Privacy Policy

Beakwise Corporation ("Beakwise," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website www.beakwise.com, use our enterprise software solutions and services, interact with us in connection with our B2B relationships, apply for employment opportunities, or engage with our sales, support, or professional services teams.

We are committed to transparency in our data practices and giving you control over your personal information. As a B2B FinTech/InsurTech provider, we handle enterprise data and job applicant information with the highest standards of security and compliance.

This policy is written to meet our obligations under the data protection laws that apply to us, including the General Data Protection Regulation (EU) 2016/679 (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), Uzbekistan Law No. ZRU-547 on Personal Data, the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act 2018 and the Lei Geral de Proteção de Dados (LGPD). We hold ISO 27001:2022 certification for information security management and ISO 9001:2015 for quality management. You can read the scope of each and download the certificates themselves here: Our certifications

We collect information through direct interactions, automated technologies, third-party sources, and job application processes to provide our enterprise services and manage recruitment.

Information You Provide Directly

• Full name and professional title
• Business and personal email addresses
• Company name, size, and industry sector
• Business and personal phone numbers
• Job title, department, and role within organization

Information Collected Automatically

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type, operating system, and unique identifiers
• Pages visited, features used, click patterns, and session duration

We process personal data only when we have a valid legal basis under applicable data protection laws:

Contract Performance

To provide our services to enterprise clients, fulfill contractual obligations, process transactions and billing, manage service delivery and support, process job applications and employment contracts

Legitimate Interests

To improve and develop our services, conduct business analytics and market research, prevent fraud and ensure security, manage business relationships and recruitment processes, market relevant services to existing clients, protect our legal rights and interests, ensure workplace safety and security

Consent

For certain marketing communications, optional features such as the candidate profile photo, cookies and similar technologies where the law requires consent, and participation in surveys or research.

Legal Obligations

To comply with applicable laws and regulations, respond to lawful requests from authorities, maintain required business and employment records, fulfill tax and accounting obligations, comply with equal employment opportunity requirements

Vital Interests

In rare cases, to protect the vital interests of individuals, including emergency situations

We use collected information for the following business purposes:

• Communications: Service updates and security alerts, marketing communications (with consent), newsletters and thought leadership, event invitations, recruitment communications
• Service Delivery: Providing access to our platform, customer onboarding, technical support, service customization and configuration
• Service Improvement: Analyzing usage patterns to enhance user experience, optimizing platform performance, and developing new features
• Marketing & Sales: Lead generation and qualification, account-based marketing, customer relationship management, market analysis and segmentation
• Legal Compliance: Meeting regulatory requirements, responding to legal requests, and protecting our rights and interests

We are committed to protecting the privacy of job applicants throughout the recruitment process:

• Purpose Limitation: We only use applicant data for recruitment, selection, and related legal obligations
• Data Retention: Unsuccessful applications retained for 12 months for future opportunities (with consent) or as required by law
• Access Control: Only authorized HR personnel and hiring managers have access to applicant data
• Automated Decisions: We do not make employment decisions based solely on automated processing
• International Transfers: Applicant data may be accessed by global HR teams with appropriate safeguards
• Sensitive Data: we do not ask for health, disability or diversity information through this website, and the application form has no field for it. If a specific recruitment step ever needs such information we will ask for it separately, explain why, and rely on your explicit consent or a legal requirement.
• Spam Protection: when you submit an application we run Google reCAPTCHA to tell real applicants from automated submissions. It examines how the page was used and sends that signal to Google, which acts as our processor for this purpose. It does not read your application content and it does not decide the outcome of your application.

Your Rights as an Applicant

• Request access to your application data
• Correct or update your information
• Request deletion of your application (subject to legal retention requirements)
• Object to specific processing activities
• Withdraw your application at any time
• Lodge a complaint with supervisory authorities

Optional Profile Photo

You may attach a profile photo when you apply for a role. It is entirely optional. Applying without one has no effect on how your application is received or considered, and you are never asked to explain why you did not provide one.

