Privacy notice

Bizinfo.Global is operated by Elbetron Technologies Company (شركة إلبيترون تيكنولوجيز), a limited liability company registered in the Kingdom of Saudi Arabia, Dammam, Commercial Registration (Unified National Number) 7054601203 (“we”, “us”). We run a database of companies built mainly from official company registers, and the website, apps and API that give access to it.

This notice explains how we handle personal data about three groups of people:

• People in the company graph: directors, officers, shareholders, beneficial owners and business contacts of the companies we list. Most of them have never used our services.
• Customers and users: people who create an account, use the product or API, or manage a claimed company profile.
• Visitors: people who browse our public pages.

For the company graph and for our own customer and visitor data we are the controller. When a customer uploads its own files for enrichment, we process that data on the customer’s behalf as a processor under our data processing agreement.

The graph is about legal entities. Where a register or other source links a person to a company, we may hold:

We do not collect home addresses, special-category data (such as health, religion or ethnicity) or government identity numbers of individuals, and we do not infer them. Court and insolvency records that concern an individual are handled with additional restrictions.

In order of authority:

1. Official company registers, tax authorities, stock exchanges and official gazettes.
2. Publicly available websites, including companies' own websites (for example contact, about and imprint pages), and public filings: contact channels, social profiles, services, languages and technologies. We use only pages anyone can open, without logging in.
3. Information submitted by companies that have claimed their profile, and by their authorised representatives.
4. Data licensed from partners whose licences permit our use.
5. Values extracted automatically from the sources above, which are labelled as such and never override register data.

We record internally where and when each value was obtained, so we can answer access requests and honour objections. Where the law requires it, we notify people that we hold their business data, tell them where it came from and how to object. Anyone can ask us to correct or remove their details, or to stop showing a contact channel, through the privacy centre; removed values are kept on a suppression list so they do not reappear.

Our legitimate-interests assessments balance the value of transparent company information against the privacy of the people concerned. The safeguards include: publishing only what registers publish about officers; excluding home addresses and full dates of birth; applying jurisdiction rules to contact details; honouring objections through a suppression list that also stops the data being added again; and contractual limits on what customers may do with the data. A summary of an assessment is available on request.

Outside the EU and UK we rely on the equivalent bases where they exist: legitimate interests under Brazil’s LGPD and South Africa’s POPIA; the publicly-available-data and legitimate-interest provisions of Saudi Arabia’s PDPL with a documented assessment; and consent where the law provides no alternative, for example for most contact data under the UAE federal PDPL. Where we cannot meet a jurisdiction’s requirements, we do not show the data there.

• Account data: name, work email, job title, organisation, password hash and two-step verification settings.
• Usage data: searches, companies viewed, lists, exports, API requests and their metering, used to provide the service, enforce plan limits and improve the product.
• Billing data: plan, invoices and tax details. Card details are handled by our payment provider and never stored by us.
• Support data: messages you send us and our replies.
• Device data: IP address, browser type and cookies. See the cookie policy.

Contact details you give us through the contact form are used only to reply and to keep a record of the conversation. We do not use them to build profiles for marketing.

If you choose to sign in with Google, Microsoft, LinkedIn or Facebook, the provider sends us your account ID with them, your name, your email address and whether they have confirmed that address. We use this only to sign you in and to match you to your Bizinfo.Global account. We never receive your password with them, your contacts or your posts, we do not store your profile picture, and we never post on your behalf. You can disconnect a provider at any time in Settings → Security → Sign-in methods; the data deletion page explains how to remove what we received from Facebook or any other provider.

With your consent (the “Analytics” choice in our cookie banner) our live site uses Google Analytics to measure, in aggregate, which pages and features are used. Before you choose, or if you decline, it does not load at all. When it runs, Google Consent Mode keeps advertising storage and ad personalisation off, Google signals are off, email addresses, codes and tokens are removed from the page addresses we send, and its cookies expire after 13 months. Google processes this data on our behalf. You can withdraw consent at any time with Change cookie settings in the cookie policy.

Our mobile app reads the same company database as the website. Everything in this notice also applies to the app; this section adds what is specific to it. The app has no advertising and we do not sell data collected through it.

