GDPR Compliance

Our Commitment to Data Protection

Preside, developed and operated by Global Board Institute, is an AI-powered board management platform that serves organizations across the United States, United Kingdom, European Union, Gulf Cooperation Council, Canada, and Australia. We handle sensitive governance data including board meeting materials, documents, voting records, e-signatures, and communications on behalf of the organizations that use our platform.

Compliance with the General Data Protection Regulation (GDPR) is fundamental to the design and operation of Preside. We recognize that the organizations we serve entrust us with highly confidential governance information, and we take that responsibility seriously. GDPR compliance is not an afterthought, it is woven into every aspect of our platform architecture, operational processes, and organizational culture.

As a data processor, Preside processes personal data on behalf of the organizations (data controllers) that use our platform. We are committed to providing our customers with the tools, transparency, and contractual assurances they need to meet their own GDPR obligations, and to upholding the highest standards of data protection for all individuals whose data passes through our systems.

Lawful Basis for Processing

Under the GDPR, all processing of personal data must be grounded in a lawful basis. Preside relies on the following legal bases depending on the nature and context of the processing activity:

Data We Process

In the course of providing board management services, Preside processes the following categories of personal data:

Data Controller vs Data Processor

Under the GDPR, the distinction between data controllers and data processors is critical. In the context of Preside:

• Organizations (Data Controllers): The organizations that subscribe to Preside are the data controllers. They determine the purposes and means of processing personal data relating to their board members, officers, and other individuals whose data is managed through the platform. Organizations are responsible for ensuring they have a lawful basis for the data they input into Preside and for informing their data subjects about how their data is used.
• Preside / Global Board Institute (Data Processor): Preside acts as a data processor, processing personal data on behalf of and under the instructions of the data controller organization. We process data only as necessary to provide the board management services described in our agreements and as instructed by the controller.

A comprehensive Data Processing Agreement (DPA) is available to all customers and is executed as part of our enterprise agreements. The DPA sets out the terms under which Preside processes personal data, the obligations of each party, and the technical and organizational measures in place to protect that data.

Your GDPR Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction that has adopted GDPR-equivalent protections, you have the following rights with respect to your personal data:

How to Exercise Your Rights

To exercise any of the rights described above, please contact our Data Protection Officer at dpo@presideos.com. When submitting a request, please include:

• Your full name and the email address associated with your Preside account.
• The name of the organization through which you access Preside.
• A clear description of the right you wish to exercise and the specific data concerned.
• Any supporting information that will help us locate and process your request efficiently.

We will acknowledge receipt of your request within five business days and will respond substantively within 30 days, as required by the GDPR. In exceptional circumstances where the complexity or volume of requests requires additional time, we may extend this period by up to 60 additional days, and we will inform you of any such extension and the reasons for it.

To protect your privacy and the security of personal data, we may need to verify your identity before processing your request. This verification may involve confirming your email address, asking security questions, or requesting a copy of a government-issued identification document.

If you access Preside through an organization, we may refer your request to your organization (the data controller) where appropriate, as the controller may be best positioned to respond to your request regarding the data they manage.

Data Protection Officer

Global Board Institute has appointed a dedicated Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy, ensuring compliance with the GDPR and other applicable data protection laws, and serving as the point of contact for data subjects, supervisory authorities, and customer organizations on all matters relating to data protection.

Our DPO can be reached at:

The DPO operates independently within the organization and reports directly to executive management. You may contact the DPO at any time with questions, concerns, or requests relating to the processing of your personal data or your rights under the GDPR.

International Data Transfers

Preside serves organizations globally, and in the course of providing our services, personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or the United Kingdom. We ensure that all international transfers of personal data are conducted in compliance with the GDPR and provide an adequate level of protection through the following safeguards:

• Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses as the primary mechanism for transfers of personal data to countries that have not received an adequacy decision. Our SCCs are incorporated into our Data Processing Agreements and sub-processor agreements.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission confirming that a third country provides an adequate level of data protection. We monitor developments in adequacy decisions and adjust our transfer mechanisms accordingly.
• UK International Data Transfer Agreement (IDTA): For transfers subject to the UK GDPR, we implement the UK IDTA or the UK Addendum to the EU SCCs as appropriate.
• Supplementary Measures: In addition to contractual safeguards, we implement technical and organizational supplementary measures, including encryption of data in transit and at rest, pseudonymization where feasible, and access controls that limit data access to authorized personnel.

Our primary data processing infrastructure is hosted in the European Union and the United States. Customers may request information about the specific locations where their data is processed by contacting our Data Protection Officer.

Data Processing Agreement

Preside offers a comprehensive Data Processing Agreement (DPA) to all customers, which is available upon request and is included as part of our enterprise subscription agreements. Our DPA fully addresses the requirements of Article 28 of the GDPR, including:

• The subject matter, duration, nature, and purpose of the processing.
• The types of personal data processed and categories of data subjects.
• The obligations and rights of the data controller.
• Preside's obligations as a data processor, including processing only on documented instructions from the controller.
• Confidentiality commitments for all personnel with access to personal data.
• Technical and organizational security measures implemented to protect personal data.
• Conditions for engaging sub-processors, including prior notification and approval mechanisms.
• Assistance with data subject rights requests and data protection impact assessments.
• Data return and deletion obligations upon termination of the agreement.
• Audit rights enabling the controller or an independent auditor to verify compliance.

To request a copy of our DPA or discuss data processing terms, please contact dpo@presideos.com.