• Purpose: the photo helps the recruiters and hiring managers handling your application recognise you across correspondence and interviews. It is not used to evaluate your suitability for a role.
• Legal basis: your explicit consent under Article 6(1)(a) GDPR, given separately from the rest of the application by ticking the photo consent box. That box is never pre-ticked. You can apply without a photo and it makes no difference to your application. If you do attach one, you will be asked either to tick the box or to remove the photo before you can submit, so that a photo is never sent without your consent and never silently dropped.
• Who can see it: only authorised recruitment staff and the hiring managers responsible for the role you applied to. It is never published, never shown outside our recruitment system, and never used for marketing. It is stored on our behalf by Cloudflare, which acts as our processor and may not use it for its own purposes.
• How it is stored: in a dedicated private store in the European Union, kept separate from your application documents. It is never publicly accessible, and recruiters view it only through short-lived links that expire automatically.
• No automated use: your photo is not used for automated decision-making or profiling, is not analysed by facial recognition or any other biometric technique, and is not used to train machine learning models.
• Retention: if your application is unsuccessful the photo is deleted with it. If you are hired, tell us if you would prefer the photo not to be carried over into your employee record and we will delete it instead.
• Withdrawing consent: you can withdraw at any time by emailing the careers privacy address below, and we will delete the photo. Before you submit, withdrawing is simply a matter of unticking the box or removing the photo. Withdrawing has no effect on the rest of your application, on how it is considered, or on the lawfulness of processing carried out before you withdrew.

We share information only as described below and with appropriate safeguards:

• Service Providers: Cloud infrastructure (AWS, Google Cloud, Azure), analytics providers, communication tools, payment processors, recruitment platforms and ATS systems, background check providers - all bound by strict confidentiality agreements
• Legal Requirements: Court orders or subpoenas, government or regulatory requests, law enforcement investigations, employment verification requests, protection of rights and safety
• Business Transfers: Mergers, acquisitions, or asset sales (with notice to affected users), bankruptcy or reorganization proceedings
• With Consent: Specific third parties you authorize, integrated services you enable, public testimonials or case studies (with permission), employment references (with authorization)

We implement comprehensive technical and organizational security measures to protect your personal data:

Encryption: TLS 1.3 for data in transit, AES-256 encryption for data at rest. Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), principle of least privilege, regular access reviews. Infrastructure: Next-generation firewalls, intrusion detection/prevention systems, DDoS protection, secure data centers with physical security. Monitoring: 24/7 security operations center, continuous audit logging, anomaly detection, vulnerability scanning and penetration testing.

Certifications: our information security management system is certified to ISO 27001:2022 and our quality management system to ISO 9001:2015. Both certificates can be downloaded from our compliance page.

While we implement industry-leading security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any incidents.

We use cookies and similar technologies to enhance your experience, analyze usage, and support marketing efforts. You can manage your preferences through our consent banner or browser settings.

Essential Cookies

Required for website functionality, security, fraud prevention, and job application systems. These cannot be disabled without losing core functionality.

Performance & Analytics Cookies

Help us understand website usage, measure performance, improve user experience, and optimize recruitment processes. Includes Google Analytics and custom analytics tools.

Marketing & Advertising Cookies

Used to deliver relevant advertisements, measure campaign effectiveness, track job board performance, and limit ad frequency. Includes LinkedIn Insights, Google Ads, and retargeting pixels.

You can manage cookie preferences through our consent banner, browser settings, or by visiting Cookie Policy

When you grant analytics consent, we use persistent visitor identification to provide more accurate analytics and improve your experience across sessions.

This persistent tracking allows us to:

• Accurately count unique visitors to our website
• Understand which marketing channels effectively reach our audience
• Analyze customer journeys across multiple visits
• Improve website performance and user experience over time

Data Stored

• Session Identifier: A randomly generated UUID in the format sess_xxxxx
• Advertising Click IDs: Parameters from advertising platforms (gclid, gbraid, wbraid for Google Ads; li_fat_id for LinkedIn Ads). These identifiers are captured immediately when you arrive from an advertisement and initially stored in temporary browser memory (sessionStorage) to enable conversion tracking based on legitimate interest. If you grant analytics consent, they are moved to persistent storage (localStorage) for improved attribution accuracy.
• Storage Location: Browser localStorage (persists until you revoke consent or clear browser data)

Consent-Based Storage

• With Analytics Consent: Your session identifier and click IDs are stored in localStorage and persist across browser sessions.
• Without Analytics Consent: Data is stored only in sessionStorage and is automatically deleted when you close your browser.
• If you grant consent mid-session, your existing session data is migrated from temporary to persistent storage.
• If you revoke consent, all persistent tracking data is immediately deleted from localStorage, and a new temporary session identifier is created.

