1.1 Terms governing our services
These terms, together with your Order Form as updated from time to time, set out the basis on which the Vendor shall provide you with services. The most up‑to‑date terms will always be available on the Vendor’s website (https://binderr.com/terms-of-service). You agree to be bound by the terms available on the Vendor website.
In the event of a conflict between these terms and your Order Form (as updated from time to time), these terms shall prevail.
1.2 Effective date
These terms are effective as of the date you first click “I agree” (or a similar button or checkbox) or use or access the services. These terms do not need to be signed to be binding. You indicate your agreement by clicking “I agree” (or a similar button or checkbox) when you complete your Order Form.
2.1 Fees
You will compensate the Vendor for the services at the rates detailed in the Order Form.Fees are variable, and the Vendor will inform you of any changes from the initial fees documented in your Order Form.
2.2 Subscription term and renewals
The Vendor provides services on a subscription basis for a term or duration recorded in the Order Form.Except as otherwise specified in the Order Form, unless either party cancels in accordance with these terms prior to expiration of the subscription term, your term will automatically renew for another period equal to your initial term. As noted above, fees may increase and you will be informed of the new fees.
2.3 Invoices
Invoices are payable in the currency indicated in the Order Form within 30 days of the invoice date. We reserve the right to charge interest at the highest amount permitted by law (currently 8%) on amounts outstanding for more than 30 days.
We may stop providing services to you where an invoice is not paid within 30 days of the invoice date, without prejudice to our right to recover due amounts, however we will seek to discuss this with you before stopping provision of services.
Payment must only be made to the bank account printed on our invoice. Any communication received by you seeking to redirect such a payment is likely to be fraudulent. Please contact us immediately if you receive any such communication, and only using the telephone number on which you usually contact us (not any number contained in the suspect communication).
3.1 Your data
Your signed Order Form and these terms constitute your instruction to the Vendor to process your customer data in connection with the services. Data processing shall be regulated in accordance with the Data Processing Agreement (the “DPA”) in the Appendix.
In addition to processing your customer data, you acknowledge and agree that we will also collect certain data and information about you and your End Users in connection with your use of the services and otherwise in connection with these terms.
Strictly anonymised data may be used to develop and improve our services. We use analytics techniques to better understand how our services are used.
3.2 Data ownership and access rights
All data uploaded, stored, or processed within the Binderr platform, whether personal or business, remains your sole property. Binderr acts solely as a data processor and custodian.
3.3 Your data obligations
You and your use of the services (including by your End Users) must comply at all times with these terms and all laws. You represent and warrant that:
3.4 Your personal information
We are committed to protecting and respecting your privacy and we will only use your information in accordance with:
Our Privacy Notice explains the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read it carefully to understand our practices regarding your personal data and how we will treat it. A copy is in the Appendix. You will be notified of any significant updates.
3.5 Confidentiality
Confidentiality of your services will be maintained except:
In all such cases, we shall reveal only such information as is considered necessary and you consent to the disclosure.
3.6 Data loss
Where you ask us to use particular communication apps or social media, hosting, data processing and document storage/sharing technology of your choice rather than ours, you will be liable for any consequences of such use, including fines, financial loss, data loss or breach of confidentiality undertakings you may have given to another party.
3.7 Security and certifications
We implement and maintain physical, technical and administrative security measures designed to protect your data from unauthorised access, destruction, use, modification, or disclosure. These measures include, without limitation, encryption of data at rest and in transit, regular security audits, access controls, and employee training. We also maintain a compliance program that includes independent third‑party audits and certifications.
4.1 Administrators
You may be able to specify certain End Users as Administrators, who will have important rights and controls over your use of the services and End User accounts, including taking actions that may incur additional fees; creating, de‑provisioning, monitoring or modifying End User accounts; setting End User permissions; and managing access to your data. You are responsible for whom you allow to become Administrators and any actions they take. Our responsibilities do not extend to the internal management or administration of your access to the services.
