Privacy Policy

1. Purpose and Scope

This Privacy & Data Protection Policy (the “Policy”) sets out the principles and framework governing the collection, use, processing, storage, and disclosure of personal data by Beirut Brokerage Corporation SAL (the “Company”, “we”, “us”, or “our”).

The Company acts as the data controller in relation to the personal data it processes.

As a licensed financial institution operating under the supervision of the Banque du Liban and the Capital Markets Authority, the Company is subject to strict regulatory obligations, particularly in relation to anti-money laundering and counter-terrorism financing (AML/CFT). These obligations require the collection and processing of personal data as part of client onboarding, risk assessment, and ongoing monitoring.

The Company processes personal data in accordance with applicable Lebanese laws and regulations, including the regulatory requirements of the Banque du Liban, notably those relating to data confidentiality, information security, and electronic services.

This Policy aims to:

• Ensure transparency in how personal data is handled
• Define internal standards for data protection and confidentiality
• Inform clients and users of their rights and how their data is used

This Policy applies to:

• Clients and prospective clients
• Users of the Company’s website and digital onboarding systems
• Any individual whose personal data is processed in the course of the Company’s activities

This document serves both as the Company’s internal data protection policy and its external privacy notice.

2. Data Protection Principles

The Company adheres to the following core data protection principles:

2.1 Lawfulness, Fairness and Transparency

Personal data is processed in a lawful manner, based on valid legal grounds, and in a way that is clear and understandable to clients.

2.2 Purpose Limitation

Data is collected only for specific and legitimate purposes, primarily related to regulatory compliance and the provision of financial services, and is not used in ways incompatible with those purposes.

2.3 Data Minimization

Only personal data that is necessary for the intended purpose is collected and processed. The Company avoids excessive or unnecessary data collection.

2.4 Accuracy

Reasonable steps are taken to ensure that personal data is accurate, complete, and kept up to date.

2.5 Storage Limitation

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal and regulatory obligations.

2.6 Integrity and Confidentiality

Personal data is protected against unauthorized access, loss, misuse, or disclosure through appropriate technical and organizational safeguards.

3. Categories of Personal Data

In the course of its activities, the Company may collect and process various types of personal data, depending on the nature of the relationship with the client.

3.1 Identity and Verification Data

This includes basic identifying information necessary to establish the identity of clients:

• Full name, date and place of birth
• Nationality and identification numbers
• Copies of official identification documents (passport, national ID, etc.)

This data is essential for verifying identity and meeting regulatory requirements.

3.2 Contact Data

This includes information used to communicate with clients:

• Residential or mailing address
• Email address
• Telephone number

3.3 Financial and Economic Data

This category includes information required to understand the financial profile of the client:

• Source of funds and source of wealth
• Employment status and professional information
• Bank account details and payment information

This data supports both regulatory compliance and suitability assessments where applicable.

3.4 KYC / AML Data

This includes information generated or assessed as part of compliance processes:

• Risk classification and client profile
• Politically Exposed Person (PEP) status
• Sanctions screening and verification results

3.5 Technical and Usage Data

When interacting with the Company’s systems or website, certain technical data may be collected:

• IP address
• Device and browser information
• Website usage patterns and access logs
• Campaign attribution data: when you arrive via a campaign link or an ad, the campaign’s tags, the ad platform’s click identifier and a short opaque token (22 characters) are kept in a cookie on your device (see our Cookies Policy). If you tap a link on our website to download the App, the website also copies a short line with this information to your device’s clipboard, so that the App can read it when you first open it (see Section 13.1). If you sign up, this information is recorded alongside your sign-up details and used to match your account opening to the campaign that brought you. The token itself is a random value and does not encode any personal data; the Company stores only a one-way hash of it.
• Advertising measurement data: only if you have allowed Marketing cookies, your email address and phone number are passed to Meta in a scrambled (hashed) form when you send us your details or open an account, so that the results of our advertising can be measured (see our Cookies Policy).

This data is used for security, system performance, analytics, and marketing effectiveness measurement.

3.6 Biometric and Verification Data

As part of digital onboarding, the Company may process:

• Facial recognition and liveness detection data
• Identity verification results

This data is collected through specialized providers such as Sumsub, and is used solely for identity verification and fraud prevention.

4. Methods of Data Collection

Personal data is collected through various channels, depending on the interaction with the Company:

4.1 Direct Collection

Data is collected directly from clients when they:

• Complete onboarding or application forms
• Communicate with the Company
• Request services

4.2 Digital Onboarding Systems

The Company uses digital onboarding platforms to streamline identity verification and compliance processes.

4.3 Third-Party Sources

To meet regulatory requirements, data may be obtained from:

• Identity verification providers
• Public registries and official records
• Compliance and screening databases

4.4 Automated Technologies

When using the Company’s website, certain data is collected automatically through:

• Cookies
• System logs
• Analytics tools

5. Purpose of Processing and Legal Basis

In most cases, the processing of personal data is required by law or is necessary for the Company to provide its services.

