Beshara Group — Privacy Policy

1. Who we are and what this policy covers

Beshara Group  is an information technology company based in the State of Kuwait. This Privacy Policy explains how we collect, use, share and protect personal data when you use any of our products or services (the “Services”).

The Services include:

• our websites, including ebeshara.com and its subdomains;
• any software we develop, license, host or operate, including software-as-a-service (SaaS) applications offered through Microsoft Marketplace (Azure Marketplace and Microsoft AppSource);
• cloud, infrastructure, licensing and professional services, including services we provide as a Microsoft Cloud Solution Provider (CSP) partner;
• support, training and any communication you have with us.

Some products may have a product-specific privacy notice. Where one exists, it supplements this policy for that product, and this policy applies to everything else.

Where the law requires your consent for a specific use of your data, we will ask for it separately and clearly.

2. Information we collect

We collect only the data we need to provide, secure and improve the Services.

We do not intentionally collect special categories of data, such as health data, except where our software is designed to process it on a customer’s behalf and under that customer’s instructions.

3. How we use information

We use personal data to run the Services you signed up for and to keep them safe. Specifically, we use it to:

• create and manage accounts, and authenticate users through Microsoft Entra ID or other sign-in methods;
• activate, provision, change and cancel subscriptions, including those purchased through Microsoft Marketplace;
• deliver, maintain and support our software, cloud and professional services;
• process billing, invoicing and payment reconciliation;
• monitor performance, fix errors and improve features;
• detect, prevent and respond to security incidents, fraud and misuse;
• send service notices, such as updates, security alerts and changes to terms;
• send marketing messages only where you have agreed or the law allows, with an option to unsubscribe in every message;
• comply with legal, regulatory, tax and audit obligations, and enforce our agreements.

We do not sell personal data, and we do not use Customer Data for advertising.

4. Legal bases for processing

We process personal data in line with applicable data protection laws, including Kuwait’s Data Privacy Protection Regulation issued by the Communications and Information Technology Regulatory Authority (CITRA Resolution No. 26 of 2024) and, where they apply, the EU and UK General Data Protection Regulations (GDPR).

Depending on the activity, we rely on one or more of these bases:

• Contract — to provide the Services you or your organization ordered;
• Consent — for optional activities such as marketing emails or non-essential cookies; you can withdraw consent at any time;
• Legal obligation — to meet tax, accounting, regulatory and law-enforcement requirements;
• Legitimate interests — to secure, maintain and improve the Services, where those interests are not overridden by your rights.

5. Customer Data processed in our software

For data your organization puts into our software, your organization is the data controller and Beshara acts as its data processor. “Customer Data” means any content, records or files that a customer or its users upload, enter or create in our software.

For Customer Data, we:

• process it only to provide the Services and only on the customer’s documented instructions, as set out in our agreement or data processing terms;
• do not use it for marketing, sell it, or use it to train artificial intelligence models without the customer’s written permission;
• limit access to authorized personnel who need it to deliver or support the Services and who are bound by confidentiality;
• assist the customer in responding to data subject requests, security incidents and regulatory inquiries;
• return or delete it at the end of the service, as described in section 8.

If you are an end user of a customer’s system, such as a patient, employee or citizen, please send privacy requests to that organization. We will support them in handling your request.

6. How we share information

We share personal data only with the parties below, and only as much as each needs.

• Microsoft — our Services run on Microsoft Azure and use Microsoft Entra ID for sign-in. When you buy through Microsoft Marketplace, Microsoft shares purchase and subscription data with us and we report usage and status back to Microsoft. Microsoft’s own processing is governed by the Microsoft Privacy Statement.
• Service providers (sub-processors) — companies that help us host, operate, support and bill for the Services, such as cloud hosting, email delivery and ticketing providers. They are bound by written contracts to protect the data and use it only for our instructions.
• Distributors and partners — where you buy Microsoft licenses or cloud services through us, we share the data needed to place and manage the order with Microsoft and our authorized distributor.
• Professional advisers — lawyers, auditors and insurers, under confidentiality duties.
• Authorities — government, regulatory or law-enforcement bodies, when the law requires it or to protect the rights, property or safety of Beshara, our customers or others.
• Business transfers — a buyer or successor in a merger, acquisition or sale of assets, who must honor this policy.
• Anyone else with your consent.

We do not sell or rent personal data to third parties.

7. Where data is stored and international transfers

We store data in Microsoft Azure data centers in the region stated in the product documentation or agreed with the customer. Where a customer requires in-country or regional hosting, we host in the region the customer specifies, subject to availability.

Some processing, such as support or sub-processor services, may take place outside Kuwait. When data leaves the country where it was collected, we protect it with contractual safeguards, Microsoft’s data protection commitments and any other measures required by applicable law.

8. Data retention

We keep personal data only as long as we need it for the purposes in this policy or as the law requires.

When data is no longer needed, we delete it or anonymize it so it can no longer identify you. Backups are overwritten on their normal cycle.

9. Data security

We protect personal data with technical and organizational measures suited to its sensitivity, including:

• encryption of data in transit (TLS 1.2 or higher) and at rest;
• access control through Microsoft Entra ID, multi-factor authentication and least-privilege roles;
• network segmentation, firewalls and continuous security monitoring;
• logging and review of administrative access;
• regular backups, patching and vulnerability management;
• confidentiality obligations and security training for staff and contractors.

No system is completely secure. If a personal data breach occurs, we will contain it, investigate it and notify the competent regulator, affected customers and, where required, affected individuals within the timeframes set by applicable law.

10. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• delete your data where we no longer have a reason to keep it;
• object to or restrict certain processing, including direct marketing;
• withdraw consent at any time, without affecting processing already carried out;
• data portability, where the law provides it;
• complain to a data protection authority, such as CITRA in Kuwait or your local regulator.

To exercise these rights, contact us using the details in section 15. We will verify your identity and respond within 30 days, or sooner if the law requires. For Customer Data, we will refer your request to the customer that controls it.

11. Cookies and similar technologies

Our websites and software use cookies and similar technologies to keep you signed in, remember your settings and understand how the Services are used.

• Essential cookies — needed for sign-in, security and core features; these cannot be switched off.
• Preference cookies — remember choices such as language.
• Analytics cookies — help us measure and improve performance; we use them only with your consent where the law requires it.

You can manage cookies through our cookie banner, where shown, or your browser settings. Blocking essential cookies may stop parts of the Services from working.

12. Children’s privacy

Our Services are intended for businesses and organizations and are not directed at children under 18. We do not knowingly collect personal data from children for our own purposes. If you believe a child has given us personal data, contact us and we will delete it.

Where a customer uses our software to process data about minors, such as patients or students, the customer is responsible for obtaining any required consent, and we process that data only as described in section 5.

13. Third-party services and links

Our Services may link to or integrate with third-party websites and services, including Microsoft Marketplace, Microsoft 365 and other Microsoft cloud services. Those third parties handle your data under their own privacy policies, and we are not responsible for their practices. We encourage you to read their policies before sharing data with them.

14. Changes to this policy

We may update this Privacy Policy as our Services or the law change. We will post the updated version on this page with a new “Last updated” date. If a change is material, we will notify customers by email or through the Services before it takes effect.

Last updated: 25 October 2026

15. Contact us

For questions about this policy or to exercise your privacy rights, contact:

Beshara Group — Privacy Office

• Company: Beshara Group for General Trading and Contracting
• Address: Sharq Fisheries Bldg. Mezzanine Floor P.O. Box 6267, State of Kuwait
• Email: info@ebeshara.com
• Phone: +965 50395551
• Website: com