Website: beady.ai
This Privacy Policy explains how We Good Solutions Limited, a legal entity incorporated in Hong Kong, with its registered address at Unit 1603, 16th Floor, The L. Plaza, 367-375 Queen’s Road Central, Sheung Wan, Hong Kong, collects, uses, discloses, transfers, stores and otherwise processes personal data when you use the beady.ai website, including its web pages, contact forms, newsletters, information materials and related services, or when you otherwise interact with us.
beady.ai is a website that gives information about our risk analytics services and solutions. We provide business intelligence services that help companies, including companies in the UAE, identify and manage different types of risk.
Please read this Policy carefully. By accessing the Website or the Services, you confirm that you have read and understood it.
For the purposes of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL), the DIFC Data Protection Law (DIFC Law No. 5 of 2020), the ADGM Data Protection Regulations 2021, the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the Hong Kong Personal Data (Privacy) Ordinance (PDPO), the California Consumer Privacy Act (CCPA/CPRA) and any other data protection laws that apply, the controller of the personal data described in this Policy is:
We Good Solutions Limited
Registered address: Unit 1603, 16th Floor, The L. Plaza, 367-375 Queen’s Road Central, Sheung Wan, Hong Kong.
Privacy email: legal@beady.ai
Data subject requests: legal@beady.ai
This Policy applies to: the Website and any subdomains we operate; beady.ai dashboards, the web application, mobile and desktop applications, APIs, newsletters (including those sent by email or through messengers such as Telegram, WhatsApp, Viber, Discord and others), exported reports and any other part of the Services; communications between us and any User or potential client; and personal data of Data Subjects of Interest collected from open sources.
Personal data means any information relating to an identified or identifiable natural person within the meaning of the UAE PDPL, the DIFC and ADGM data protection laws, the GDPR, UK GDPR, PDPO and other applicable laws.
Processing means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment or combination, restriction, deletion or destruction.
Open source means any source of information that is freely available to the general public without getting around any technical or contractual access restrictions. This includes news websites, public social media posts, government and corporate registries, court and arbitration databases, sanctions lists and watchlists, regulator websites and other open online resources.
Client means a legal entity that has signed a subscription agreement or other agreement with us for access to the Services.
End User means an individual authorised by a Client to access and use the Services on its behalf.
Observation means a structured signal, alert, data point or analytical record generated by the Services in connection with a company or individual being monitored.
We collect and process the following categories of personal data about Users:
• Identification and contact data: first and last name, corporate email address.
• Account data: username, multi-factor authentication identifiers, role and access permissions, organisation, settings and preferences, alert configuration and watchlists set up by the User.
• Communications data: the content of emails, support requests and similar interactions with us.
• Technical and usage data: IP address, device identifiers, browser type and version, operating system, language, referrer, pages and screens viewed, features used, queries to the conversational AI agent, timestamps, session and log data, crash and diagnostic data, cookies and similar identifiers (see Section 9).
To provide the Services, we collect, organise, enrich and analyse information about Data Subjects of Interest from open sources and provide it to the relevant Client. This information may include:
• Identification data: name, alternative names, transliterations, date and place of birth (when publicly disclosed), nationality, country of residence, public profile photos, and identifiers used in public registries and public reporting.
• Professional and corporate data: current and previous employers, positions, directorships, ownership stakes, business connections, professional licences, registrations in public registries, and publicly disclosed CVs.
• Public behaviour and statements: publicly available posts and content on social media and developer platforms, public comments, blog posts, press statements, participation in hackathons, grant applications and similar publicly visible professional activity.
• Reputation and risk data: negative mentions in the news (adverse media), mentions of investigations, regulatory actions, fines, sanctions, court and arbitration proceedings, bankruptcy, liquidation or cessation events, publicly available reviews and ratings, sentiment indicators, allegations made in public, and fraud and impersonation indicators.
