Corporate Transaction Disclosure

What it is

If BeReal is sold, merges with another company, or goes through a major corporate change, your personal data including your photos and location history can be transferred to the new owner.

Why it matters (compliance & governance perspective)

A corporate transaction could result in your personal data being controlled by an entirely different company with different privacy practices, and you may have limited ability to prevent this transfer.

Consumer impact (what this means for users)

This provision means that in a sale or restructuring of BeReal, all data the platform holds on you including dual-camera photos and location history could be passed to a new entity, whose privacy practices may differ materially from BeReal's.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Under GDPR, a transfer of personal data in a corporate transaction must be covered by a valid legal basis, and the acquiring entity must either maintain the same processing purposes or obtain fresh consent for new purposes. The CNIL and other EU supervisory authorities have examined data transfers in M&A contexts. Under CCPA, a business successor that receives personal data in a merger or acquisition must honour opt-out requests and provide notice of material changes to privacy practices. The FTC has also required spin-off or successor entities to honour original privacy commitments made to consumers. (2) GOVERNANCE EXPOSURE: Medium. This is a standard clause present across the industry. However, given BeReal's French ownership (Vibe SAS) and its user base including EU/EEA residents, any future acquisition involving a non-EEA acquirer would trigger data transfer adequacy assessment requirements and potentially require supervisory authority engagement. (3) JURISDICTION FLAGS: EU/EEA users have the strongest protections against unconstrained data repurposing following a corporate transaction under GDPR. California users have CCPA rights that a successor entity must honour. The FTC's 2012 enforcement action against Facebook's acquisition of Instagram established a precedent that successor entities must honour privacy commitments, though direct applicability to any future BeReal transaction would depend on specific facts. (4) CONTRACT AND VENDOR IMPLICATIONS: Due diligence teams in any acquisition of BeReal should assess the scope and sensitivity of personal data held (particularly dual-camera imagery and location data at scale), the adequacy of existing data processing agreements with sub-processors, and the compliance status of the existing privacy program before closing. (5) COMPLIANCE CONSIDERATIONS: If BeReal undergoes a material corporate transaction, a privacy impact assessment should be conducted prior to data transfer. Affected users should be notified of material changes to the data controller identity and given the opportunity to exercise deletion rights before the transfer completes, consistent with GDPR and CCPA requirements.

Applicable agencies

Provision details

Other risks in this policy

• Dual-Camera Simultaneous Image Capture high
• Location Data Collection high
• Third-Party Advertising Partner Data Sharing high
• User Rights for EU, UK, and California Residents medium
• Data Retention medium
• Minors and Age Restrictions high