4.2 End User consent
You are responsible for providing all required disclosures to, and obtaining and maintaining all required consents from, End Users to allow:
4.3 End User responsibility
Our services have various user onboarding flows. Some require users to be designated by Administrators; some allow users to sign up for individual accounts which can later become associated with teams or organisations; some may allow users to invite other users. You are responsible for understanding the settings and controls for each service you use and for controlling who may become an End User.
If payment is required for End Users to use or access the services, we are only required to provide the services to those End Users for whom you have paid the applicable fees, and only such End Users may access and use the services.
Some services may allow you to designate different End User types (e.g., with different access levels). Pricing and functionality may vary by End User type. You are responsible for compliance with these terms by all End Users, including any payment obligations.
You are responsible for the activities of all End Users, including all additional fees and how End Users use your data, even if those End Users are not from your organisation or domain.
4.4 End User security
You must require that all End Users keep their user IDs and passwords strictly confidential and do not share them with any unauthorised person. User IDs are granted to individual, named persons and may not be shared. You are responsible for any actions taken using End User accounts and passwords and agree to immediately notify us of any unauthorised use of which you become aware.
5.1 Access
Subject to these terms and during the applicable term specified in your Order Form (as updated from time to time), you may access and use the services for your own business purposes in accordance with these terms, the applicable Order Form and, where applicable, Vendor documentation.
5.2 Support
During the service term specified in your Order Form, we will provide support for the services.
5.3 Restrictions
Except as otherwise expressly permitted, you will not:
5.4 Warranty disclaimer
The services, software and tools are provided “as is,” without warranties of any kind, whether express, implied or statutory, including without limitation any implied warranties of merchantability or fitness for a particular purpose. The Vendor does not warrant that the functions of the services or tools will meet your requirements or that the services will be error‑free or uninterrupted.
5.5 Reliance
The Vendor makes no warranties for services or information accessed by you through use of the services. Binderr provides tools to access information provided by third parties which may assist you in fulfilling your compliance obligations; however, the Vendor is not responsible for the reliability of any information provided by third parties and you are solely responsible for conclusions you reach through the use of the services. Information you access through the services is not updated in real time and, as such, accuracy may be affected. This is outside the Vendor’s control and responsibility.
Subject to these terms, you may purchase additional services that we will provide pursuant to the applicable Order. Additional services may be subject to additional policies and terms (including fees) as specified by us.
Please discuss any concerns about any aspect of our services with your Relationship Manager. We shall try to resolve any problem quickly through our internal complaints procedure, a copy of which is available on request.
Unless you instruct us otherwise, you expressly consent to our communicating with you by email.
8.1 General risks
There are inherent risks associated with communication by internet‑based systems (e.g., email, SMS and mobile apps). We deploy various means to prevent such cyber threats and regularly review them; however we assume no responsibility or liability for damages or costs incurred by you due to such occurrences.
Please ensure you have proper means of checking for viruses and other malware in any emails and attachments, especially those received from third parties. We will be entitled to regard any email address you provide as secure and to assume you consent to the associated risks.
8.2 Our emails to you
We cannot accept responsibility for the accuracy or completeness of the content of emails or any attachments once they have left our server (including any corruption or alteration that may occur after sending).
Most businesses have experienced a situation where a client or third‑party email account has been hacked, and a scam email is sent seeking to redirect a payment to a new account.
Payment must only be made to the bank account printed on our invoice. Any communication received by you seeking to redirect such a payment is likely to be fraudulent. Please contact us immediately if you receive any such communication, and only using the telephone number on which you usually contact us (not any number contained in the suspect communication).
8.3 Unintended consequences
We may use software intended to filter unsolicited or undesirable emails and this may inadvertently reject legitimate emails from you. We cannot accept liability where emails do not reach their intended recipient because of such software.