• Install ID. On first launch the app creates a random ID and keeps it in the phone’s secure storage (Android Keystore or iOS Keychain). It is not linked to a person. The app registers it with us, together with the platform, the app version and, where the phone can provide one, proof that the app is genuine (Google Play Integrity on Android, Apple App Attest on iOS). We use it to give each install an allowance of free reads and to prevent abuse. Reading without signing in works on this alone.
• Device details when you sign in. We record the install ID, the device make and model, the platform, the operating-system version and the app version. You see them in the app under Account, in Signed-in devices, and can sign any device out there.
• Google Firebase. The app uses three Firebase services from Google. Crashlytics sends crash and error reports (the technical trace, device model, operating-system version, app version and the app’s state at the time of the crash) and runs in release builds only. Analytics records which screens are opened by type of page, for example “company page”, never which company or person you looked at; the advertising ID is not collected. Cloud Messaging delivers push messages: every install subscribes to a general news topic, which registers the install with Google’s messaging service whether or not you are signed in. A push token reaches us only after you sign in, so that we can send personal alerts, and is removed when you sign out. We have not switched personal push alerts on yet and do not store push tokens today. On Android 13 and later the app asks for notification permission when you sign in; it covers alerts and news. The app does not send your name, email address or account ID to Firebase, but Firebase gives each install its own anonymous installation identifier, which we do not link to your account. The app has no separate on/off switch for crash reports or analytics today. Google acts as our processor for these services.
• Signing in. With Google the app uses Google’s own account sheet and receives an ID token from Google, and keeps no Google session. With Facebook it uses the Facebook login SDK for sign-in only: no app events are sent to Facebook, no advertising ID is used, and the Facebook token is not kept. LinkedIn and Microsoft sign-in open our website for the sign-in and hand back to the app. What we receive from each provider is described in the section above.
• Only on your phone. The optional app lock uses the phone’s own fingerprint, face or screen-lock prompt, and nothing from it leaves the phone. The same is true of the setting that hides the app in the app switcher and blocks screenshots, and of saved copies of pages for offline reading, which are cleared when the reader changes and from Settings with the Clear button.
• Map. The map screen loads map tiles from tiles.openfreemap.org, whose server sees the phone’s IP address and the map area being shown. The app does not ask for location permission and never reads the phone’s location, contacts or photos.

To delete your account from the app, open Account and choose Delete account; the data deletion page explains the steps and what is removed. Uninstalling the app removes the install ID from the phone.

• Customers, who access graph data under our terms and within their plan. Customers are independent controllers of the data they receive and must honour opt-outs and deletions we pass on.
• Service providers acting for us under contract: hosting, email delivery, payments, customer support and security tooling — including Oracle Cloud (hosting, Saudi Arabia), Google (Firebase crash reports, app analytics and push messaging for the mobile app), Cloudflare (network security and bot protection, including an invisible Cloudflare Turnstile check on our pages — see the Turnstile Privacy Addendum) and Lemon Squeezy (payments, as merchant of record). A current list of sub-processors is available on request from privacy@bizinfo.global.
• Authorities, where the law requires it or to protect rights and safety.
• A buyer or successor of our business, subject to this notice.

We do not sell customer or visitor data. Making business information about people available to our customers can count as “selling” or “sharing” personal information under some US state laws, including the California Consumer Privacy Act as amended by the CPRA. You can opt out at any time through Do not sell or share my personal information. We honour Global Privacy Control signals as an opt-out for the browser that sends them.

We host the service in the Kingdom of Saudi Arabia (Oracle Cloud, Riyadh region) and use service providers in other countries. When personal data leaves the European Economic Area, the UK, Saudi Arabia, the UAE, South Africa or Brazil, we use the safeguards those laws recognise: adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, Brazilian standard contractual clauses, and the transfer rules and risk assessments required by Saudi Arabia’s PDPL Transfer Regulations. Enterprise customers can choose regional data residency.

Depending on where you are, you can ask us to:

• tell you whether we hold data about you, give you a copy and say where it came from (access);
• correct inaccurate data (rectification);
• delete data (erasure), which we follow by suppressing your details so they are not added again;
• stop or limit certain uses while a question is resolved (restriction);
• stop using your data on the basis of legitimate interests (objection), and always stop direct marketing;
• stop selling or sharing your data (California and other US states);
• give you data you provided to us in a machine-readable format (portability);
• withdraw consent you gave, without affecting earlier processing.

Use the privacy centre to make a request. You do not need an account. We confirm your email address with a one-time code, and we may ask for more information if a request would disclose data about you. Authorised agents can act for you with your signed permission. We will not treat you differently for exercising your rights.

South Africa’s POPIA also protects companies (juristic persons); those requests are handled in the same way. If you are not satisfied with our answer you can complain to a data protection authority, such as your local EU authority, the UK Information Commissioner’s Office, the Saudi Data & AI Authority (SDAIA), the UAE Data Office, the DIFC or ADGM Commissioner, the South African Information Regulator, Brazil’s ANPD or the California Privacy Protection Agency.

Where the law requires it, we register as a data broker — for example with the California Privacy Protection Agency or in other US states — before serving that market, and process deletion requests received through official channels such as California’s Delete Request and Opt-out Platform at the required frequency.

Data is encrypted in transit and at rest. Access inside our team is limited by role, logged and reviewed. Passwords are hashed, API keys are stored only as hashes, and two-step verification is available on every account. We test our systems regularly and will notify authorities and affected people of a personal data breach where the law requires, including within 72 hours under the GDPR, UK GDPR and Saudi PDPL.

Verification levels and quality scores describe companies, not people, and we do not use them to make decisions with legal or similarly significant effects on individuals. Customers must not use our data to decide on an individual’s eligibility for credit, employment, insurance or housing. Where a company is a sole trader, we treat its data as personal data.

Our services are for businesses and are not directed at children. We do not knowingly collect data about anyone under 16.

We will update this notice when our processing changes, and change the date at the top. Material changes are announced in the product and by email to account holders before they take effect.

• Privacy requests: the privacy centre
• Data protection contact: privacy@bizinfo.global
• Postal address: Elbetron Technologies Company, Dammam, Kingdom of Saudi Arabia