5.1 Regulatory Compliance (Legal Obligation)

The primary purpose of processing is to comply with AML/CFT laws and regulatory requirements. This includes:

• Verifying client identity (CDD/KYC)
• Assessing risk and client profiles
• Monitoring transactions and activities
• Reporting suspicious transactions to authorities

5.2 Provision of Services (Contractual Necessity)

Personal data is processed to:

• Evaluate client applications
• Onboard clients
• Provide brokerage or arranging services
• Maintain ongoing relationships

5.3 Operational Purposes (Legitimate Interests)

The Company processes data to:

• Maintain accurate records and audit trails
• Improve systems and services
• Manage communications
• Prevent fraud and enhance security
• Measure the effectiveness of its marketing campaigns and attribute account openings to the correct campaign, using first-party attribution tokens (see Section 3.5)
• Contact clients and prospective clients about their account and the help they asked for: the Company’s team may call, or write on WhatsApp or by email, about opening, verifying or funding an account, or about a request the person made. To do so, the Company keeps a copy of account details in its own client relationship system, which only its authorised staff can use

5.4 Consent-Based Processing

In certain limited situations, the Company may process personal data based on the client’s consent. This typically applies to processing that is not strictly required by law or for the provision of core services, such as:

• Marketing communications, such as messages about the Company’s products and offers on WhatsApp or by email, sent only to people who agreed to receive them (for example by ticking “I agree to BBCorp contacting me on WhatsApp” or “I agree to BBCorp sending me emails” on one of the Company’s forms)
• Optional services or features

Clients may withdraw their consent at any time: for WhatsApp messages, by replying STOP or blocking marketing messages from the Company in WhatsApp; for emails, by using the unsubscribe link in any email; and for either, by contacting the Company (see Section 15). The Company then stops sending them. However:

• Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal
• It does not apply to processing required by law (such as AML/KYC)

6. Data Sharing and Disclosure

Personal data may be shared with third parties where necessary and appropriate.

6.1 Service Providers

The Company works with specialized providers to support its operations, including:

• Sumsub, for identity verification, fraud prevention, and compliance checks
• Google Firebase Cloud Messaging, for delivering notifications in the BBCorp app (see Section 13)
• OpenRouter, for the AI models behind Agent B, the BBCorp app’s assistant (see Section 13)
• Central, the service the Company uses to send and receive WhatsApp messages, and WhatsApp (Meta Platforms), which carries them
• The Company’s email service provider, for the emails it sends
• IT and system providers responsible for infrastructure, hosting, and security

These providers are contractually bound to maintain confidentiality and protect personal data.

6.2 Partner Brokers

Where services involve arranging or facilitating account opening, personal data may be shared with partner brokers.

The Company may share personal data with partner brokers, including entities that may be under common ownership or management with the Company.

Such partner brokers may be located in jurisdictions outside Lebanon, and by engaging with the Company’s services, clients acknowledge and accept that their personal data may be transferred and processed in such jurisdictions for the purpose of service provision.

6.3 Regulatory Authorities

Personal data may be disclosed where required by law, including to:

• Special Investigation Commission (SIC)
• Banque du Liban
• Capital Markets Authority
• Law enforcement agencies

6.4 Professional Advisors and Financial Institutions

Data may also be shared with:

• Banks and payment providers
• Auditors, legal advisors, and consultants

7. International Data Transfers

Due to the nature of the Company’s operations, personal data may be transferred to jurisdictions outside Lebanon.

Where such transfers occur:

• Transfers are limited to what is necessary
• The receiving parties are required to apply appropriate data protection and confidentiality standards
• Contractual and organizational safeguards are applied

8. Data Retention

Personal data is retained in line with legal and operational requirements.

In particular:

• AML/CFT-related data is retained for the minimum period required by law
• Data may be retained for audit and legal purposes
• Campaign attribution tokens are retained for as long as the associated sign-up record is kept, and deleted or anonymized with it
• Once no longer needed, data is securely deleted or anonymized

9. Automated Decision-Making and Profiling

The Company may use automated systems as part of onboarding and compliance processes.

These may include:

• Identity verification tools
• Risk assessment models
• Eligibility checks

Such processes may involve the use of profiling based on financial or identification data, strictly for compliance and risk assessment purposes.

Where applicable, clients may request a review of these assessments and decisions.

10. Data Subject Rights

Clients may have the following rights:

• Access to their personal data
• Correction of inaccurate data
• Deletion of data (subject to regulatory and legal constraints)
• Restriction or objection to processing
• Data portability (where applicable)
• Withdrawal of consent (where applicable)
• File a complaint with a competent authority, where applicable

Requests are handled within a reasonable timeframe, typically within 10 days.

11. Data Security and Confidentiality

The Company maintains strong security measures, including:

• Controlled access to systems and data
• Secure Storage and encrypted communications (where applicable)
• Monitoring mechanisms
• Staff confidentiality obligations

These measures are designed to prevent unauthorized access or misuse of personal data. While the Company implements robust technical and organizational measures to protect personal data in accordance with applicable regulatory requirements. However, no system or transmission can be guaranteed to be completely secure.