You agree to bring any claim (including negligence) in connection with the services provided by the Vendor only against the company and not against any individuals or other Vendor Group entities. In the event that you pursue any officer or employee of the Vendor or of any Vendor Group entity, they will be entitled to rely on these terms.
Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or invalidity thereof, shall be settled by arbitration, in accordance with Part IV (Domestic Arbitration) or Part V (International Arbitration) of the Malta Arbitration Act and the Arbitration Rules of the Malta Arbitration Centre as in force at the time of the claim. In other jurisdictions this will be under similar jurisdictional laws as applicable.
Our liability to you in relation to our services is subject to a limit of three (3) months’ fees applicable pursuant to your Order Form. That limit applies to any liabilities, losses, damages or costs.
Unless otherwise agreed in writing, we shall only ever be liable to you in relation to our services and not to any third party and no such third party will be entitled to enforce the terms of this agreement. We assume no liability for any act or omission attributable to another party.
We shall not be liable to you if we are unable to perform our services due to a cause beyond our reasonable control. In the event of any such occurrence affecting us, we shall notify you as soon as reasonably practicable.
No amendment, variation, rescission or termination of this agreement will require the consent of any person who is not a party to it.
You agree to enter into this Agreement for the Minimum Service Term which is always 12 months, and hence to pay the applicable minimum fees for that period, irrespective of early termination. Without prejudice and subject to the payment of the minimum fees, both you and the Vendor may terminate the provision of services at any time by written communication giving 30 days’ notice.
We may cease to provide services if you are in breach of our terms, there is a breakdown in our relationship, if continuing to act would cause us an issue in relation to any other services we may provide or have provided, or if you do not pay any invoice in accordance with these terms.
If our relationship is terminated, you will pay our fees incurred up to the date of termination. If you fail to pay our fees we will be entitled to charge interest at the judgment debt rate. Where we obtain a court order to compel payment of our fees together with interest, we will also be entitled to recover the costs of obtaining and enforcing such order.
In the event of termination for any reason, the terms of our agreement will remain in force regarding payments, confidentiality, data protection, liability and files/documents.
11.1 Applicable law and jurisdiction
These terms (including this paragraph) and our Order Form and any dispute or claim concerning them shall be governed by Maltese law excluding conflict of laws principles. By your agreement to these terms by clicking “I agree” (or similar) at the time you complete your Order Form, both we and you submit to the non‑exclusive jurisdiction of the Maltese Courts.
11.2 Elective arbitration
Notwithstanding clause 11.1, we may, at our sole option, elect in writing to have any dispute determined by arbitration. Any arbitration commenced in accordance with this clause will be subject to Part IV (Domestic Arbitration) of the Malta Arbitration Act, 1996 and the Arbitration Rules of the Malta Arbitration Centre in force at that time. The number of arbitrators shall be one.
11.3 Entire agreement
These terms and our Order Form constitute the entire agreement between the parties in relation to the services we provide. It replaces any earlier terms, representations or discussions.
11.4 Vendor Group
The following companies are wholly owned subsidiaries of Binderr Limited: Binderr Operations Limited and Binderr Mena Electronic Brokerage LLC.
If any provision of the agreement is held to be void, then that provision will be deemed not to form part of the agreement and the remaining provisions will continue in force.
In these terms, the following words and expressions have the meanings given below:
Most personal information we process is provided by you in connection with our services under these terms. We also receive personal information indirectly, from companies and individuals that you introduce to us, or where you have requested they use the Vendor’s services.
We use the information to provide our services to you, including assisting you to fulfil your own policy requirements when onboarding clients.
Your information is securely stored. We will keep your personal information for as long as you are a client. After you stop being a client, we may keep your data for a period to:
We regularly review retention periods to ensure data is not kept longer than necessary.
Under data protection law, you have rights including:
There are exemptions and restrictions that may apply to some or all of these rights.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond. Please contact your Relationship Manager.
If you have any concerns about our use of your personal information, you can complain to us at Binderr Limited, Ortigia, Tal Ferha, Limit ta’ Gharghur, GHR 1821, Malta or email privacy@binderr.com.