• Special categories of data (only when strictly necessary): if an open source discloses information covered by Article 9 GDPR, or sensitive personal data under the UAE PDPL or the DIFC and ADGM laws, we process it on a limited basis and only to the extent that it has been manifestly made public by the data subject, or is strictly necessary for the substantial public interest of preventing fraud, money laundering, terrorist financing, sanctions evasion or other unlawful activity.
We get personal data from the following sources: directly from you when you contact sales or support, set up monitoring in the Services or otherwise communicate with us; from our Clients when a Client uploads, sends, configures or otherwise provides personal data for monitoring through the Services; and from open sources such as news resources, search engines, public social media platforms, public corporate, judicial, regulatory and sanctions databases, government and intergovernmental registries, public blacklists and other freely accessible online resources.
We process personal data of Users to create and manage accounts, authenticate Users, provide access to the Services, display dashboards, newsletters and reports, set up and carry out monitoring of companies and individuals selected by the Client, generate Observations and risk signals, enable collaboration features and otherwise perform our contract with the Client. Legal basis: performance of a contract (Article 6(1)(b) GDPR) or, if the User is not a party to the contract, our legitimate interests (Article 6(1)(f) GDPR), together with the corresponding grounds under the UAE PDPL and the DIFC and ADGM laws where they apply.
We process technical data, usage data and account data to monitor and protect the Services from abuse, including unauthorised access, scraping, mass extraction, denial of service, credential stuffing, account takeover, infringement of our intellectual property rights and other malicious actions. Legal basis: our legitimate interests in protecting our Services, our Clients and third parties (Article 6(1)(f) GDPR), and compliance with legal obligations (Article 6(1)(c) GDPR).
We process contact data and communications data to answer enquiries, provide customer support, send service notifications, manage billing and contracts, keep accounting and tax records and run day-to-day operations. Legal basis: performance of a contract, legitimate interests and compliance with legal obligations.
We process personal data of Data Subjects of Interest collected from open sources to: (i) create and maintain subject profiles and historical archives of Observations; (ii) carry out continuous automated monitoring; (iii) identify, deduplicate, classify, summarise and assess the relevance, sentiment and risk of public mentions; (iv) match Observations to the correct subject using our proprietary matching algorithms; (v) provide the relevant Client with risk signals, alerts, dashboards and reports; and (vi) improve, train and evaluate the analytical models used in the Services, using aggregated or anonymised data where possible. Legal basis: our legitimate interests and those of our Clients in carrying out risk screening, anti-fraud, anti-money laundering, sanctions evasion prevention, brand protection and counterparty due diligence (Article 6(1)(f) GDPR), and compliance with legal obligations that apply to us or our Clients (Article 6(1)(c) GDPR), including AML and counter-terrorist financing obligations under UAE law.
The Services rely heavily on automated processing, including artificial intelligence and machine learning models, to filter, deduplicate, classify, assess and summarise data from open sources, match Observations to subjects and assess sentiment, relevance and risk indicators. These automated results are meant to support decision-making by our Clients, not replace it. The Services do not make legally binding decisions, or decisions with a similarly significant effect, about Data Subjects of Interest. Clients are contractually required to carry out human review of Observations and risk signals before making any decision that may affect a Data Subject of Interest.
We may disclose personal data to the following categories of recipients. Clients and authorised End Users: publicly available personal data about Data Subjects of Interest is disclosed to the Client who set up the relevant monitoring and to its authorised End Users, in the form of dashboards, alerts, exports, reports and API outputs. Government authorities and regulators: when we are required to do so under applicable law, including UAE law, a court order or other lawful process, or when we believe in good faith that disclosure is necessary to protect our rights, the security of the Services or the rights of others. We do not sell personal data within the meaning of the CCPA/CPRA and do not transfer personal data for cross-context behavioural advertising.
The Services use cookies, local storage, pixel tags and similar technologies for functionality, security and to improve what we offer. We use strictly necessary cookies that the Services need to work (for example, for authentication, session management and security). Where the law requires it, we will ask for your consent through our cookie banner before placing optional cookies. You can manage your preferences at any time in your browser settings or, where available, in our cookie management centre.
