Privacy Policy

This Privacy Policy explains how Between Technologies FZ-LLC (“b2n.ai”, “we”, or “us”) processes Personal Data when you visit our website, use our Services, or are processed by our customers as a Prospect. It describes the categories of data we process, the lawful bases on which we rely, the parties with whom we share data, the rights available to data subjects, and how to contact us. Who the controller is in each case, and our privacy contact, are set out in § 6 and § 15.

Categories of Personal Data processed: (a) identifiers, including name, business email address, employer name, and job title; (b) commercial information limited to professional engagement signals; (c) internet or other electronic activity information, including page views, clicks, agent interactions, and event timestamps; (d) inferences drawn from publicly available business signals associated with Prospects; and (e) scores of how well accounts and contacts fit a customer’s target profile, which constitute profiling for direct marketing and do not produce decisions with legal or similarly significant effects. We do not knowingly collect special categories of personal data within the meaning of GDPR Article 9.

Lawful bases under GDPR: (a) performance of a contract with you or with your employer (Article 6(1)(b)); (b) consent for marketing communications to customers and website visitors and for any optional cookies (Article 6(1)(a)); (c) legitimate interests in operating, securing, and improving the Services, in conducting Prospect research and in b2n.ai’s own outreach to business prospects (§ 6A) (Article 6(1)(f)), balanced against the rights and freedoms of data subjects; and (d) compliance with legal obligations to which we are subject (Article 6(1)(c)).

Roles. For each customer’s campaigns, the customer is the controller of the Prospect Data used and b2n.ai processes it as the customer’s processor under the Terms of Service and the Data Processing Addendum. For the business-contact data that b2n.ai holds and keeps up to date independently of any one customer, b2n.ai is the controller.

Lawful basis. Legitimate interests (GDPR Article 6(1)(f)), for b2n.ai’s own business-contact data and for client campaigns where the client relies on it. The legitimate-interest balancing test considers the limited scope (business contact and professional information), the reasonable expectation of business professionals to be contacted in a B2B context, and the unconditional right to opt out. The client decides the lawful basis for its own outreach, including any consent required by electronic-marketing rules in the recipient’s country (Terms of Service, Section 6). b2n.ai is established in the United Arab Emirates, so its own processing is also subject to UAE Federal Decree-Law No. 45 of 2021. For data subjects in the UAE, b2n.ai relies on Article 4(2) of that law, for data the data subject has made available to the public themselves, or on another case listed in Article 4. For data subjects in Saudi Arabia, b2n.ai relies on legitimate interests under Article 6(4) of the Saudi Personal Data Protection Law.

Categories of data. Name, job title, employer, work email and phone, professional profile URL, LinkedIn member identifier and connection status, company information, engagement with messages, the content of replies and conversations, opt-out records, and fit scores.

Sources (GDPR Article 14(2)(f)). Publicly accessible sources, including company websites, business directories, public professional profiles, news and filings; B2B contact-data providers; the business-contact data b2n.ai holds as controller; and lists supplied by the customer. On request, b2n.ai tells a data subject the specific source of their data where it is known.

Recipients. The customer whose campaign the data is used in, the subprocessors listed in § 5 and in the Data Processing Addendum, and authorities where the law requires.

Profiling. Accounts and contacts are scored for fit with the customer’s target profile. There are no decisions with legal or similarly significant effects.

Retention. Prospect records used in a customer’s campaigns are kept until the customer instructs b2n.ai to delete them, or the data subject’s erasure request is upheld. Opt-out and objection records are kept for as long as needed to keep honouring them.

Rights and timing. An unsubscribe or objection to direct marketing made in response to a customer’s outreach stops that customer’s outreach to the data subject immediately. An objection to direct marketing sent to b2n.ai at privacy@b2n.ai is acted on without undue delay and in any event within one month of receipt; b2n.ai then ends its use of the business-contact data it holds about the data subject for direct marketing, for all customers (GDPR Article 21(3)). Other requests about data for which b2n.ai is the controller are answered without undue delay and within one month, which may be extended where GDPR Article 12(3) allows. Requests about a customer’s campaign are forwarded to that customer under the Data Processing Addendum. Within a client campaign, b2n.ai does not process Prospect Data for any purpose unrelated to that customer’s outreach, other than keeping the platform-wide block list described in Section 12 of the Data Processing Addendum.

Notice. This section is the information GDPR Article 14 requires for prospects. For a customer’s campaigns it is given on the customer’s behalf. Each email identifies the sender and contains an unsubscribe text and link to the unsubscribe page, which carries this information. Where b2n.ai holds business-contact data independently and has not contacted the person within one month of obtaining it, b2n.ai makes this information publicly available here and relies on GDPR Article 14(5)(b).

Where b2n.ai uses the Services to contact businesses about its own services, Between Technologies FZ-LLC is the controller of the Prospect Data concerned. § 6 applies to that processing as it does to client campaigns, with b2n.ai in the place of the customer.

