Privacy and Data
Protection Policy

Information about us

BVision.AI is the brand name and platform of FORTVISION LTD, a company incorporated under the laws of Israel with company registration number 515224905, and whose registered address is in Israel ("FORTVISION", "BVision.AI", "we", "us", or "our").

For the purposes of the European Union's ("EU") General Data Protection Regulation 2016/679 ("GDPR") and other applicable privacy laws, BVision.AI is a data controller ("Controller") in relation to the personal data of our former and current employees, directors, officers, management, representatives, clients, service providers, website visitors and whistleblowers. Likewise, BVision.AI is a Business (as defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, "CCPA")), and other US state privacy laws, subject to their applicability to BVision.AI.

For the purposes of the GDPR and other applicable privacy laws, BVision.AI is a data processor ("Processor") in relation to your personal data processed in connection with our provision of the Services. Therefore, when processing such personal data, we are doing so on behalf of our clients, who are Controllers of such personal data, and such processing is governed by the applicable Data Processing Agreement ("DPA") with the relevant Controller (i.e., client).

If your personal data is provided to us by a client in connection with the provision of the Services, please contact our relevant client in order to receive further information regarding the processing of your personal data in connection with the Services.

As FORTVISION LTD is incorporated in Israel — a country recognized by the European Commission as providing an adequate level of data protection — transfers of Personal Data from the EEA to BVision.AI's primary operations in Israel benefit from an EU adequacy ruling.

Information we collect and how we collect it

2.1 Engagements with Employees

We obtain your Personal Data from you directly, for example, during the course of your employment. Personal Data we collect includes: your name, social security or identification number, mailing address, email address, phone number, age, gender, salary, education, professional designation, employment history, resume details, references, interview notes, performance review notes, and emergency contact information.

We collect this data for: fulfillment of our contractual obligations to you (Performance of a Contract); evaluation of your candidacy for employment (Legitimate Interests); general business management (Legitimate Interests); and statutory reporting obligations (Legal Obligation).

2.2 Engagements with Clients and Service Providers

We may obtain your Personal Data from you directly or publicly-available sources. Personal Data we collect includes: your business name, name of your representative, business mailing address, business email address, business phone number, business payment details, and job title of your representative. For anti-money laundering requirements, we may also collect date of birth, utility bill information, copies of passports or identification cards, and nationality.

We collect this data for: fulfillment of our contractual obligations (Performance of a Contract); establishment and management of our relationship (Legitimate Interests); general business management (Legitimate Interests); security management (Legitimate Interests and Legal Obligation); and statutory reporting obligations (Legal Obligation).

2.3 Processing of Personal Data in Connection with the Services

We may obtain your Personal Data from you directly or from our clients. Personal Data we collect includes: your name, email address, username, password, audio recordings of support service calls, and the phone number of the caller (excluding identification numbers and credit card numbers).

Please note that any Personal Data processed as described in this section is processed by us in our role as a Processor on behalf of our clients in their role as a Controller, in connection with our provision of Services to them.

2.4 Whistleblowing

If you submit a whistleblower report through our internal reporting channel, we collect your name, email address, and employee number. You may submit anonymously; if you do, we collect only information included in the report itself. We process this data to comply with whistleblowing standards and legal requirements (Legitimate Interests; Legal Obligation).

2.5 Website Visitors

When you access our website, we or our third-party service providers may collect: your IP address, URL, type of operating system, browser type, browser plug-in versions, screen resolution, Flash version, time zone setting, clickstream data, the period of time you accessed our website, and methods used to browse away from our website. We use this information to maintain and improve the operation of our website (Legitimate Interests).

If you object to our use of your Personal Data for any of the aforementioned purposes, please contact us at privacy@bvision.ai.

Sharing data with third parties

BVision.AI maintains an updated list of the categories of third parties to which it discloses Personal Data, including the categories of Personal Data shared, the business purposes, and where such third parties are located internationally. To receive notification of changes to our sub-processor list, contact us at privacy@bvision.ai.

