor (or “service provider”) on the Customer’s behalf and processes it only to provide the Service and in accordance with the Customer’s instructions and our Terms of Service. If your personal information is included in a Customer’s Customer Content (for example, you are listed as a contact in a company’s trust profile), please contact that Customer first; we will assist the Customer in responding to your request.
• Account, security and usage information. For information about Users’ accounts, sign-ins, security events, audit records, API token usage, support requests and visits to our website, LamWorks acts as a controller.
• Information shared between Customers. When a Customer approves another organization’s trust request, that organization may view and download the Customer’s full trust profile and evidence. The receiving organization decides for itself how it uses what it receives and is independently responsible for it as its own controller.

3. Information we collect

3.1 Information you or your organization provide

• Account information: full name, business email address and whether you have confirmed it, job title, password (stored only as a salted cryptographic hash), optional profile picture, and assigned role.
• Multi-factor authentication: if you enable it, the secret key that links your authenticator app to your account.
• Organization information: organization name, logo, business classification, the company identifier we assign, which member is its root account (the account that receives organization-wide emails), and organization-level settings such as password, lockout and MFA requirements.
• Trust profile content: declarations about the organization (for example corporate identity, certifications, security, privacy, operations, products and services), which may include names, titles, email addresses and telephone numbers of the organization’s staff and representatives, and the names and titles of people who approve published versions.
• Evidence files: documents and images uploaded to the evidence vault, with their descriptions and expiry dates. Evidence files may contain personal information chosen by the Customer.
• Trust relationships: trust requests, optional messages sent with them, and decisions to approve, deny or revoke them.
• Team management: email addresses and roles of people invited to join an organization, and requests to join an organization made by registering with an email address at its company domain (shown to that organization’s administrators with the requester’s name, job title and email address until they approve or reject it).
• Subscription information: your organization’s subscription status and history (payments, refunds and chargebacks with their dates, amounts and invoice numbers, and any subscription we gave or ended, with the reason), and the identifiers Paddle uses for your organization’s customer record, subscription and transactions. Payments are made to Paddle, our reseller and merchant of record (Section 7): the name, email address, billing address, tax registration number and payment details you enter at checkout are collected by Paddle, not by us, and payment card details never reach us.
• Support requests: the content of support tickets and replies, and any attachments.
• Reports: when you report another organization, your name, email address and organization, the reason and description you give, the messages exchanged with us about the report, and our decision.
• API tokens: the name an administrator gives a token, its expiry date and who created it. We store only a cryptographic hash of the token itself and cannot recover it.

3.2 Information collected automatically

• Audit records: the Service records security-relevant and business actions (for example sign-ins and failed sign-in attempts, profile changes, submissions and approvals, evidence uploads, views and downloads, trust decisions, team changes, settings changes and API token management) together with the date and time, the acting User’s name and email address, the IP address and the browser’s user-agent string.
• Enforcement records: when we review a report, remove content, or suspend or reinstate an account, we record what we did, when, why and which of our staff did it, both in our own staff activity log and, where it concerns your organization, in your organization’s audit log.
• Security data: failed sign-in counts and account lockout status, and the date, time and IP address at which each API token was last used.
• Technical data: information your browser or integration sends with each request (such as IP address, user agent and requested URL), which our servers and hosting providers may record in technical logs used to operate and secure the Service.

3.3 Information from other Customers

Another Customer may enter information about you, for example by inviting you to its team or by listing you as a contact in its trust profile. When a User of another Customer views your organization’s full trust profile or downloads its evidence, the Service records that event in your organization’s audit log (see Section 6).

We do not use third-party analytics, advertising or tracking services, and we do not purchase personal information from data brokers.

4. How we use information

We use personal information to:

• provide, operate and maintain the Service, including creating accounts, authenticating Users and enforcing each organization’s security settings;
• store, display and share Customer Content as directed by Customers, including publishing public registry entries and making full trust profiles and evidence available to organizations a Customer has approved;
• keep audit records that Customers can review and export, and that we use to investigate security incidents and misuse;
• detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms of Service, including rate limiting of the API;
• review reports that organizations make about each other, ask the reporting organization for clarification, and enforce our Terms of Service, including by removing content and suspending or closing accounts, and detect abuse of the reporting feature;
• manage subscriptions: know which organizations have one, unlock the features it includes, and follow payments, renewals, cancellations, refunds and chargebacks reported by Paddle, which processes the payments, issues invoices and receipts, and collects and remits taxes;
• respond to support requests and communicate with Customers and Users about the Service, including service, security and legal notices;
• send emails the Service needs to work: confirming your email address, password reset links and invitations; notices about your own account (for example a role change or a new password); and notices about your organization’s activity (for example approvals and publication of its trust profile, trust and partner requests, support tickets and its subscription) to the people involved and to the organization’s root account. These are part of the Service, not marketing;
• maintain, troubleshoot and improve the Service; and
• comply with legal obligations, enforce our agreements and establish, exercise or defend legal claims.

