Privacy Policy

Beakwise Corporation ("Beakwise," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website www.beakwise.com, use our enterprise software solutions and services, interact with us in connection with our B2B relationships, apply for employment opportunities, or engage with our sales, support, or professional services teams.

We are committed to transparency in our data practices and giving you control over your personal information. As a B2B FinTech/InsurTech provider, we handle enterprise data and job applicant information with the highest standards of security and compliance.

This policy is written to meet our obligations under the data protection laws that apply to us, including the General Data Protection Regulation (EU) 2016/679 (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), Uzbekistan Law No. ZRU-547 on Personal Data, the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act 2018 and the Lei Geral de Proteção de Dados (LGPD). We hold ISO 27001:2022 certification for information security management and ISO 9001:2015 for quality management. You can read the scope of each and download the certificates themselves here: Our certifications

We collect information through direct interactions, automated technologies, third-party sources, and job application processes to provide our enterprise services and manage recruitment.

Information You Provide Directly

• Full name and professional title
• Business and personal email addresses
• Company name, size, and industry sector
• Business and personal phone numbers
• Job title, department, and role within organization

Information Collected Automatically

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type, operating system, and unique identifiers
• Pages visited, features used, click patterns, and session duration

We process personal data only when we have a valid legal basis under applicable data protection laws:

Contract Performance

To provide our services to enterprise clients, fulfill contractual obligations, process transactions and billing, manage service delivery and support, process job applications and employment contracts

Legitimate Interests

To improve and develop our services, conduct business analytics and market research, prevent fraud and ensure security, manage business relationships and recruitment processes, market relevant services to existing clients, protect our legal rights and interests, ensure workplace safety and security

Consent

For certain marketing communications, optional features such as the candidate profile photo, cookies and similar technologies where the law requires consent, and participation in surveys or research.

Legal Obligations

To comply with applicable laws and regulations, respond to lawful requests from authorities, maintain required business and employment records, fulfill tax and accounting obligations, comply with equal employment opportunity requirements

Vital Interests

In rare cases, to protect the vital interests of individuals, including emergency situations

We use collected information for the following business purposes:

• Communications: Service updates and security alerts, marketing communications (with consent), newsletters and thought leadership, event invitations, recruitment communications
• Service Delivery: Providing access to our platform, customer onboarding, technical support, service customization and configuration
• Service Improvement: Analyzing usage patterns to enhance user experience, optimizing platform performance, and developing new features
• Marketing & Sales: Lead generation and qualification, account-based marketing, customer relationship management, market analysis and segmentation
• Legal Compliance: Meeting regulatory requirements, responding to legal requests, and protecting our rights and interests

We are committed to protecting the privacy of job applicants throughout the recruitment process:

• Purpose Limitation: We only use applicant data for recruitment, selection, and related legal obligations
• Data Retention: Unsuccessful applications retained for 12 months for future opportunities (with consent) or as required by law
• Access Control: Only authorized HR personnel and hiring managers have access to applicant data
• Automated Decisions: We do not make employment decisions based solely on automated processing
• International Transfers: Applicant data may be accessed by global HR teams with appropriate safeguards
• Sensitive Data: we do not ask for health, disability or diversity information through this website, and the application form has no field for it. If a specific recruitment step ever needs such information we will ask for it separately, explain why, and rely on your explicit consent or a legal requirement.
• Spam Protection: when you submit an application we run Google reCAPTCHA to tell real applicants from automated submissions. It examines how the page was used and sends that signal to Google, which acts as our processor for this purpose. It does not read your application content and it does not decide the outcome of your application.

Your Rights as an Applicant

• Request access to your application data
• Correct or update your information
• Request deletion of your application (subject to legal retention requirements)
• Object to specific processing activities
• Withdraw your application at any time
• Lodge a complaint with supervisory authorities

Optional Profile Photo

You may attach a profile photo when you apply for a role. It is entirely optional. Applying without one has no effect on how your application is received or considered, and you are never asked to explain why you did not provide one.