You can also raise concerns with the Office of the Information and Data Protection Commissioner: https://idpc.org.mt/contact/
IntroductionYour signed Order Form and these Terms of Service constitute your instruction to the Vendor to process your customer data in connection with the services. This Data Processing Agreement ("DPA") regulates that processing. You and the Vendor agree that this DPA sets forth obligations with respect to the Processing of
Personal Data.
(Controller, Data Importer, Data Exporter, Data Protection Legislation, Data Subject, European Data Protection Legislation, GDPR, Non‑European Data Protection Legislation, Personal Data, Processing, Processor, Pseudonymisation, Standard Contractual Clauses, Sub‑Processor, Supervisory Authority, UK GDPR) — as set out in the original text, unchanged for legal accuracy.
This DPA applies to the Processing of your Personal Data by the Vendor pursuant to the Terms of Service and your Order Form. You are the Controller (except where you act as a Processor or Sub‑Processor, in which case the Vendor acts as your Sub‑Processor). Nothing alters the Vendor’s role as a Processor with respect to you. This DPA does not limit any data protection commitments in the Terms of Service. You acknowledge the Vendor’s security practices provide a level of security appropriate to the risk.
3.1 Data Subjects — determined and controlled by you at your sole discretion; may include your representatives, end users, employees, contractors, collaborators, clients, prospects and customers, and their personnel.
3.2 Categories of Personal Data — determined by you; may include first and last name, employer, role, title, and contact information.
3.3 Special categories of Personal Data — will not be processed by the Vendor; you agree never to share such data with the Vendor.
3.4 Processing operations — the Vendor shall Process Personal Data only: (i) to provide the services in accordance with your documented instructions; and (ii) for business operations incidental to providing the services (e.g., delivering functional capabilities, preventing/detecting/repairing problems including Security Incidents, and providing support, planning, advice and guidance).
4.1 Processing Personal Data — the Vendor will: (i) process only on documented instructions (including transfers), unless required by law; (ii) inform you if an instruction infringes applicable law and may suspend processing; (iii) ensure persons authorised to process are bound by confidentiality; (iv) provide periodic privacy and security training; (v) implement appropriate technical and organisational measures (including pseudonymisation and encryption; ensuring confidentiality, integrity, availability and resilience).
4.2 Systems and services — restore availability and access to Personal Data in a timely manner; regularly test and evaluate measures; prevent unauthorised access or disclosure; and adhere to conditions for Sub‑Processors (see clauses 6 and 7).
Documented Instructions include the Terms of Service, this DPA and the Order Form. The Vendor shall not retain, use, disclose or otherwise Process Personal Data other than for the purposes set out herein and shall not sell Personal Data.
5.1 Notice — the Vendor shall notify you without undue delay (and in any event within 48 hours) after becoming aware of any Security Incident. Notification may be provided via email to your administrators. You are responsible for your own incident notification obligations. Vendor’s reporting is not an acknowledgement of fault.
The Vendor will investigate, provide information (which may be provided in phases), and take reasonable steps to mitigate effects. If the Security Incident was not due to the Vendor’s fault, reasonable cooperation costs and expenses shall be covered by you. The Vendor will make reasonable efforts to assist with notifications to Supervisory Authorities and Data Subjects. You shall promptly notify the Vendor of any possible misuse or potential security incident related to the services.
The Vendor may engage subcontractors and Sub‑Processors. The Vendor will: (i) provide prior notice of additions or replacements, giving you the opportunity to object; (ii) ensure Sub‑Processors are bound by no‑less‑protective obligations; and (iii) remain fully liable for Sub‑Processor obligations.
Approved Sub‑Processors:
At least 60 days before authorising any new Sub‑Processor, the Vendor shall post notice at www.binderr.com. You may object on reasonable grounds within 30 days, and the Vendor may (at its discretion): cancel use; take corrective steps; or cease providing the particular aspect of the services, with a fee adjustment as mutually agreed. If none of these are reasonably available or agreed within 30 days, either party may terminate the affected services.