We do not sell personal information, we do not use Customer Content to train artificial intelligence models, and we do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

5. Legal bases for processing

Where the GDPR or UK GDPR applies to our processing as a controller, we rely on the following legal bases: performance of a contract (to provide the Service to Customers and their Users); our legitimate interests in operating a secure, reliable and accountable business platform, maintaining audit trails, preventing abuse and improving the Service, which we balance against your rights; compliance with legal obligations; and, where we ask for it, your consent, which you may withdraw at any time. Under Canadian law, we collect, use and disclose personal information with your knowledge and consent, which may be implied where appropriate for business contact information used in a business context, or as otherwise permitted or required by law.

6. Who can see your information on the Service

• Anyone on the internet can see an organization’s public registry entry: its name, logo, company identifier, the listing date and, once a trust profile is published, its legal entity name, trade name, legal form, jurisdiction, operational status, website and business classification. Anyone can find organizations by name using the registry search.
• Members of your organization can see its trust profile, evidence and trust relationships. Administrators can also see team members, pending invitations, the audit log, settings, API tokens and the subscription and its payment history; members with the Billing user role see only the dashboard, the subscription and support.
• Organizations your organization approves can view your organization’s full published trust profile and evidence, and download evidence files, until the approval is revoked. Approval works in one direction only.
• Audit logs of other organizations. When you view another organization’s full trust profile or download its evidence, your name, email address, organization, IP address and user agent are recorded in that organization’s audit log, which it controls.
• API integrations. Developers holding an API token issued by an administrator of your organization can retrieve, through the API, the same information that administrator can see.
• Reports. A report your organization files, and the conversation with us about it, can be seen by members of your organization who can contact support, and by our staff. The organization you report is not told who reported it.
• Inactive profiles. If your organization’s subscription ended more than the grace period ago (Terms of Service, Section 11.5), other organizations and the public registry see that its trust profile is inactive instead of the profile itself, and trust relationships give no access in either direction until it subscribes again.
• Suspensions. If we suspend your organization, organizations with a trust relationship with it see that it is suspended and the reason we give; everyone else sees only that it is suspended. If we suspend an individual account, that organization’s administrators see the suspension and its reason.

Revoking a trust relationship stops further access through the Service, but cannot recall copies that the other organization has already downloaded, printed or otherwise retained.

7. When we disclose information

We disclose personal information only as follows:

• As directed by Customers, through the sharing features described in Section 6.
• Reports. We do not disclose the identity of a reporting organization or User to the organization they reported, except where required by law or to establish, exercise or defend legal claims (for example where a report proves knowingly false).
• Paddle (Paddle.com Market Limited and its affiliates), our reseller and merchant of record for subscriptions. When you subscribe, we pass Paddle your organization’s identifier and your email address to start the checkout, and you give Paddle your billing and payment details directly. Paddle processes them as an independent controller under its own privacy notice, and tells us the outcome (for example that a payment succeeded or was refunded). Paddle’s checkout and customer portal are served from Paddle’s own websites, which receive your IP address and browser information.
• Service providers who host, store, secure and deliver the Service on our behalf (for example cloud infrastructure and storage providers), under written obligations to protect the information and to use it only to provide services to us. The Service’s icon font is delivered by the jsDelivr content delivery network, which receives your IP address and browser information when it serves that file. Emails are sent through Amazon Simple Email Service, operated by Amazon Web Services, which processes the recipient’s name and email address and the content of each email; the images in our emails are served by Amazon CloudFront, which receives the reader’s IP address and email client information when they load.
• Legal requirements, where we believe in good faith that disclosure is required by law, regulation, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of LamWorks, our Customers, Users or others. Where legally permitted, we will notify the affected Customer before disclosing its Customer Content.
• Business transfers, to a successor in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to this policy or equivalent protections.
• With consent, or at the direction of the individual concerned.

