1. Data Controller and EU Representative

Borderless Business LLC, a US-based entity (operating Tu Apostilla and DigitalNomadInSpain.org), is the Data Controller for the purposes of your FBI Identity History Summary check and associated document procurement services.

As we do not have a physical establishment in the European Union, we have appointed an EU Representative pursuant to Article 27 of the General Data Protection Regulation (GDPR) to act as our local point of contact for data subjects and regulatory authorities.

2. Purpose and Legal Basis for Processing

To facilitate your request for an FBI background check, we process your biometric data (fingerprints).

• Legal Basis (Explicit Consent): We rely on your Explicit Consent pursuant to Article 9(2)(a) GDPR for the processing of biometric data.
• Contractual Necessity: The processing is also necessary to fulfill our service agreement with you pursuant to Article 6(1)(b) GDPR.

3. International Data Transfers (EU to USA)

Your fingerprints are captured by our authorized local service provider in the European Union. These identifiers are immediately encrypted and transferred to our secure servers in the United States and subsequently to the Federal Bureau of Investigation (FBI).

Safeguards: To ensure a level of protection equivalent to the GDPR, we utilize the European Commission’s Standard Contractual Clauses (SCCs) (Module 2: Controller-to-Processor) as the legal mechanism for this transfer.

4. Local Processing & “Zero-Retention” Protocol

Our European service providers act as Data Processors and operate under our strict instructions. To minimize your data risk, our protocol requires the immediate deletion of your biometric files from the local capture device once the encrypted transfer to the United States is confirmed.

No local copy of your fingerprints is retained in the European Union.

5. Data Retention & Your Rights

We retain your biometric data only for the time required to complete the submission to the FBI. Once the background check is processed, the biometric images are purged from our systems.

You have the right to access your data, withdraw your consent, or request erasure by contacting our EU Representative.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact. Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data).