Who we are
This policy covers personal information handled by World Business Welfare Organisation, Corp ("WBWO", "we" or "us"), a nonprofit corporation registered in the State of Colorado, United States. WBWO is a non-governmental organization that certifies genuine businesses, gives them a verified identity, and runs a member platform where they can find and contact each other.
WBWO decides how and why this information is used, which makes us its controller. Our registered office is in Colorado, United States. For anything in this policy, email privacy@wbwo.org.
What we collect
When you visit the website
- Technical information your browser sends, such as your IP address, browser type and the pages you request. Our hosting provider keeps this in server logs to keep the site running and secure.
- WBWO numbers entered in the business checker, and the time of the check. We don't record who made the check.
- Anything you send us through a form or by email, such as your name, email address and message.
When you apply for certification
Certification depends on knowing who owns and runs a business. For every person who owns 25% or more of the business, every director, and the person making the application, we collect:
- name, date of birth, nationality and contact details
- a copy of a passport or national ID card
- a proof of home address, such as a utility bill or bank statement
- for the person applying, or a director, a geotagged photo taken at the business premises (see Premises photos below)
- the results of sanctions screening, and whether the person holds or has held a prominent public position
About the business itself, we collect:
- registration certificates, constitution, shareholder and director records, and ownership charts
- proof of business address, tax registration, licenses, and a cancelled cheque or bank letter for the business account
- tax returns, financial statements, proof of turnover and tax compliance certificates, depending on the size of the business
- workforce and employer information, such as headcount, contract types and payroll registration
- the audit report prepared by the business's assigned auditor
Business documents often contain personal information about owners, staff, customers and suppliers. We protect all of it in the same way.
When you use the member platform
- your login details and the people your business adds to its account
- your business profile, which other logged-in members can see
- connection requests you send, receive and accept
- a log of sign-ins and account changes, kept for security
When you ask for financial support or use mediation
If you ask for a loan from the Welfare Fund or an introduction to investors, we collect the evidence and financial information you send, which may include health information if illness is the reason. If you use mediation, we keep the records needed to run it.
What is public, and what never is
Each certified member has a public record that anyone can check. It shows only:
- the business name and WBWO number
- country of registration and sector
- certification status and the date certification runs until
- the date of the last audit and its result
The public record never shows your documents, the personal details of owners, directors or staff, financial figures, audit findings or bank details. Your full platform profile is visible only to logged-in members.
How we use your information
| What we do | Why |
|---|---|
| Check identities and businesses, and decide on certification | To provide the certification you applied for |
| Screen people and businesses against sanctions lists | To comply with United States sanctions laws, including those administered by the US Treasury’s Office of Foreign Assets Control (OFAC) |
| Publish and maintain the public record | Because a public, checkable record is what certification is, and members agree to it when they join |
| Run the member platform and member services | To provide the membership you signed up for |
| Handle requests for financial support and introductions | To deal with your request; we share your information with investors or lenders only with your permission |
| Investigate fake certificates and misuse of the WBWO name | Our legitimate interest in protecting members and the people who rely on our records |
| Keep records after membership ends | To answer questions about past certifications, to establish or defend legal claims, and to meet our tax and accounting record-keeping obligations |
| Keep the website and platform secure | Our legitimate interest in running a safe service |
We don't sell personal information, we don't share it for targeted advertising, and we don't use it for automated decisions about you. Every certification decision is made by people.
Premises photos
To confirm that a business operates from the address it gives, and that a real person behind it is there, we ask for a photo of the person applying, or a director, at the business premises.
- The photo file contains location (GPS) data and the time it was taken. We use these only to check the photo against the business address.
- A verification officer compares the person in the photo with their ID document by eye. We don’t use facial recognition, and we don’t create biometric templates.
- We keep the photo with the business’s other KYC records, and we never publish it.
- If you can’t take a geotagged photo, we can do a short video call with you at the premises instead.
Sensitive information
Some information we collect is treated as sensitive by law, such as nationality or citizenship in identity checks, and health information in a request for financial support. We use it only with your consent, only by the people who need it, and only for the purpose you gave it for. You can withdraw consent at any time, though we may then be unable to continue with your application or request.
