Legal

Data Subject Notice

For business professionals whose information may appear in Kuration AI's database — what we hold, why, and the rights you can exercise.

Last updated 17 April 2026

Last Updated: 17 April 2026

This notice is for business professionals whose name, work email, work phone, job title, or other professional information may appear in Kuration AI's database. You may be seeing it because a colleague forwarded it, because we have reached out to you, or because you found us through a directory page or a search result.

We did not collect this information directly from you. Under the EU GDPR (Article 14), the UK GDPR, the Hong Kong Personal Data (Privacy) Ordinance (PDPO), the UAE PDPL, the California CCPA/CPRA, and other data protection laws, you have the right to know how we use your data and to exercise specific rights over it. This notice explains both.

1. Who is responsible for your data

Kuration AI Limited Company Registration No. 76420894, Hong Kong Registered office: Unit 2A, 17/F., Glenealy Tower, No. 1 Glenealy, Central, Hong Kong

We act as an independent data controller for the information about you that we have compiled from public and professional sources. Our Data Protection contact is privacy@kuration.ai.

2. What we hold

For a typical business professional, the information we may hold includes:

  • Full name
  • Professional email address (work domain)
  • Professional phone number (where available)
  • Job title
  • Employer name, website, and industry
  • LinkedIn or other professional social-media profile (public)
  • City and country of work
  • Publicly reported events, conferences, or committees attended
  • Publicly available biographical information (e.g., language skills, prior employers)

We do not knowingly collect sensitive categories of personal data (health information, religion, political opinions, sexual orientation, biometric data, precise location, or data of children). We do not collect information about your personal, non-professional life.

3. Where we got it

Kuration AI compiles professional data from lawful, publicly available, or purchased sources. In practice, our sources typically include one or more of:

  • Company websites and corporate filings
  • Official registries (commercial registries, regulatory registries, licensing authorities, public tender records)
  • Professional social networks (such as LinkedIn) where information is published publicly
  • Industry associations and published directories
  • Trade-show and conference attendee lists and exhibitor catalogues
  • Press releases, news articles, and professional publications
  • Proprietary research by our in-house team and the Brainsfeed research network, drawing only from the sources above
  • Partner data providers that have represented to us that they obtained the data lawfully

We do not use hacking, credential theft, phishing, or unauthorised access. Where we collect data by automated means, we respect robots.txt directives and site terms.

4. Why we hold it

We hold this information to provide B2B data intelligence services — a database and platform that our customers (other businesses) use to identify, research, and contact organisations and the business professionals who work in them, for sales, research, recruitment, and partnership purposes.

Our customers are contractually required to use the data only for lawful, business-to-business purposes. They are prohibited from using it for consumer marketing, credit / employment / housing / insurance decisions, training AI models that compete with us, redistribution, harassment, or discrimination. See our Acceptable Use Policy for the full list.

For data subjects in the European Economic Area, the United Kingdom, and jurisdictions with equivalent frameworks:

  • Legitimate interests (GDPR Art. 6(1)(f)). Our legitimate interest is in providing a B2B data intelligence service. Your professional interest in being contactable in a business context is well established, and we have conducted a written Legitimate Interests Assessment (LIA) which concluded that our processing does not override the rights and reasonable expectations of data subjects in a professional context.

For data subjects in jurisdictions without a "legitimate interests" concept, the equivalent basis under local law applies (e.g., PDPO: use for a purpose directly related to the purpose for which the data was collected; PDPL / KSA PDPL: legitimate interest or equivalent; CCPA: a covered business-to-business purpose).

6. Who we share it with

We share data with:

We do not sell your personal data to advertisers, and we do not include it in data monetisation schemes outside of our core B2B licensing model.

7. International transfers

We are established in Hong Kong. Our infrastructure and sub-processors include providers located in the European Union, the United Kingdom, the United States, and other regions. Where transfers require a specific safeguard (for example, transfers from the EEA to a third country without an adequacy decision), we rely on the European Commission's Standard Contractual Clauses and, for UK transfers, the UK ICO's International Data Transfer Addendum, supplemented by additional measures as appropriate. See our Data Processing Agreement for the full text.

8. How long we keep it

We keep professional data for as long as it remains useful for our B2B purpose and regularly verify and refresh it from source. When a record appears to be stale (for example, because a domain has been deactivated or a professional has clearly changed context), we either re-verify or remove it.

If you request deletion, we delete your data (see §10 below) and add your identifiers to a suppression list so that we do not re-ingest your data from sources. We retain the suppression entry for as long as necessary to honour the original request.

9. Your rights

Depending on where you live, you have some or all of the following rights:

  • Access — a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or outdated information.
  • Erasure ("right to be forgotten") — delete your data from our database.
  • Restriction — limit our use of your data while a dispute is resolved.
  • Objection — object to our processing on legitimate-interest grounds.
  • Portability — receive your data in a portable format (where applicable).
  • Non-discrimination — not be retaliated against for exercising these rights.
  • Complaint — lodge a complaint with a supervisory authority (see §11).

We do not use your data for automated individual decision-making, including profiling that produces legal or similarly significant effects, within the meaning of GDPR Art. 22.

10. How to exercise your rights

The fastest way to request access, correction, deletion, or to opt out is:

👉 Use our Data Removal Request form.

You can also email privacy@kuration.ai and we will route the request to the right team.

We honour verified requests within 30 days (GDPR) or the timeframe required by your local law. For complex cases we may extend the deadline by up to two months and will let you know if so. We may ask you to verify your identity before processing a request — this protects you against someone else impersonating you to delete or change your data.

11. Supervisory authorities

If you are not satisfied with how we have handled your request, you may complain to:

  • Hong Kong — Office of the Privacy Commissioner for Personal Data (PCPD) — www.pcpd.org.hk
  • European Economic Area — your country's data protection authority (DPA).
  • United Kingdom — Information Commissioner's Office (ICO) — ico.org.uk
  • UAE — UAE Data Office.
  • Saudi Arabia — Saudi Data & AI Authority (SDAIA).
  • Singapore — Personal Data Protection Commission (PDPC).
  • California — California Privacy Protection Agency (CPPA) — cppa.ca.gov.

12. Changes

We update this notice when our practices change or when new rights become available under new law. The effective date at the top reflects the current version. Material changes are signalled on this page; we do not proactively email individuals in the database about minor changes.

Contact