• Purpose: the photo helps the recruiters and hiring managers handling your application recognise you across correspondence and interviews. It is not used to evaluate your suitability for a role.
• Legal basis: your explicit consent under Article 6(1)(a) GDPR, given separately from the rest of the application by ticking the photo consent box. That box is never pre-ticked. You can apply without a photo and it makes no difference to your application. If you do attach one, you will be asked either to tick the box or to remove the photo before you can submit, so that a photo is never sent without your consent and never silently dropped.
• Who can see it: only authorised recruitment staff and the hiring managers responsible for the role you applied to. It is never published, never shown outside our recruitment system, and never used for marketing. It is stored on our behalf by Cloudflare, which acts as our processor and may not use it for its own purposes.
• How it is stored: in a dedicated private store in the European Union, kept separate from your application documents. It is never publicly accessible, and recruiters view it only through short-lived links that expire automatically.
• No automated use: your photo is not used for automated decision-making or profiling, is not analysed by facial recognition or any other biometric technique, and is not used to train machine learning models.
• Retention: if your application is unsuccessful the photo is deleted with it. If you are hired, tell us if you would prefer the photo not to be carried over into your employee record and we will delete it instead.
• Withdrawing consent: you can withdraw at any time by emailing the careers privacy address below, and we will delete the photo. Before you submit, withdrawing is simply a matter of unticking the box or removing the photo. Withdrawing has no effect on the rest of your application, on how it is considered, or on the lawfulness of processing carried out before you withdrew.

We share information only as described below and with appropriate safeguards:

• Service Providers: Cloud infrastructure (AWS, Google Cloud, Azure), analytics providers, communication tools, payment processors, recruitment platforms and ATS systems, background check providers - all bound by strict confidentiality agreements
• Legal Requirements: Court orders or subpoenas, government or regulatory requests, law enforcement investigations, employment verification requests, protection of rights and safety
• Business Transfers: Mergers, acquisitions, or asset sales (with notice to affected users), bankruptcy or reorganization proceedings
• With Consent: Specific third parties you authorize, integrated services you enable, public testimonials or case studies (with permission), employment references (with authorization)

We implement comprehensive technical and organizational security measures to protect your personal data:

Encryption: TLS 1.3 for data in transit, AES-256 encryption for data at rest. Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), principle of least privilege, regular access reviews. Infrastructure: Next-generation firewalls, intrusion detection/prevention systems, DDoS protection, secure data centers with physical security. Monitoring: 24/7 security operations center, continuous audit logging, anomaly detection, vulnerability scanning and penetration testing.

Certifications: our information security management system is certified to ISO 27001:2022 and our quality management system to ISO 9001:2015. Both certificates can be downloaded from our compliance page.

While we implement industry-leading security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any incidents.

We use cookies and similar technologies to enhance your experience, analyze usage, and support marketing efforts. You can manage your preferences through our consent banner or browser settings.

Essential Cookies

Required for website functionality, security, fraud prevention, and job application systems. These cannot be disabled without losing core functionality.

Performance & Analytics Cookies

Optional analytics storage helps us understand public website use through Google Analytics. Attaching an analytics identifier to a sales enquiry and reporting its later qualification both require explicit analytics permission. Limited cookieless public-page measurements may still be sent to Google when analytics storage is denied.

Marketing & Advertising Cookies

With marketing permission, Google Ads and LinkedIn measure accepted sales enquiries on eligible public pages. Advertising tags are excluded from employee, newsletter and careers routes and from URLs containing sensitive or unreviewed fields.

You can manage cookie preferences through our consent banner, browser settings, or by visiting Cookie Policy

Submitting an enquiry does not require analytics permission. The privacy checkbox on the contact form lets us handle the enquiry; it does not grant analytics or advertising permission or subscribe you to marketing communications.

If you explicitly permit analytics, we may save the existing Google Analytics browser identifier with an accepted sales enquiry. If our sales team later qualifies that enquiry, our server may send a qualification event to Google Analytics using that original consented identifier. We do not assign the staff member’s browser identity to you. Reviewed source and medium from the first consented public page may be retained for the current tab session, alongside the enquiry’s product and engagement context. This does not recover pre-consent activity or guarantee attribution to the original visit. If advertising permission was also explicitly recorded and remains valid, the qualification event may be available for measurement through a linked Google Ads account.

Before attaching this identifier, we prepare a private first-party withdrawal cookie, bw-attribution-receipt, lasting up to 365 days. It is HttpOnly, Secure and SameSite=Strict. It is used to locate the related server records for withdrawal, not for advertising. Page scripts cannot read its value; browser local storage holds only boolean presence and pending-withdrawal markers for this process.

Turning analytics off requests withdrawal and removal of the stored analytics link. Once our server acknowledges the request, future qualification exports for the associated enquiries stop. If the request fails, a pending marker is retained for retry and further attribution is blocked. Withdrawal does not recall events already delivered to Google or delete the business enquiry itself.

Turning marketing off separately blocks future advertising use of qualification reporting while preserving the consented analytics link. That advertising denial remains attached to the existing withdrawal cookie; turning marketing on again does not reactivate qualification advertising for that cookie. A full analytics withdrawal removes it after confirmation, and a later consented enquiry can prepare a fresh cookie.