Security Measures

In accordance with Article 32 of the GDPR, Preside implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk involved in processing personal data. Given the sensitive nature of board governance data, we maintain rigorous security standards including:

• Encryption: All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption. Encryption keys are managed through dedicated key management services with automatic key rotation.
• Access Controls: Role-based access control (RBAC) ensures that users can only access data and functionality appropriate to their role. Multi-factor authentication (MFA) is available for all accounts and is enforced for administrator accounts. Single Sign-On (SSO) integration via SAML 2.0 and OIDC is supported for enterprise customers.
• Audit Logging: Comprehensive server-side audit logs record all significant actions within the platform, including document access, votes, login events, permission changes, and administrative actions. Audit logs are retained in accordance with customer requirements and applicable regulations.
• Incident Response: We maintain a documented incident response plan that includes identification, containment, eradication, recovery, and post-incident review procedures. Our security team conducts regular incident response drills and tabletop exercises.
• Regular Security Assessments: We conduct periodic penetration testing by qualified third-party security firms, regular vulnerability scanning, code security reviews, and internal security audits. Findings are tracked to resolution with defined remediation timelines.
• Infrastructure Security: Our cloud infrastructure is hosted with providers that maintain SOC 2 Type II, ISO 27001, and other relevant certifications. We leverage network segmentation, intrusion detection systems, and automated threat monitoring.
• Personnel Security: All employees and contractors with access to personal data undergo background checks, sign confidentiality agreements, and complete mandatory data protection training upon onboarding and annually thereafter.

Data Breach Notification

In compliance with Articles 33 and 34 of the GDPR, Preside has established robust procedures for detecting, reporting, and responding to personal data breaches:

• Notification to Supervisory Authorities (Article 33): In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Preside will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, the approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.
• Notification to Data Controllers: As a data processor, Preside will promptly notify affected data controller organizations of any personal data breach without undue delay upon becoming aware of it. We will provide sufficient detail to enable the controller to assess the breach and fulfill its own notification obligations.
• Notification to Data Subjects (Article 34): Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will assist the data controller in communicating the breach to affected data subjects, describing the nature of the breach and the steps individuals can take to protect themselves.
• Breach Documentation: All personal data breaches are documented, including the facts relating to the breach, its effects, and the remedial actions taken. This documentation is maintained to demonstrate compliance and to support continuous improvement of our security posture.

Privacy by Design

In accordance with Article 25 of the GDPR, Preside is built on the principles of data protection by design and by default. These principles are embedded in our product development lifecycle and operational processes:

• Data Minimization: We collect and process only the personal data that is necessary for the specific purposes of board management. Our platform is designed to avoid the collection of excessive or unnecessary data, and we regularly review our data collection practices to ensure they remain proportionate.
• Purpose Limitation: Personal data is processed only for the specific, explicit, and legitimate purposes for which it was collected. We do not repurpose governance data for unrelated activities such as advertising, profiling for third-party benefit, or any purpose incompatible with the original collection purpose.
• Storage Limitation: We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable legal and regulatory retention obligations. Our data retention policies are clearly defined, and automated deletion processes are in place to purge data that is no longer needed.
• Default Privacy Settings: Preside is configured with privacy-protective default settings. New features are launched with the minimum necessary data processing, and additional data collection requires affirmative action from the user or administrator.
• Privacy Impact Assessments: We conduct Data Protection Impact Assessments (DPIAs) for new features, services, or processing activities that may present a high risk to data subjects, particularly those involving AI-powered functionality or new categories of data processing.

Sub-Processors

Preside engages a limited number of carefully vetted third-party sub-processors to assist in delivering our services. Each sub-processor is bound by contractual obligations that provide at least the same level of data protection as our own commitments, including compliance with applicable GDPR requirements. Our sub-processors fall into the following categories:

• Cloud Infrastructure: Hosting, storage, and computing services that underpin the Preside platform, located in the EU and US with appropriate safeguards for international transfers.
• Email Delivery: Transactional email services for system notifications, meeting invitations, document sharing alerts, and account-related communications.
• Analytics: Privacy-respecting analytics services used to understand platform usage patterns, diagnose performance issues, and improve the user experience. Analytics data is aggregated and anonymized wherever possible.
• Payment Processing: PCI DSS-compliant payment processors for handling subscription billing. Preside does not store credit card numbers or sensitive payment information on our systems.
• AI and Machine Learning: Providers of AI model infrastructure used to power Preside's meeting summaries, governance insights, and AI Board Advisor features, bound by strict data processing terms.

We maintain a current list of all sub-processors, including their names, purposes, and processing locations. This list is available upon request by contacting dpo@presideos.com. Data controller customers are notified in advance of any intended changes to our sub-processor list and have the right to object to new sub-processors, as detailed in our Data Processing Agreement.

Children's Data

Preside is a professional board management platform designed for use by organizations and their board members, officers, and governance professionals. Our services are not directed at children under the age of 16, and we do not knowingly collect or process personal data from children. If we become aware that personal data of a child under 16 has been inadvertently collected, we will take immediate steps to delete that data from our systems and notify the relevant data controller.

Updates to This Page

We may update this GDPR Compliance page from time to time to reflect changes in our data processing practices, legal requirements, or regulatory guidance. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify our customers and users through the platform or via email. We encourage you to review this page periodically to stay informed about how we protect your personal data and comply with the GDPR.

Contact Information

If you have any questions, concerns, or requests relating to this GDPR Compliance page, our data protection practices, or your rights as a data subject, please contact us:

We aim to respond to all inquiries within five business days and to resolve data protection requests within the timeframes required by applicable law.

Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR or other applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. You may file a complaint with the supervisory authority in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

For individuals in the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO). A list of EU/EEA data protection authorities is available on the European Data Protection Board website. We encourage you to contact us first at dpo@presideos.com so that we may address your concern directly, though this does not affect your right to lodge a complaint with a supervisory authority at any time.