To the fullest extent permitted by applicable law, the Company shall not be held liable for any unauthorized access, data breaches, loss, or alteration of personal data resulting from cyber incidents, system failures, or acts or omissions of third parties, where such events occur beyond the Company’s reasonable control, provided that the Company has complied with its legal and regulatory obligations and implemented appropriate safeguards

12. Cookies and Website Technologies

Cookies and similar technologies may be used to:

• Enhance user experience
• Analyse website performance
• Improve security
• Measure the performance of our advertising

Analytics and marketing cookies are used only with your consent, which you give or refuse on our cookie banner and can change at any time using the “Cookie settings” link at the bottom of our website. Our Cookies Policy lists every cookie we use, what it is for and how long it stays. Users can also manage cookie settings through their browser.

13. The BBCorp App

This section applies to the BBCorp mobile app for iPhone and Android (the “App”). The rest of this Policy applies to the App as well.

13.1 What the App Collects

• Account and identity data you enter: your name, email address, phone number, country, and the information requested for identity verification
• Financial data shown in the App: your wallet and trading account balances, deposits, withdrawals, and transfers
• Device data: the device model and operating system, the App version and language, and a notification token
• Usage data: the screens you open and the actions you take in the App, sent to the Company’s own systems to keep the App working and to improve it
• Messages, photos, documents, and voice messages you send to Agent B, the App’s assistant
• How you found the App: if you opened or installed the App from one of our campaign links or ads, the campaign’s tags, the ad platform’s click identifier and our campaign token, read from the link, from Google Play when you install the App on Android, or, once when you first open the App, from a line our website copied to your clipboard (your phone shows that the App pasted it, and the App then clears it). This is kept on your phone for up to 30 days and recorded with your sign-up details if you open an account, only to match your account opening to the campaign that brought you. The App does not read anything else from your clipboard.
• Your tracking choice (which of Analytics and Marketing you allowed, and when) and, only if you allow Marketing, your device’s advertising identifier and a reference number for your registration, recorded with your sign-up details.

13.2 Face ID, Touch ID, and Fingerprint

If you choose to unlock the App with Face ID, Touch ID, or your fingerprint, the check takes place on your device. The App never receives or stores your face or fingerprint data.

13.3 Camera, Microphone, and Photos

The App asks for your permission before it uses the camera, microphone, or photo library, and uses them only for identity verification and for the photos, documents, and voice messages you choose to send to Agent B.

13.4 Service Providers for the App

• Google Firebase Cloud Messaging delivers the App’s notifications. It receives your device’s notification token and the content of each notification.
• OpenRouter connects Agent B to the artificial intelligence models that write its replies. When you use Agent B, your messages, and the account details needed to answer them, are sent through OpenRouter to the model provider. A photo or document you send is read to answer you and is not kept. A voice message is sent through OpenRouter to be turned into text, which you see before you send it; the recording is not kept.
• Meta (Facebook and Instagram) and TikTok, on Android and only if you allow Marketing: they receive the App’s installation and opening; when you start and complete registration, submit identity documents, open the deposit screen (the payment method, never the amount), tap Support or view the accounts and funding screens; your device’s advertising identifier; and, at registration, your email address and phone number, which their tools scramble (hash) on your phone before sending. They use this to measure our advertising and show our ads. Names, dates of birth, ID numbers, documents, balances and trades are never sent.

These providers process data on the Company’s behalf and may do so outside Lebanon (see Section 7).

13.5 What Agent B Remembers

Agent B keeps your conversations and short notes on what you have asked before, so that it can answer you better. You can see these notes under “What I know about you” on Agent B’s page in the App, and remove any of them.

13.6 No Advertising or Third-Party Tracking

The App shows no advertising. On iPhone, it contains no third-party advertising or analytics tools. On Android, it contains Meta’s and TikTok’s tools (Section 13.4), which run only if you allow Marketing when the App asks on first open; Analytics and Marketing are off until you allow them. You can change your choice at any time in Profile › Privacy, and turning Marketing off stops these tools from that moment. Data already sent is not recalled.

13.7 Closing Your Account

You can ask to close your account from the App (Profile, then Other, then Close my account) or by contacting the Company (see Section 15). Data the Company must keep by law, such as AML/CFT records, is kept for the period the law requires and then deleted or anonymized (see Section 8).

14. Governance and Responsibility

The Compliance Function is responsible for overseeing data protection practices and ensuring compliance with this Policy.

All employees are required to:

• Handle personal data responsibly
• Maintain confidentiality
• Follow internal procedures

15. Contact Information

For any inquiries regarding this Policy:

Compliance Department

Beirut Brokerage Corporation SAL

Email: compliance@bbcorpfx.com

Address: Beirut, Verdun, Diamond Building, 8th floor

Phone: +9611789101

16. Policy Updates

This Policy may be updated periodically to reflect legal or operational changes.

The latest version will always be made available through the Company’s official channels.