Privacy notice for onboarding

This notice covers onboard.dot.bm, where you choose your services, check your order, sign your agreement and, if you need one, prepare your bank's merchant account application. The dotbm website has its own notice at dot.bm/privacy.

dotbm (Christopher Bennett trading as dotbm) is responsible for your information here. We handle it under Bermuda's Personal Information Protection Act 2016 (PIPA). Questions and requests go to hello@dot.bm.

What we collect

• Your business details: legal and trading name, address, and what the business does.
• The people we deal with: names, job titles, email addresses and phone numbers of your contact and the person who signs.
• Your answers about the services you want, and the prices and terms we agree with you.
• For card payments with a new merchant account: the details and documents your bank's application asks for, such as identity documents and bank account details.
• Your signature and the signing record: who signed, when, and from which IP address.
• What you need to sign in: your email address and the one-time codes we send it.

What we use it for

• To prepare your order, your agreement and your services.
• To prepare your bank's merchant account application, when you ask us to help with one.
• To run the onboarding: sending you links and reminders, and showing you where things stand.
• To keep the records our work together needs, including the signed agreement.

We do not use it for marketing, we do not sell it, and we do not use it to train software.

Where it is kept, and who handles it

• Your answers, your order and your documents are kept by Cloudflare in the European Union. Documents you upload are encrypted before they are stored. Cloudflare also checks that sign-ins come from a person, not a bot.
• Signing happens on sign.dot.bm, which runs on our own server in Helsinki, Finland.
• Backups are copied every day to our own storage in Helsinki, Finland, with a second, encrypted copy in Canada (Backblaze).
• Email we send you goes through Resend, an email delivery company in the United States.
• Your bank receives its application and agreement, filled in from your answers, only as part of the application you asked us to help with.
• After you sign, your business name and the setup work go into our project tool, on our own server in Helsinki.

Inside dotbm, only the people who work on your onboarding and your services see your information.

How long we keep it

• If you do not sign: your answers, prices and order are deleted 90 days after the onboarding closes.
• Documents you upload for the bank are deleted 90 days after the application closes, whether or not you sign.
• If you sign: the signed agreement and its signing record are kept for six years after our work together ends, which is Bermuda's time limit for claims under a contract. Then they are deleted, with your answers, prices and order.
• Backups of the onboarding system keep their copies for up to three years before they are deleted, so a deleted record can remain in an encrypted backup until then. If anything is ever restored from a backup, these deletions are applied to it again.

Your rights

Under PIPA you can ask us for the personal information we hold about you, ask us to correct it, and ask us to stop using it or delete it where the law allows. Email hello@dot.bm. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner for Bermuda.

Cookies

We use one cookie to keep you signed in, and one for the few minutes a sign-in code is valid. Nothing here tracks you, and there are no analytics or advertising cookies.

Last updated 6 October 2026.