Greenboard procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You may exercise your rights with respect to your personal information as set forth in the "Your Rights and Choices" section of this Privacy Policy. You may also have the right to lodge a complaint with the data protection authority in your jurisdiction if you believe that a violation of applicable data protection law in your jurisdiction has occurred. All personal information collected via the Site will be stored on servers. We may transfer your personal information to recipients (including third party service providers) in countries other than the country in which the information originally was collected. Those countries may not have the same data protection laws as the country in which you initially provided the information. When your information is transferred to recipients in other countries (such as the U.S.), it will be protected as described in this Privacy Policy and we will comply with applicable legal requirements providing adequate protection for the transfer of personal information to recipients in countries other than the one in which you provided the information.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We provide you with choices regarding the use of your personal information for marketing and promotional purposes. Subject to applicable law, you may have the right to: Request access to your personal information; Correct or amend your personal information; Request the deletion of your personal information; Request restrictions on the use of your personal information or object to or request that we refrain from processing your personal information; Request the transfer of your personal information to a third party you select; Request the following information be disclosed to you: the categories of personal information collected about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or selling the personal information, the categories of third parties with whom personal information has been shared, the specific pieces of personal information collected about you; and” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Not receive discriminatory treatment for the exercise of any of the foregoing rights. Where we have restricted the processing of your personal information at your request, we will notify you before the restriction is lifted. To make a request with respect to your personal information, please contact us by email at [email protected] . In order to protect your privacy and security, your identity must be verified prior to completing any request that you may submit with respect to your personal information. You may be asked to provide certain information already collected from you to confirm that it matches our records so please include the following information in all requests: first name, last name, email address, physical address (to identify the jurisdiction in which you live), a description of the request being made, and "Privacy" in the subject line. While reasonable efforts will be made to accommodate your request, certain restrictions and requirements may be imposed on such requests, as permitted or required by applicable law. You may designate an authorized agent to make a request on your behalf pursuant to this Privacy Policy or applicable law. Prior to completing a request made by such an authorized agent, your authorized agent must provide a copy of written permission from you to submit such a request on your behalf.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ To the extent permitted by applicable law, we retain your personal information as long as needed for the purposes for which it was provided or there is another lawful basis for retaining the data, such as to comply with applicable laws or regulations, for dispute resolution purposes, to enforce agreements, prevent fraud or for other legitimate purposes. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ For purposes of the GDPR, Greenboard acts as a processor of personal information that is collected by our customers and provided to us in connection with the provision of our Services. When Greenboard acts as a processor, we will process personal information only in connection with our customers' instructions, as permitted or required by law, and in connection with our agreements with such customers. Greenboard, located in the state of New York, USA, is the controller of personal information described in Section 1 of this Privacy Policy. When we act as a controller of your personal information, we process such information as a controller for the purposes described in the "How Personal Information is Used" and "How Personal Information is Disclosed" sections of this Privacy Policy. We use different legal bases under the GDPR to process your personal information. These include processing that is: based on your consent; necessary for the performance of a contract; necessary to comply with a legal, regulatory, tax or other obligation; necessary for our legitimate interests, such as offering products and services based on user interests, improving services, managing relationships and preventing fraud. Where consent is used as a legal basis to process your personal information, you may withdraw your consent at any time by contacting us as described in the "How to Contact Us" section of this Privacy Policy. This will not impact the lawfulness of any processing based on consent prior to its withdrawal. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell, rent or otherwise disclose your Personal Information with any third parties except as described in this Privacy Policy. In some cases, we may disclose your personal information to third-party vendors to help provide services to you, such as hosting services. We may disclose your personal information to these vendors to perform services on our behalf for limited purposes. We may disclose personal information to our affiliates and subsidiaries and to our customers, vendors and other third party business partners. We may also share personal information (1) as required by law or legal process, such as in response to a valid court order or subpoena, (2) in response to a government request or law enforcement investigation, (3) to exercise or defend our legal rights or (4) as necessary or appropriate to prevent physical harm or suspected or illegal activity. We may transfer your information in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation) to the successor of such business or assets. We may also aggregate or anonymize personal information in accordance with applicable law and disclose such aggregated or anonymized information to third parties.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.