1. Who is responsible
The controller is Borderstride Morrow, De Brulen 28, 2370 Arendonk, Belgium, enterprise number 0731.511.147 and VAT BE0731511147.
- Privacy enquiries
- relay@borderstride.com
- Telephone
- +32 474 29 01 04
We have not appointed a data protection officer because we are not legally required to do so. Questions reach the responsible person directly.
2. Visiting borderrelay.com
The introductory website uses no analytics, advertising pixels, tracking scripts or external fonts. The suitability self-check runs only in your browser and its answers are not sent to us.
The web infrastructure may temporarily process ordinary request data such as your IP address, request time, requested page and browser information to deliver the site and protect it against abuse. We do not use this data to build visitor profiles or measure advertising.
3. Contacting us
The contact form on borderrelay.com does not submit information to the website. It composes a message in your own email application. If you choose to send that message, we receive the name, company, country, website and message you included.
We use this information to answer your enquiry and assess whether a potential business relationship makes sense. The legal basis is our legitimate interest in responding to a request initiated by you. Enquiries that lead nowhere are deleted after twelve months.
4. Buying through relay.borderstride.com
When you buy through the operational BorderRelay service, we process:
- Name, email address and country
- For business purchases: company name and VAT number
- Product, amount, currency and purchase date
- Payment reference and payment status
- Invoice and VAT treatment
- Your withdrawal-waiver choice and timestamp
We never receive or store your card number. Card data is entered directly with the payment provider; we receive a transaction reference and result.
5. Why we process purchase data
- Contract · Article 6(1)(b) GDPR
- To conclude the sale, arrange delivery, handle withdrawal or complaints and issue refunds.
- Legal obligation · Article 6(1)(c)
- To issue and retain invoices and meet Belgian VAT and Union OSS obligations.
- Legitimate interests · Article 6(1)(f)
- To prevent fraud, secure the service, answer enquiries and investigate incidents.
- Payment and disputes · Articles 6(1)(b) and (c)
- To process payment references and provide evidence when a payment is disputed.
6. Who else receives data
- The payment provider, acting as a separate controller for payment data
- The product supplier, receiving the minimum information necessary to deliver access and support
- Our email provider, acting as processor for invoices and service notifications
- Our accountant and competent tax authorities where legally required
We do not sell personal data, share it for advertising or enrich it with purchased marketing data.
7. Transfers outside the EEA
A supplier may be established outside the European Economic Area. Where no adequacy decision applies, necessary transfers are governed by the Standard Contractual Clauses under Implementing Decision (EU) 2021/914 and supported by a transfer impact assessment and appropriate safeguards. You may request information about the safeguards applicable to your purchase.
8. Retention
- Invoices and accounting records
- Ten years from the end of the year in which the invoice was issued.
- Order and delivery data
- Until support needs and applicable payment-dispute windows have ended.
- Withdrawal-waiver record
- Retained with the invoice as evidence of the agreed delivery choice.
- Support correspondence
- Two years after the matter is closed.
- Unsuccessful enquiries
- Twelve months.
- Security and access logs
- Only as long as needed to protect and investigate the service.
9. Your rights
You may request access, correction, deletion, restriction or portability and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it. Write to relay@borderstride.com. We normally respond within one month and may verify your identity before disclosing data.
Where statutory retention applies, we can restrict use but cannot delete the record before that period ends.
10. Complaints, security and automated decisions
You may complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, or to the supervisory authority in your own country.
The operational application runs on dedicated infrastructure, uses two-factor access control, field-level encryption, encrypted backups and tamper-evident audit logging. We make no solely automated decisions that produce legal or similarly significant effects. Automated checks may flag a transaction, but a person decides what happens next.
11. Changes
We update this statement when our processing changes. Material changes affecting existing buyers are communicated directly rather than only republished.