Mergers and Acquisitions: We will disclose your Personal Data to third parties if some or all of our shares or assets are acquired by a third party, including by way of a merger, share acquisition, or asset purchase, in which case Personal Data will be one of the transferred assets.

Legal and Regulatory Obligations: We transfer Personal Data to third parties if we are under a duty to disclose or share your Personal Data in order to comply with any legal, audit or compliance obligation, in the course of any legal or regulatory proceeding or investigation, in order to enforce or apply our terms and other agreements, or in order to assert or protect our rights, property or safety.

Where we store your data

We store your Personal Data on servers owned and controlled by BVision.AI or its affiliates or processed by third parties on behalf of BVision.AI, such as reputable cloud service providers. This includes, but is not limited to, storage in the United States of America ("USA"), the EU, and the UK.

All data storage locations maintain appropriate technical and organizational security measures consistent with our Data Processing Agreement and applicable data protection laws. We conduct regular reviews of our storage infrastructure to ensure ongoing compliance.

International data transfers

We transfer, store and process Personal Data to locations outside of the EEA and the UK in order to facilitate the purposes described in Section 2. This includes transfers to the USA and other jurisdictions where our third-party service providers are located.

We transfer Personal Data to locations outside the EEA and UK in order to: store or backup the information; enable us to fulfill our contractual commitments; enable us to fulfill legal, auditory, ethical or compliance obligations; facilitate the operation of our business; serve you across multiple jurisdictions; and operate our affiliates in an efficient and optimal manner.

Where your Personal Data is transferred outside of the EEA or the UK, we take reasonably necessary steps to ensure that your Personal Data is subject to appropriate safeguards:

• Transfers from the EEA to Israel are made based on the European Commission's adequacy ruling recognizing Israel as providing adequate data protection
• Transfers from the EEA to the USA are made based on the EU-US Data Protection Framework or Standard Contractual Clauses (SCCs) published by the European Commission
• Transfers from the UK to the EEA or Israel are made based on the UK's Adequacy Regulations
• Transfers from the UK to the USA or other non-adequate countries are made based on the UK's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
• All other international transfers are made pursuant to approved transfer mechanisms under applicable law

For more information about these safeguards, please contact us at privacy@bvision.ai.

Data retention

BVision.AI will retain Personal Data we process only for as long as required in order to fulfill each purpose for which such Personal Data is collected, in accordance with our data retention policy, and as necessary to comply with our legal and other obligations, resolve disputes, and enforce agreements. We will also retain Personal Data to meet audit, compliance, and business best-practice requirements.

Personal Data that is no longer retained will be anonymized or deleted. Some metadata and statistical information concerning the use of our website and the Services are not subject to the deletion procedures in this Privacy Policy and will be retained by BVision.AI. We will not be able to identify you from this data.

Some data may also be retained on our third-party service providers' servers until deleted in accordance with their privacy policy and retention policy, and in our backups until overwritten.

Data collection from our website and from cookies

Our website uses cookies, pixel tags and other forms of identification and local storage (collectively, "cookies") to distinguish you from other visitors of our website. This helps us to provide you with an optimal user experience and allows us to provide and improve our website.

Cookies are computer files containing small amounts of information which are downloaded to a user's device when visiting a website. Cookies fall into several distinct categories:

• Essential cookies: Strictly necessary for the website to function, such as enabling page navigation, access to secure areas, and core functionalities
• Functional cookies: Enhance usability and performance by remembering visitor preferences and settings
• Analytics cookies: Used to carry out website performance and audience metrics
• Marketing cookies: Used for tracking visitor behavior across websites for targeted advertising

BVision.AI uses only essential (functional) cookies. We do not use non-essential cookies such as cookies for marketing and advertising purposes. Functionality cookies do not require your consent.

You can block cookies by activating the settings on your browser that allow you to refuse the settings of all or some cookies. However, if you block all cookies, you may not be able to access all or parts of our website. For more information on managing cookies, visit aboutcookies.org.