7.1 Emergency replacement — the Vendor may urgently replace a Sub‑Processor where necessary and beyond its control, with notice as soon as practicable; you retain the right to object.
The Vendor will reasonably assist with Data Subject requests consistent with the services’ functionality. You are responsible for costs beyond existing functionality. If the Vendor receives a request directly, it will instruct the Data Subject to contact you. Unless prevented by law, the Vendor will notify you without undue delay if a Supervisory Authority makes any inquiry or request for disclosure.
Taking into account the nature of processing and information available, the Vendor shall provide reasonable assistance to ensure compliance with security, notifications, DPIAs, consultations with Supervisory Authorities, and audits (see clause 11).
10.1 Personal Data — the Vendor shall delete or return Personal Data in accordance with mutual agreement, save where retention is required by law (and then only for so long as required).
10.2 Services — you will have the ability to access, extract, and delete Personal Data during the term. The Vendor shall retain Personal Data for 90 days after expiration or termination so you may extract it. After 90 days, the Vendor will disable your account and delete all Personal Data within 30 days (and certify deletion where required), save where retention is required by law. Backups or other media created for disaster recovery/business continuity may be overwritten or remediated in the ordinary course and in any event not longer than 90 days after creation. The Vendor has no liability for deletion of any data as described in this clause.
Where your audit requirements cannot reasonably be satisfied through available reports and documentation, the Vendor shall, not more than once per calendar year, respond to audit requests subject to scope, timing, duration, control/evidence requirements and fees agreed in advance. Audits to be by an independent, accredited firm during business hours with at least 20 days’ notice and subject to confidentiality/security procedures. No access to other customers’ data or systems not involved in your services. You are responsible for all costs and Vendor time. Material findings will be promptly cured. Where SCCs apply, nothing here varies or modifies them. The Vendor shall maintain records of processing as required and make them available upon request.
12.1 Your acknowledgment — you shall comply with all applicable Data Protection Legislation; determine whether the services are appropriate for storage/processing of Personal Data; have the right to transfer or provide access to Personal Data to the Vendor and its Sub‑Processors; are solely responsible for third‑party notification obligations related to a Security Incident; and shall not violate any Data Subject rights.
12.2 Personal Data sharing — the services may enable authorised users to share Personal Data or invite third‑party users. Such third parties may access, view, download, and share Personal Data. Your (and/or your authorised users’) choice to share is solely your responsibility, and the Vendor cannot control third parties with whom you share Personal Data.
The Vendor may modify or supplement this DPA with notice to you if required by a Supervisory Authority or law, to implement SCCs, or to adhere to an approved code of conduct/certification. If such changes render you non‑compliant with applicable law, you may terminate the Terms of Service and receive a pro‑rata refund for prepaid, undelivered services. This DPA is effective upon your use of the services and remains in force while the Vendor processes Personal Data on your behalf.
You acknowledge the Vendor and its Sub‑Processors may process Personal Data outside the EEA and the UK (including where hosting is in the EEA/UK) if necessary to provide the services. The Vendor shall comply with applicable transfer requirements, including SCCs, adequacy decisions, or other appropriate safeguards.
14.1 Location of Personal Data — Personal Data processed by the Vendor shall be stored in the EEA. Sub‑Processors’ personnel in other regions may have access. The Vendor does not control or limit the regions from which you or authorised users may access or process Personal Data.
14.2 Miscellaneous — the Vendor has appointed a DPO, EU representative, and UK representative (as documented in the Privacy Policy at www.binderr.com). If there is a conflict between the Terms of Service and this DPA, the DPA prevails; if between this DPA and the SCCs, the SCCs prevail. Aggregate liability arising out of this DPA and/or the SCCs shall not exceed the limitations in the Terms of Service.