Clearing browser data, cookie expiry or changing device can prevent this browser from locating earlier attributed enquiries. You can use the privacy contact route below to discuss those records or request access or deletion. The withdrawal cookie’s expiry is not a deletion schedule for enquiry records.

When you visit our website from a mobile app (such as LinkedIn, Facebook, WhatsApp, or other social platforms), we analyze your browser's User-Agent string to determine the traffic source. This helps us understand how visitors find our website.

We detect the following from User-Agent strings:

• Whether you're using an in-app browser (e.g., LinkedIn app, Facebook app, WhatsApp)
• The platform you're browsing from (iOS, Android)
• General browser type (not specific version)

This processing is based on our legitimate interest in understanding traffic sources for marketing analytics (GDPR Article 6(1)(f)). The User-Agent string is a standard browser identifier that does not uniquely identify individuals.

User-Agent data is not stored permanently. It is processed in real-time for traffic source inference and then discarded. The resulting traffic source categorization (e.g., 'linkedin', 'facebook') is included in analytics events.

You can avoid this detection by opening links in your default browser instead of in-app browsers. Most social apps provide an 'Open in Browser' option.

On eligible public pages, accepted sales enquiries and demo requests may produce a native Google Ads conversion and a LinkedIn conversion only when marketing permission is granted. Submit attempts, newsletter subscriptions, downloads and career contacts are separate activities.

Conversion events use the accepted enquiry’s opaque submission identifier for duplicate control. Google Ads may also receive the submitted email address or phone number through its enhanced-conversion mechanism for matching, subject to marketing permission and the account’s enabled settings. These matching details are scoped to that Google Ads conversion and are not ordinary Google Analytics event fields. LinkedIn receives the configured conversion action and an opaque event identifier.

Analytics and advertising choices are separate from contact privacy acceptance and from consent to marketing communications. You can change these choices through the cookie controls. Declining marketing permission prevents these advertising conversions; we do not replay denied-time conversions after a later grant.

Employee pages do not initialize these measurement vendors. Advertising additionally excludes newsletter and careers pages and URLs with sensitive or unreviewed fields. No universal match-rate or delivery guarantee applies.

As a global company, we transfer data internationally in compliance with all applicable laws and with appropriate safeguards:

• Transfer Mechanisms: where personal data leaves the European Economic Area we rely on Standard Contractual Clauses approved by the European Commission, on adequacy decisions where they apply, or on your explicit consent. We do not rely on Binding Corporate Rules. You can ask us for a copy of the safeguards that apply to a particular transfer using the contact details below. Transfers that start in Turkey or Uzbekistan are governed by those countries' own rules and rely on the explicit consent you give when you submit the form, because European mechanisms do not apply to them.
• Where Your Data Is Stored: what you submit through our forms, including job applications and any profile photo, is stored in the European Union. Our managed database runs in Frankfurt, Germany, and file storage is restricted to the EU jurisdiction. We do not operate separate national data centres, so this data is not localised to Turkey, Uzbekistan or any other individual country. Analytics and advertising data is a separate matter: it is processed by the providers named in the Advertising Conversion Tracking and Data Retention sections, and some of them, including Google, Microsoft, X and Yandex, process data outside the European Economic Area.

You have important rights regarding your personal data. The specific rights available depend on your location and your relationship with us (customer, job applicant, etc.):

GDPR Rights (EU/UK/EEA Residents)

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain processing activities
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

CCPA Rights (California Residents)

• Right to Know: What personal information we collect, use, share, and sell
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information, but you may opt-out of certain sharing
• Right to Non-Discrimination: Equal service and employment consideration regardless of exercising privacy rights

We retain personal data only as long as necessary for business and legal purposes:

Active Accounts: Duration of business relationship plus 7 years for financial records. Marketing Data: Until consent withdrawn or 3 years of inactivity. Job Applications: Successful applicants - transferred to employee records; Unsuccessful applicants - 12 months (with consent) or as legally required. Legal Records: As required by law (typically 5-10 years for financial data, 3-7 years for employment records). Technical Logs: 90 days for operational logs, 2 years for security audit logs. Backup Data: 90 days in backup systems after deletion from primary systems

After retention periods expire, we securely delete personal data using industry-standard methods, anonymize data for statistical purposes where permitted, and maintain deletion logs for compliance verification

Different storage items have different purposes. The business enquiry and any consented analytics link are separate from website measurement cookies; deleting a browser cookie does not itself delete the enquiry.

Cookie choices remain in browser local storage until changed or cleared. Reviewed source and medium for qualification attribution are retained only for the current tab session and cleared on analytics withdrawal. Advertising click identifiers are stored only with marketing permission and are cleared when that permission is withdrawn.