Legal Basis

We process this data based on your explicit consent (GDPR Article 6(1)(a)). You have the right to revoke your consent at any time through our consent management interface.

Data Retention

• With consent: Up to 13 months of inactivity (automatically deleted by server after 395 days)
• Without consent: Session duration only (deleted when browser is closed)
• Upon consent revocation: Immediate deletion from both client-side storage and server databases

Your Rights

• View your current session identifier on this page (see Analytics Session ID section below)
• Revoke analytics consent at any time to stop persistent tracking
• Clear your browser's localStorage to remove all stored identifiers
• Contact us to request deletion of any analytics data associated with your session

When you visit our website from a mobile app (such as LinkedIn, Facebook, WhatsApp, or other social platforms), we analyze your browser's User-Agent string to determine the traffic source. This helps us understand how visitors find our website.

We detect the following from User-Agent strings:

• Whether you're using an in-app browser (e.g., LinkedIn app, Facebook app, WhatsApp)
• The platform you're browsing from (iOS, Android)
• General browser type (not specific version)

This processing is based on our legitimate interest in understanding traffic sources for marketing analytics (GDPR Article 6(1)(f)). The User-Agent string is a standard browser identifier that does not uniquely identify individuals.

User-Agent data is not stored permanently. It is processed in real-time for traffic source inference and then discarded. The resulting traffic source categorization (e.g., 'linkedin', 'facebook') is included in analytics events.

You can avoid this detection by opening links in your default browser instead of in-app browsers. Most social apps provide an 'Open in Browser' option.

We use server-side conversion tracking to measure the effectiveness of our advertising campaigns. When you submit a form, request a demo, or take other qualifying actions on our website, we may send conversion data to our advertising partners to understand which advertisements drove your action and optimize our marketing spend.

Data Collected

We collect two tiers of conversion data:

Tier 1: Basic Conversion Data (Always Tracked)

• Conversion value (if applicable)

Tier 2: Enhanced Conversion Data (Only with Marketing Consent)

• Phone number (SHA-256 hashed before transmission)

Advertising Partners

Conversion data is sent to:

• Google Ads: For measuring Google advertising campaign effectiveness and ROI
• LinkedIn Ads: For measuring LinkedIn campaign performance and business audience targeting

Legal Basis for Processing

Legitimate Interest (Tier 1 Data)

We track basic conversion metrics based on legitimate interest (GDPR Article 6(1)(f)) to measure advertising ROI, optimize ad spend, understand customer journey, and prevent fraud. This processing is necessary for our business operations and does not override your fundamental rights.

Marketing Consent (Tier 2 Data)

We only include personally identifiable information (PII) in conversion events when you have explicitly consented to marketing communications. This enhanced data improves ad targeting accuracy and match rates with advertising platforms. You can grant or withdraw consent at any time through our consent management interface.

Data Security and Privacy

• Server-Side Processing: All conversion tracking is performed server-side through our Backend-for-Frontend (BFF) service, eliminating the need for third-party cookies on your device.
• SHA-256 Hashing: All personally identifiable information (email, phone, name) is hashed using SHA-256 cryptographic algorithm before transmission to advertising platforms. The original plaintext data is never sent.
• Ephemeral Processing: PII is hashed in-memory during request processing and immediately discarded. We do not store conversion PII in databases or logs.
• IP Anonymization: IP addresses are automatically anonymized before any processing (IPv4: last octet zeroed; IPv6: last 80 bits zeroed).

Your Rights and Control

• Opt-Out: You can opt out of enhanced conversion tracking (Tier 2) by declining marketing consent in our consent banner.
• Basic Tracking: Even if you decline marketing consent, we will continue to track basic conversion metrics (Tier 1) based on legitimate interest. This data contains no PII and cannot identify you personally.
• Data Access: Since conversion data is processed ephemerally and not stored, we cannot provide access to historical conversion data. However, you can review your current consent status and manage preferences at any time.
• CCPA Opt-Out: California residents can opt out of the "sale" or "sharing" of personal information (as defined by CCPA) by declining marketing consent. Click IDs and basic conversion data (Tier 1) do not constitute "sale" under CCPA.