Security and storage of data

We take great care in implementing, enforcing and maintaining the security of the Personal Data we process. BVision.AI implements, enforces and maintains security measures, technologies and policies to prevent the unauthorized or accidental access to or destruction, loss, modification, use or disclosure of Personal Data. Our security practices include:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Role-based access controls and least-privilege access principles
• Multi-factor authentication (MFA) for all internal systems
• Regular penetration testing by independent third parties
• SOC 2 Type II certification, reviewed annually
• Continuous security monitoring and anomaly detection
• Periodic security awareness training for all employees

Please note that no data security measures are perfect or impenetrable and we cannot guarantee that unauthorized access, leaks, viruses and other data security breaches will never occur.

We endeavor to limit access to Personal Data to those of our personnel who require access to fulfill our obligations, have been appropriately trained with respect to the requirements applicable to the processing of Personal Data, and are under confidentiality obligations as required under applicable law.

We act in accordance with applicable law to promptly notify the relevant authorities and Data Subjects in the event that any Personal Data is lost, stolen, modified or disclosed or where there has been unauthorized access to it. BVision.AI shall promptly take reasonable remedial measures.

Data subject rights

Data Subjects in certain jurisdictions, such as in the EU and the UK, have rights granted pursuant to local laws under certain circumstances and with certain exceptions, including:

To exercise any of your rights, contact us at privacy@bvision.ai. Please note that BVision.AI may have to undertake a process to identify a Data Subject prior to facilitating the exercise of such rights. Data Subjects in the EU, the UK and other jurisdictions have the right to file a complaint with a local data protection supervisory authority, as well as pursue an effective judicial remedy.

US states' privacy rights

This section provides additional details about the Personal Data we collect about consumers in California, Virginia, Colorado, Connecticut, Utah, Iowa, Tennessee, Texas, Oregon, Nebraska, New Hampshire, Montana, New Jersey, Indiana, Delaware, Nevada and other applicable US states, subject to the applicability of their respective privacy laws.

We neither sell nor share personal information to third parties.

Subject to certain limitations, CCPA and other applicable US state laws provide consumers certain rights, including:

• The right to be provided with a notice of our practices regarding the collection, use, sale and sharing of personal information
• The right to request a summary of the personal information we have collected about you, including specific pieces of personal information
• The right to delete the personal information we have collected about you
• The right to opt-out of the sale or sharing of your personal information
• The right to not be discriminated against due to the exercise of your rights
• The right to limit our collection and processing of your sensitive personal information
• The right to opt-out of the use of your personal information for automated decision-making
• The right to correct your personal information
• A private right of action when your unencrypted or unredacted personal information is breached (California)

To make such requests, please contact us at privacy@bvision.ai. Government identification may be required. You can also designate an authorized agent to exercise these rights on your behalf. Please note that your entitlement to exercise any of the aforementioned rights is subject to the applicability of the specific privacy law to BVision.AI that grants such right.

Do Not Track signals

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers to inform websites that they do not wish to be tracked. BVision.AI honors DNT signals. When a valid DNT signal is detected, we do not place non-essential tracking technologies on your device.

Changes to this Privacy Policy

The terms of this Privacy Policy will govern the provision of the Services and any data collected in connection with them and BVision.AI's contractual obligations. BVision.AI may amend or update this Privacy Policy from time to time. The most current version will always be available at bvision.ai/privacy.

Changes to this Privacy Policy are effective as of the date stated as "Last updated" at the top of this page. Your continued engagement with us or use of the Services following the effective date of any changes will constitute your active acceptance of the changes to the terms of this Privacy Policy. Where required by applicable law, we will obtain your consent to material changes.

Contact us

BVision.AI (FORTVISION LTD) aims to process only adequate, accurate and relevant data limited to the needs and purposes for which it is gathered. We also aim to store data only for the time period necessary in order to fulfill the purpose for which it was gathered.

Our policies and practices are constantly evolving and we invite any suggestions for improvements, questions, complaints or comments concerning this Privacy Policy. We will make an effort to reply within a reasonable timeframe.