The private first-party withdrawal cookie lasts up to 365 days and is removed after our server confirms withdrawal. Necessary boolean presence and retry markers remain only to manage this process; the receipt value and Google Analytics identifier are not stored in these markers.

Google Analytics, Google Ads and LinkedIn retain delivered measurement under their respective service and account settings. A browser withdrawal request does not recall events already delivered to those services.

For earlier enquiries that this browser can no longer link, or for access or deletion requests concerning business records or delivered analytics, use the privacy contact route in this policy. We do not publish a separate automatic deletion schedule for enquiry attribution in this notice.

Our services are designed for businesses and professional recruitment and are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover we have inadvertently collected such data, we will promptly delete it. Job applicants must be of legal working age in their jurisdiction.

As a FinTech/InsurTech provider operating globally, we maintain enhanced safeguards for financial data:

• Scope: this website and its recruitment features do not process payment card data, bank credentials or client financial records. Financial data handled in our products for enterprise clients is governed by the contract with that client, not by this policy.
• Special Categories: we do not ask for special category data (such as health, disability or diversity information) through this website. Where a specific process needs it, we collect it only with explicit consent or where the law requires it, and we tell you which applies at the point of collection.
• Safeguards: data is encrypted in transit and at rest, access is limited to staff who need it for their role, and access to personal data is logged. Enterprise clients evaluating us can request our current certifications and audit reports under NDA; we do not list certification claims here that we cannot evidence on request.

We use AI and machine learning in a limited way, and not to make decisions about job applicants:

• Where We Use It: extracting structured data from documents that business users upload to our products, and matching those documents to existing records. In both cases the result is shown to a person who reviews it and can correct it.
• Recruitment: we do not use AI to screen, score, rank or shortlist job applicants, and we do not parse or evaluate your CV, cover letter or profile photo automatically. Applications are read by people, and no decision about your application is made solely by automated means. If that ever changes we will update this policy and tell applicants before it takes effect.
• What We Do Not Do: we do not use AI for social scoring, for emotion recognition, for inferring characteristics from biometric data, or for any other practice the EU AI Act prohibits.

We may update this policy when our practices change or when new obligations apply to us. When we make a material change we will say so in the summary at the top of this page and move the version and effective date. Where the law requires us to obtain your consent for a change, we will ask for it rather than assume it.

• California Privacy Rights: California residents have rights under the CCPA and CPRA, including the right to know what personal information we hold, to request deletion, and to opt out of sale or sharing. We do not sell personal information. We do share personal information for cross-context behavioural advertising when you grant marketing consent, and you can opt out at any time by declining or withdrawing that consent in our cookie settings. Contact us using the details below to exercise these rights.
• Nevada Privacy Rights: Nevada residents may opt-out of the sale of covered information. We do not currently sell covered information as defined under Nevada law.
• Turkey: personal data of individuals in Turkey is processed under KVKK Law No. 6698. Data collected through this website is stored in the European Union rather than in Turkey. That is a transfer abroad under KVKK, and we rely on the explicit consent you give when you submit the form.
• Uzbekistan: personal data of individuals in Uzbekistan is processed under Law ZRU-547. Data collected through this website is stored in the European Union rather than in Uzbekistan. That is a cross-border transfer under Uzbek law, and we rely on the explicit consent you give when you submit the form.
• European Union: we act as data controller for the personal data described in this policy and process it under the GDPR. Contact us using the details below for any request concerning your data, or to reach the person responsible for data protection.
• Cookie Policy: for detail on cookies and similar technologies, see our Cookie Policy. Cookies and Tracking Technologies
• Terms of Service: use of our services is also governed by our Terms of Service. Terms of Service
• Job Applications: applying for a role is covered by the Job Applicant Privacy section of this policy. There is no separate careers terms document.
• Accessibility: We are committed to making our privacy practices accessible. Contact us if you need this policy in an alternative format.
• Regulatory Updates: we review this policy when our practices change or when new obligations apply to us, and we record what changed in the summary at the top of this page.

For privacy-related questions, concerns, or to exercise your rights, please contact us:

Supervisory Authorities

You have the right to lodge a complaint with supervisory authorities:

• EU/EEA: Your local data protection authority or lead supervisory authority
• UK: Information Commissioner's Office (ICO)
• Turkey: Personal Data Protection Authority (KVKK)
• Uzbekistan: State Inspectorate for Control in the Field of Informatization and Telecommunications (UzComNazorat)
• California: California Attorney General
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• For AI-related complaints: EU AI Office or national competent authorities
• For platform services: European Board for Digital Services