Data Retention

Conversion data retention by our advertising partners:

• Google Ads: Conversion data is retained for up to 18 months for campaign optimization, then automatically deleted or anonymized.
• LinkedIn Ads: Conversion data is retained for up to 12 months for reporting and analytics purposes.
• Beakwise: We do not retain conversion data beyond the ephemeral processing period (milliseconds). All PII is discarded immediately after hashing and transmission.

How Conversion Tracking Works

Advertising platforms use hashed PII to match conversions to their user profiles, enabling accurate attribution and campaign optimization. Typical match rates:

• Tier 1 Only (Click IDs): ~60-70% match rate
• Tier 2 Enhanced (PII + Click IDs): ~85-95% match rate

Higher match rates mean more accurate ROI measurement and better ad targeting, but require your explicit marketing consent.

As a global company, we transfer data internationally in compliance with all applicable laws and with appropriate safeguards:

• Transfer Mechanisms: where personal data leaves the European Economic Area we rely on Standard Contractual Clauses approved by the European Commission, on adequacy decisions where they apply, or on your explicit consent. We do not rely on Binding Corporate Rules. You can ask us for a copy of the safeguards that apply to a particular transfer using the contact details below. Transfers that start in Turkey or Uzbekistan are governed by those countries' own rules and rely on the explicit consent you give when you submit the form, because European mechanisms do not apply to them.
• Where Your Data Is Stored: what you submit through our forms, including job applications and any profile photo, is stored in the European Union. Our managed database runs in Frankfurt, Germany, and file storage is restricted to the EU jurisdiction. We do not operate separate national data centres, so this data is not localised to Turkey, Uzbekistan or any other individual country. Analytics and advertising data is a separate matter: it is processed by the providers named in the Advertising Conversion Tracking and Data Retention sections, and some of them, including Google, Microsoft, X and Yandex, process data outside the European Economic Area.

You have important rights regarding your personal data. The specific rights available depend on your location and your relationship with us (customer, job applicant, etc.):

GDPR Rights (EU/UK/EEA Residents)

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain processing activities
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

CCPA Rights (California Residents)

• Right to Know: What personal information we collect, use, share, and sell
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information, but you may opt-out of certain sharing
• Right to Non-Discrimination: Equal service and employment consideration regardless of exercising privacy rights

We retain personal data only as long as necessary for business and legal purposes:

Active Accounts: Duration of business relationship plus 7 years for financial records. Marketing Data: Until consent withdrawn or 3 years of inactivity. Job Applications: Successful applicants - transferred to employee records; Unsuccessful applicants - 12 months (with consent) or as legally required. Legal Records: As required by law (typically 5-10 years for financial data, 3-7 years for employment records). Technical Logs: 90 days for operational logs, 2 years for security audit logs. Backup Data: 90 days in backup systems after deletion from primary systems

After retention periods expire, we securely delete personal data using industry-standard methods, anonymize data for statistical purposes where permitted, and maintain deletion logs for compliance verification

We believe in keeping your data only as long as necessary. Our backend implements automated GDPR-compliant data deletion via scheduled database jobs, ensuring your information doesn't outlive its purpose.

Analytics Data We Collect

What We Don't Store

• Your full IP address — we anonymize it before any storage
• Cookies for privacy-focused analytics — Plausible is completely cookieless
• Any personally identifiable information in analytics data

Third-Party Analytics Providers

Automatic Deletion Schedule

We run automated deletion jobs to ensure data doesn't outlive its purpose:

• Weekly (Sundays): Consent records and user analytics history older than 13 months are permanently deleted
• Daily: Analytics events older than 90 days are permanently deleted
• Daily: Failed/dead letter events older than 30 days are permanently deleted

All deletions are logged to an internal audit trail for compliance verification.

Your Rights Under GDPR

Right to Erasure (Article 17)

Request deletion of your data before the retention period expires by contacting our Data Protection Officer.

Right to Object (Article 21)

Withdraw consent anytime via the cookie banner. GA4 tracking stops immediately. Plausible continues under legitimate interest as it's cookieless and collects no personal data.