The b2n.ai Assistant extension for Google Chrome (the “Extension”) processes the following Personal Data solely to provide the Extension’s single purpose of executing LinkedIn actions that a Customer has approved in the Services, whether approved by a user or by the Customer’s AutoPilot setting with a cancellation period, and reporting their results, including replies, to the Customer: (a) the LinkedIn display name and profile URL of the signed-in user, to associate the browser with the Customer’s sender; (b) for Prospects in the Customer’s approved sequences, the LinkedIn member identifier, profile URL, and connection status; (c) message event identifiers used to determine whether a Prospect replied and, where the user has agreed to the in-product disclosure describing it, the text of messages exchanged with that Prospect after the Customer’s first message sent through the Services (the Prospect’s replies and the user’s own messages), excluding earlier messages and attachments, used to display the conversation to the Customer in the Services; and (d) the outcome of each action, including diagnostic names displayed on the page where a safety check prevented the action. Data is transmitted to b2n.ai over encrypted connections (TLS 1.2 or higher).

The Extension does not collect authentication credentials or cookies, browsing activity outside LinkedIn, or content unrelated to an approved action. Data is collected only after the user has agreed to an in-product disclosure. The lawful basis is performance of the Customer contract (GDPR Article 6(1)(b)) for the signed-in user and legitimate interest (Article 6(1)(f)) for Prospects, on the terms set out in § 6.

b2n.ai’s use of information collected through the Extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Such information is not sold; not transferred to third parties except subprocessors listed in § 5 acting on our instructions, as required by law, or as part of a merger or acquisition; not used or transferred for personalised advertising or to determine creditworthiness or for lending purposes; and not read by humans except with the user’s consent, for security purposes, to comply with applicable law, or in aggregated and anonymised form for internal operations.

Cross-border transfers of Personal Data from the EEA, UK, or Switzerland to third countries are governed by the European Commission’s Standard Contractual Clauses (Module 2 or Module 3, as applicable), supplemented by additional safeguards where required following a transfer impact assessment. Customers and data subjects may request a copy of these safeguards, with commercial terms removed, at privacy@b2n.ai.

Transfers of Personal Data outside the United Arab Emirates are made in accordance with Articles 22 and 23 of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Transfers of Personal Data outside the Kingdom of Saudi Arabia are made in accordance with the Saudi Personal Data Protection Law and its implementing regulations on transfers outside the Kingdom.

Data subjects in the EEA, the UK, and Switzerland may exercise rights of access, rectification, erasure, restriction, portability, and objection under the GDPR. Under GDPR Article 21(2) and (3), a data subject may object at any time to processing of their Personal Data for direct marketing, including profiling to the extent it is related to such marketing, and the data will then no longer be processed for those purposes. California residents may exercise the rights described in the California Consumer Privacy Act, including the right to know, the right to delete, and the right to opt out of the sale or sharing of personal information. To opt out of the sale or sharing of your personal information, write to privacy@b2n.ai with the subject “Do not sell or share my information”. We will act on it without undue delay.

Data subjects whose Personal Data is protected by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data may exercise the rights in Articles 13 to 18 of that law, including the rights to obtain information, to data portability, to correction or erasure, to restriction of processing, to stop processing, and in relation to automated processing. Data subjects whose Personal Data is protected by the Saudi Personal Data Protection Law may exercise the rights it grants, including the rights to be informed, to access, to correction and to destruction of their Personal Data.

Data subjects also have the right to lodge a complaint with the relevant authority, including the UAE Data Office, the Saudi Data & Artificial Intelligence Authority (SDAIA), the UK Information Commissioner’s Office (ICO), and the supervisory authority of their EU Member State. We will not discriminate against you for exercising any of these rights.

Personal Data is retained for as long as is necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. The criteria used to determine retention include (a) the duration of the customer relationship, (b) statutory retention obligations, including UAE corporate tax law, which requires billing and tax records to be retained for at least seven years, (c) limitation periods applicable to potential claims, and (d) the legitimate interest in retaining information necessary to defend or pursue legal rights. Prospect Data used in a client campaign is retained until the customer instructs b2n.ai to delete it, or the data subject’s erasure request is upheld. Business-contact data that b2n.ai holds as controller is retained until the data subject’s erasure request is upheld. Records of opt-outs and objections are retained for as long as necessary to continue honouring them. Aggregated and de-identified data, which does not identify any individual, may be retained indefinitely.

b2n.ai maintains technical and organisational measures appropriate to the risk of processing, including encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), principle-of-least-privilege access controls, vendor security review, vulnerability monitoring, and an incident-response process consistent with GDPR Articles 32 and 33. Customers may request a current security overview at privacy@b2n.ai.

b2n.ai’s agents score accounts and contacts for fit and draft messages. This processing does not produce decisions with legal or similarly significant effects on data subjects within the meaning of GDPR Article 22. Messages are sent as the Customer approves them, message by message or through automatic settings the Customer turns on (such as automatic sending or AutoPilot). Where the Customer turns on automatic sending, messages are sent without individual review, and the Customer is responsible for those settings (Terms of Service, Section 6.4). Data subjects may request human review, contest a decision, and obtain an explanation of the logic involved by contacting privacy@b2n.ai. b2n.ai contractually prohibits its subprocessors from using Customer Data, Prospect Data, or message content to train, fine-tune, or otherwise adapt any AI model, whether shared, general-purpose, or customer-specific, and limits the use of such data to the specific purposes set out in this Policy and the customer agreement.