Our headquarters is in Hong Kong, and we operate internationally. Personal data may be processed and stored outside the UAE, the European Economic Area (EEA), the United Kingdom, Hong Kong or your country of residence, including in jurisdictions whose data protection laws may differ from those of your country. Where the UAE PDPL, the DIFC Data Protection Law or the ADGM Data Protection Regulations apply, we transfer personal data outside the UAE, the DIFC or ADGM only in line with the cross-border transfer rules in those laws. When we transfer personal data from the EEA, the UK or Switzerland to third countries that have no adequacy decision, we rely on appropriate safeguards, including the European Commission Standard Contractual Clauses (SCC), the UK International Data Transfer Agreement or the UK Addendum to the SCC, and, where necessary, additional measures (such as encryption in transit and at rest, access controls and contractual obligations) to ensure an essentially equivalent level of protection.
We keep personal data for as long as we need it for the purposes for which it was collected and to meet our legal, regulatory, accounting and reporting obligations. After that, we delete or anonymise it.
Personal data of Users is kept for the duration of the contract between us and the relevant Client, and for an additional period after it ends, as required by applicable law (in particular limitation periods and accounting rules) or to enforce or defend legal claims.
In line with how the Services are designed, we apply the following principles when storing information about Data Subjects of Interest collected from open sources. Operational window: the full stream of public Observations (including negative, neutral and positive items) is stored while the subject is being monitored by a User, so that recent activity stays visible. Curated historical archive: individual historical records that previously needed attention, including risk-relevant Observations, may be stored for up to 24 months from the date of collection for context and trend analysis. Basic profile at onboarding: when a subject is first profiled, we may collect curated historical Observations covering up to twelve (12) preceding years, which are then stored under the rules above. Client-specific retention: if a Client sets a longer or shorter retention period in the Services, we follow that setting to the extent permitted by applicable law.
We put in place and maintain appropriate technical and organisational measures to protect personal data from unauthorised or unlawful processing and from accidental loss, destruction, damage, alteration or disclosure. Depending on the level of risk, these include: encryption in transit (HTTPS and TLS) and at rest where appropriate; strict access controls, a role model, multi-factor authentication and the principle of least privilege for our staff; network segmentation, logging, monitoring and intrusion detection tools; vulnerability management and regular testing of our infrastructure; vendor screening and contractual security obligations for service providers; staff measures, including confidentiality obligations and security training; and business continuity and disaster recovery. No security measure is perfect or impenetrable. While we work hard to protect personal data, we cannot guarantee the security of any information sent to us or stored by us, and any such transmission is at your own risk.
Under applicable data protection law, including the UAE PDPL and the DIFC and ADGM laws where they apply, data subjects have the following rights. We give effect to them taking into account the specific nature of open-source (OSINT) data processing and any limitations expressly permitted by law:
Right of access. Data subjects have the right to confirmation of whether their personal data is being processed, and to information about the categories of data processed, the purposes and legal bases for processing, retention periods, categories of recipients and sources of data. We may limit the information provided where disclosure could: breach the rights and legitimate interests of third parties, including our Clients and other data subjects; reveal confidential processing methods, information sources or other trade secrets; hinder the prevention, detection, investigation or prosecution of offences; breach our confidentiality obligations to Clients or other third parties; or affect national security, public safety or other legally protected interests.
Right to rectification. Data subjects have the right to ask for inaccurate personal data to be corrected and, taking into account the purposes of processing, for incomplete data to be completed. When processing data from public sources, we may keep the original data with a note of the data subject’s objection if the data accurately reflects the primary source and the correction needs to be made at the primary source itself.
Right to erasure. Data subjects have the right to ask for their personal data to be deleted in the circumstances set out by applicable law. This right is not absolute and does not apply, in whole or in part, where processing is necessary: for exercising the right to freedom of expression and information; for compliance with our legal obligations; for purposes in the public interest, including combating fraud, money laundering and terrorist financing and carrying out compliance checks and due diligence; for the establishment, exercise or defence of legal claims; or for archiving, research or statistical purposes.