(Condensed summary; populated as in the original text for legal completeness.)
(Parties and description of transfer) — as in the original text, streamlined for readability without altering legal effect.
Security measures implemented by the Vendor (reorganised for clarity; substance unchanged).
Standards — commercially reasonable safeguards protect confidentiality, availability and integrity of Personal Data.
Confidentiality — personnel authorised to access Personal Data are bound by confidentiality or statute.
Training — personnel with access to Personal Data receive annual training.
Backups — 24/7 managed backups; at least daily; retained 90 days in primary and 90 days in secondary site.
Disaster recovery — capabilities designed to minimise disruption; incident management; recovery procedures; periodic testing.
Authentication — complex passwords (minimum XXXX characters) and MFA.
Infrastructure security — hardened builds; host firewalls; anti‑virus; minimal end‑user device software; application allow‑listing; no local admin rights; secure email gateway scanning inbound/outbound/internal mail; URL filtering with category blocks; managed XDR with SIEM integration (incl. AWS, firewalls, email gateway); single sign‑on where supported.
Network controls — network managed by IT; firewalls implemented; minimal on‑prem infrastructure; guest Wi‑Fi segregated; personal devices cannot connect to corporate Wi‑Fi; extensive network access controls in AWS; segregated test and production.
Backup & resilience — encryption at rest/in transit; mix of daily/weekly/monthly backups, 30‑minute snapshots and log shipping; immutable backups off‑site; cloud availability zones; cloud‑native backups; automated failure alerts; documented restore processes; periodic restore testing.
Access control — role‑based access on least‑privilege basis; administrative access limited to IT.Patching & vulnerability management — policy‑driven patching by severity; daily/weekly scans; vendor advisories monitored; XDR threat intel; staged testing; systems management tooling for deployment.
Third‑party access — rare, for support; time‑bound and disabled when no longer needed; confirmation obtained.
Transmission — HTTPS and/or VPN for data in transit.Storage — encryption at rest using ciphers at least as strong as AES‑256 (or equivalent).Backups — backups encrypted and stored in a secondary data centre.
Safeguards — physical access only by formal authorisation; access reviewed periodically.Facilities — Tier 3 (or higher) data centres; protections against power failure, fire and other hazards; limited access to authorised individuals.
Network security — enterprise‑class SIEM; firewalls and additional controls to ensure appropriate network access.Logging — access and use of information systems containing Personal Data are logged.
Malicious software — anti‑malware controls to mitigate accidental/unlawful destruction, loss, alteration, unauthorised disclosure or access.
Asset inventory — maintained for computing equipment and media; access restricted to authorised personnel.
Standards — Binderr Ltd holds the following ISO certification:
AWS data centres used by Binderr have numerous certifications (see provider Trust Portals).Independent assessments — annual independent security assessment.
Business continuity — plan maintained and compliant with ISO 22301.
Practices: Security Awareness Training
The Vendor uses an externally provided security training and awareness platform, which also includes an email phishing simulation component.
Practices: Accountability
Practices: Data Minimisation
The Vendor makes reasonable efforts to ensure only the minimum necessary Personal Data is collected, used, and retained to provide the services.
Practices: Data Quality
Throughout the term of the agreement, clients may amend Personal Data to maintain accuracy and fulfil their data quality obligations.
Practices: Data Retention
The Vendor retains Personal Data in its systems for ninety (90) days after expiration or termination of this agreement, allowing clients to extract their data.
After this 90-day period, the Vendor disables the client account and deletes all Personal Data within thirty (30) days. Where required by law, the Vendor will certify deletion. Data may be retained longer only where legally mandated.
Practices: Portability
During the agreement, clients have the ability to access, extract, and delete their Personal Data within the Vendor’s service.
Practices: Erasure
Upon disposal or removal of storage media, the Vendor destroys, deletes, or otherwise makes Personal Data irrecoverable.
Client data is logically separated from all other Vendor customer data to ensure confidentiality and integrity.