Who we share it with
We share personal information only with organizations that help us do the work described above:
- Accredited auditors assigned to your business, who see what they need for the audit
- An identity-document verification provider that checks ID documents are genuine
- A sanctions-screening provider that checks names against sanctions lists
- Hosting, storage and email providers that run our systems
- Mediators, if you take part in mediation
- Investors and lenders, only with your permission, when you ask us for an introduction
- Professional advisers, such as our lawyers and accountants, when needed
Each provider may use the information only to provide their service to us, under a written contract that requires them to protect it. We may also disclose information when the law requires it, such as a valid court order, or where we reasonably believe it’s needed to prevent fraud or protect someone’s safety.
International transfers
We certify businesses in many countries, and our systems are based in the United States. When personal information is sent to the United States or another country from a place whose law restricts transfers, such as the European Economic Area or the United Kingdom, we use the safeguards that law recognizes, usually the standard contractual clauses approved by the European Commission and the UK addendum to them.
How long we keep it
| Information | How long |
|---|---|
| Identity and business documents, including premises photos (KYC and KYB records) | 5 years after membership ends, so we can answer questions about past certifications and deal with legal claims, then deleted |
| Applications that don’t lead to certification | 2 years after the decision, then deleted |
| Platform account and connections | While your account is open, and 1 year after it closes |
| Fees and invoices | 7 years, for tax and accounting purposes |
| Website enquiries and general correspondence | 2 years after our last contact |
| Server logs | Up to 90 days, unless needed to investigate a security incident |
| Lapsed public records | Shown as lapsed, so people checking an old certificate get an accurate answer, until the KYC and KYB records are deleted |
When information reaches the end of its retention period, we delete it or destroy it securely.
How we protect it
Documents are encrypted in transit and at rest. Only our verification team and the auditor assigned to your business can open them, and access is logged. Staff, auditors and providers are bound by confidentiality. No system is perfectly secure, so if a security breach affects your information, we will tell you and the authorities the law requires us to tell. For Colorado residents, that means notice within 30 days of our determining that a breach occurred, and notice to the Colorado Attorney General when the law requires it.
Your rights
Wherever you live, you can ask us to:
- confirm whether we hold personal information about you, and give you a copy
- correct information that is wrong or incomplete
- delete information, unless we need to keep it for a reason described in this policy
- send information you gave us to you, or to another organization, in a portable format
Email privacy@wbwo.org. We may need to confirm who you are before acting on a request, and we may ask for proof if someone makes a request on your behalf. We respond within 45 days. If we need longer, up to a further 45 days, we will tell you why within the first 45. We won’t charge you or treat you differently for using your rights.
Some requests limit what we can do. For example, a business can’t stay certified if the people behind it ask us to delete their identity information, and we may keep information we need for a legal claim.
Appeals. If we decline your request, you can appeal by replying to our decision within 45 days. A different member of staff will review it, and we will tell you the outcome within 45 days of receiving your appeal.
Colorado residents
The Colorado Privacy Act gives Colorado residents, acting for themselves or their household, the rights listed above, plus the right to opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. We don’t do any of those things, and we treat a Global Privacy Control signal from your browser as an opt-out request. We use sensitive data, such as nationality or health information, only with your consent. If you aren’t satisfied with the outcome of an appeal, you can contact the Colorado Attorney General.
Residents of other US states
Several other states have privacy laws, and some, including California’s, generally don’t apply to nonprofit organizations. We give residents of every state the same rights described in this policy, whether or not their state’s law requires it.
The European Economic Area and the United Kingdom
If you are in the EEA or the UK, the GDPR or UK GDPR gives you the rights above, the right to object to uses based on our legitimate interests, and the right to complain to your data protection authority. The table above explains why we use each kind of information. Where we rely on consent, you can withdraw it at any time.
Cookies and browser storage
The website uses only what it needs to work. The certification checklist remembers which documents you’ve ticked using your browser’s local storage; that stays on your device and is never sent to us. The member platform uses a cookie to keep you signed in. We don’t use advertising or cross-site tracking cookies. If we ever add analytics, we will update this policy first and ask for your consent where the law requires it.
Children
Our website and services are for businesses and the adults who run them, and aren’t directed to children. We don’t knowingly collect information from anyone under 18. If you think we have, contact us and we will delete it.
Changes to this policy
We update this page when our practices change and show the date of the latest version at the top. If a change materially affects how we use members’ or applicants’ information, we will tell them by email before it takes effect.
Contact
For privacy questions, or to use your rights, email privacy@wbwo.org.