Right to Access (Article 15)

Request a copy of data we hold about you through a Data Subject Access Request (DSAR).

Legal Basis for Processing

Contact for Data Requests

When submitting a data deletion or access request, please reference your analytics session identifier below. This helps us locate and process your data efficiently.

Our services are designed for businesses and professional recruitment and are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover we have inadvertently collected such data, we will promptly delete it. Job applicants must be of legal working age in their jurisdiction.

As a FinTech/InsurTech provider operating globally, we maintain enhanced safeguards for financial data:

• Scope: this website and its recruitment features do not process payment card data, bank credentials or client financial records. Financial data handled in our products for enterprise clients is governed by the contract with that client, not by this policy.
• Special Categories: we do not ask for special category data (such as health, disability or diversity information) through this website. Where a specific process needs it, we collect it only with explicit consent or where the law requires it, and we tell you which applies at the point of collection.
• Safeguards: data is encrypted in transit and at rest, access is limited to staff who need it for their role, and access to personal data is logged. Enterprise clients evaluating us can request our current certifications and audit reports under NDA; we do not list certification claims here that we cannot evidence on request.

We use AI and machine learning in a limited way, and not to make decisions about job applicants:

• Where We Use It: extracting structured data from documents that business users upload to our products, and matching those documents to existing records. In both cases the result is shown to a person who reviews it and can correct it.
• Recruitment: we do not use AI to screen, score, rank or shortlist job applicants, and we do not parse or evaluate your CV, cover letter or profile photo automatically. Applications are read by people, and no decision about your application is made solely by automated means. If that ever changes we will update this policy and tell applicants before it takes effect.
• What We Do Not Do: we do not use AI for social scoring, for emotion recognition, for inferring characteristics from biometric data, or for any other practice the EU AI Act prohibits.

We may update this policy when our practices change or when new obligations apply to us. When we make a material change we will say so in the summary at the top of this page and move the version and effective date. Where the law requires us to obtain your consent for a change, we will ask for it rather than assume it.

• California Privacy Rights: California residents have rights under the CCPA and CPRA, including the right to know what personal information we hold, to request deletion, and to opt out of sale or sharing. We do not sell personal information. We do share personal information for cross-context behavioural advertising when you grant marketing consent, and you can opt out at any time by declining or withdrawing that consent in our cookie settings. Contact us using the details below to exercise these rights.
• Nevada Privacy Rights: Nevada residents may opt-out of the sale of covered information. We do not currently sell covered information as defined under Nevada law.
• Turkey: personal data of individuals in Turkey is processed under KVKK Law No. 6698. Data collected through this website is stored in the European Union rather than in Turkey. That is a transfer abroad under KVKK, and we rely on the explicit consent you give when you submit the form.
• Uzbekistan: personal data of individuals in Uzbekistan is processed under Law ZRU-547. Data collected through this website is stored in the European Union rather than in Uzbekistan. That is a cross-border transfer under Uzbek law, and we rely on the explicit consent you give when you submit the form.
• European Union: we act as data controller for the personal data described in this policy and process it under the GDPR. Contact us using the details below for any request concerning your data, or to reach the person responsible for data protection.
• Cookie Policy: for detail on cookies and similar technologies, see our Cookie Policy. Cookies and Tracking Technologies
• Terms of Service: use of our services is also governed by our Terms of Service. Terms of Service
• Job Applications: applying for a role is covered by the Job Applicant Privacy section of this policy. There is no separate careers terms document.
• Accessibility: We are committed to making our privacy practices accessible. Contact us if you need this policy in an alternative format.
• Regulatory Updates: we review this policy when our practices change or when new obligations apply to us, and we record what changed in the summary at the top of this page.

For privacy-related questions, concerns, or to exercise your rights, please contact us:

Supervisory Authorities

You have the right to lodge a complaint with supervisory authorities:

• EU/EEA: Your local data protection authority or lead supervisory authority
• UK: Information Commissioner's Office (ICO)
• Turkey: Personal Data Protection Authority (KVKK)
• Uzbekistan: State Inspectorate for Control in the Field of Informatization and Telecommunications (UzComNazorat)
• California: California Attorney General
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• For AI-related complaints: EU AI Office or national competent authorities
• For platform services: European Board for Digital Services