Right to restriction of processing. Data subjects have the right to ask for processing to be restricted in the cases expressly set out by applicable law, including while the accuracy of disputed data or the lawfulness of processing is being checked, and, when an objection to processing has been made, while we assess whether the objection is valid.
Right to object. Data subjects have the right to object to processing based on our legitimate interests or those of third parties. We will stop processing unless we can show compelling legitimate grounds for continuing that override the interests, rights and freedoms of the data subject, or unless processing is necessary for the establishment, exercise or defence of legal claims. Data subjects can object to processing for direct marketing at any time, without conditions.
Right to data portability. Data subjects have the right to receive the personal data they have provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and is carried out by automated means. This right does not cover data we obtained from public sources or third parties, or derived data, analytical conclusions and other results of processing created by us.
Right to withdraw consent. Where processing is based on the data subject’s consent, it can be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not prevent us from processing on other legal grounds.
Right to lodge a complaint. Data subjects have the right to lodge a complaint with the competent supervisory authority. In the UAE, this may be the UAE Data Office under the UAE PDPL, the DIFC Commissioner of Data Protection for matters under the DIFC Data Protection Law, or the ADGM Office of Data Protection for matters under the ADGM Data Protection Regulations. Data subjects may also complain to the supervisory authority of an EU member state where they usually live, work or where the alleged infringement took place, to the UK Information Commissioner’s Office (ICO), to the Hong Kong Privacy Commissioner for Personal Data (PCPD), or, in other cases, to the relevant data protection authority in their jurisdiction.
If you live in California, you may also have the following rights under the CCPA/CPRA, subject to certain limitations: the right to know what personal information we collect, use, disclose or share; the right to request deletion or correction; the right to limit the use of sensitive personal information; the right to opt out of any sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising); and the right not to be discriminated against for exercising privacy rights.
To exercise your rights, send us a written request at dsr@beady.ai. We may need to verify your identity before we respond, for example by asking for additional information that confirms the request comes from the relevant data subject. We will respond within the time limits set by applicable law. If we cannot fulfil the request, we will explain why in our response.
If the request relates to personal data that we process on behalf of and on the instructions of our Clients as a processor (for example, when a Client has uploaded personal data of its employees, counterparties or other persons for checks or monitoring), we act as follows. Request redirection: we promptly (no later than 72 hours after receipt) forward your request to the relevant Client acting as data controller, as the Client has primary responsibility for respecting your rights as a data subject. Help with the response: at the request of the Client, we provide technical and organisational support in preparing a response to your request, within our technical capabilities and in line with the data processing agreement signed with that Client. Direct response in exceptional cases: we may respond to your request directly, without forwarding it to the Client, where the Client has stopped using our services and is no longer available, the Client does not respond to the forwarded request within a reasonable time, the request concerns a data security breach on our side, or the competent supervisory authority directly requires us to respond.
The Services are intended only for business clients and authorised professionals. They are not directed at children and are not meant to be used by children. We do not knowingly collect personal data directly from children. If we find out that we have collected personal data from a child without an appropriate legal basis, we will take steps to delete it.
We may update this Policy from time to time to reflect changes in our practices, Services or applicable law, or for other operational, legal or regulatory reasons. The “Last updated” date at the top of this Policy shows when it was last revised. If the changes are material, we will give additional notice, for example by email to Client account administrators or by a notice on the Website or in the Services. If you continue to use the Services after the effective date of the updated Policy, you accept the updated Policy.
If you have any questions, comments or concerns about this Policy or how we process personal data, please contact us:
We Good Solutions Limited
Registered address: Unit 1603, 16th Floor, The L. Plaza, 367-375 Queen’s Road Central, Sheung Wan, Hong Kong.
Email: legal@beady.ai
Data subject requests: legal@beady.ai