8. Cookies and similar technologies

The Service uses only cookies that are strictly necessary for it to work. It does not use advertising, analytics or cross-site tracking cookies. Paddle’s checkout and customer portal, which open only when you subscribe or manage billing, are served by Paddle and may use their own cookies, as described in Paddle’s privacy notice.

You can block cookies in your browser, but the Service will not work without them.

9. Where information is stored and international transfers

We host the Service’s data in Canada. Our service providers, Paddle (for subscription payments), and organizations with which Customers choose to share information, may be located in, or access information from, other countries whose data protection laws may differ from those of your country. Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (the European Commission has recognized Canada as providing adequate protection for personal data subject to PIPEDA) or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. While information is in another jurisdiction, it may be accessible to that jurisdiction’s courts, law enforcement and national security authorities.

10. How long we keep information

• Customer Content is kept for as long as the Customer’s organization exists on the Service. Customers can delete evidence files at any time.
• Deleting an organization permanently deletes, immediately, its trust profiles, evidence files, invitations, trust relationships, support tickets and attachments, API tokens, subscription history, audit log and the accounts of all its members, and cancels its subscription.
• Removed team members. When an administrator removes a member, the account is deactivated and can no longer sign in; its details remain part of the organization’s records until the organization is deleted or deletion is requested under Section 12.
• Email records (to whom we sent each email, its subject and content, when, and the mail service’s confirmation that it accepted it) are kept while the organization exists, so we and the organization can check what was sent, and are deleted with it. The content of emails with a personal sign-in link (email confirmation, password reset, invitation) is deleted as soon as the email is sent.
• Subscription records (the subscription history, refunds and chargebacks we keep) are kept while the organization exists and are deleted with it; deleting the organization also cancels its Paddle subscription. Our staff activity log keeps the record of subscriptions we gave or ended (see Enforcement records). Invoices, payment and tax records are kept by Paddle, as merchant of record, for as long as tax and accounting laws require, under Paddle’s privacy notice.
• Audit records are kept for the life of the organization so that the organization keeps a complete and tamper-evident history. Records about your actions kept in another organization’s audit log are retained by that organization.
• Reports. Reports your organization files are kept while it exists and are deleted with it. Reports other organizations filed about your organization are kept after it is deleted, so that those organizations keep our decision, and are deleted on request where we no longer need them.
• Enforcement records. Our staff activity log, which records the actions our staff take (including content removals, suspensions and report decisions), is append-only and kept after an organization is deleted, for as long as we need it to show accountability, resolve disputes, prevent repeated abuse and comply with legal obligations.
• Backups and logs. Residual copies in backups and technical logs are deleted or overwritten in the ordinary course, and in any event within 90 days, unless a longer period is required by law.

We may retain information for longer where necessary to comply with legal obligations, resolve disputes or enforce our agreements.

11. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, described in our Security Overview. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, or that otherwise requires notification, we will notify affected Customers, individuals and regulators as required by applicable law.

12. Your rights and choices

Depending on where you live, and subject to legal exceptions, you may have the right to:

• access the personal information we hold about you and obtain a copy of it;
• correct inaccurate or incomplete information;
• have your information deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your information in a portable format;
• withdraw consent where we rely on it, without affecting processing that took place before withdrawal; and
• lodge a complaint with a data protection authority.

You can update your name, title, profile picture, password and MFA settings yourself under Account settings. To exercise any other right, contact our Privacy Officer at privacy@bordershub.com. We will verify your identity before acting on a request and respond within the period required by applicable law (generally within 30 days). For personal information contained in Customer Content, we will refer your request to the Customer that controls it and assist that Customer in responding. We will not discriminate against you for exercising your rights.

13. Additional information for U.S. residents

In the past 12 months we have collected the categories of personal information described in Section 3 (identifiers, professional or employment-related information, internet or other electronic network activity information, and any personal information Customers include in Customer Content), from the sources and for the business purposes described in Sections 3 and 4, and disclosed them to the categories of recipients described in Sections 6 and 7. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. You may use an authorized agent to make a request on your behalf, subject to verification.

14. Children

The Service is intended for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children.

15. Changes to this policy

We may update this policy from time to time. We will post the updated policy with a new effective date and, if the changes are material, we will give Customers reasonable advance notice through the Service or by email.

16. Contact us and complaints

Questions, requests and complaints about this policy or our privacy practices can be sent to our Privacy Officer at privacy@bordershub.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or the data protection authority where you live or work.