Privacy Policy

1.Introduction and Scope

This Privacy Policy governs the processing of personal data collected through the website unumverse.com (the “Website”), its subdomains, associated landing pages and contact forms, as well as through advertising campaigns on third-party platforms (including Meta and Google) operated by UNUM.

This Policy has been designed to comply with:

• The General Data Protection Regulation of the European Union (Regulation (EU) 2016/679 — “GDPR”), applicable to users residing in the European Economic Area.
• Indonesia’s Personal Data Protection Law No. 27 of 2022 (“UU PDP”).
• The UK GDPR and the Data Protection Act 2018 for users in the United Kingdom.
• The California Consumer Privacy Act (CCPA/CPRA) for California residents.
• The advertising policies of Meta Platforms, Google Ads and other platforms used by UNUM.

2.Data Controller

PT Tropical Business Solutions acts as the Data Controller for all personal data collected through the Website and determines the purposes and means of processing. Any communication, exercise of rights or inquiry relating to the processing of your personal data should be addressed to the privacy contact indicated above.

3.Categories of Personal Data Collected

We collect the following categories of personal data, depending on the user’s interaction with the Website:

3.1. Data Voluntarily Provided

• First and last name.
• Email address.
• Telephone number, including international country code.
• Country of residence and nationality.
• Declared investment capacity range, including minimum investment amount and previous experience.
• Messages and inquiries submitted through contact forms.
• Video call bookings through Calendly, including time zone and selected time slot.

3.2. Data Collected Automatically

• IP address and approximate geolocation derived from it.
• Device, browser, operating system and language identifiers.
• Pages visited, time spent on the Website, browsing patterns and referrer information.
• Advertising and tracking identifiers provided by advertising platforms, including Meta click ID (“fbclid”), Google click ID (“gclid”) and UTM parameters.
• Cookies and similar technologies (see Section 8).

3.3. Data We DO NOT Collect Through the Website

4.Purposes of Processing and Legal Bases

We process your personal data for the following purposes and on the following legal bases, in accordance with Article 6 GDPR and equivalent provisions under Indonesia’s UU PDP:

4.1. Responding to Information Requests

Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

We respond to inquiries regarding real estate projects promoted under the UNUM brand, provide product information, arrange video calls and send requested commercial documentation.

4.2. Direct Marketing and Commercial Communications

Legal basis: the user’s explicit consent (Article 6(1)(a) GDPR) or, where applicable, legitimate interest in the case of qualified B2B contacts (Article 6(1)(f) GDPR), following an appropriate balancing assessment.

Users may withdraw their consent at any time by using the unsubscribe link included in each communication or by contacting [privacy@unumverse.com](mailto:privacy@unumverse.com), without affecting the lawfulness of processing carried out prior to the withdrawal.

4.3. Digital Advertising, Remarketing and Campaign Measurement

Legal basis: user consent provided through the cookie banner (Article 6(1)(a) GDPR and Article 22 of the Spanish LSSI / e-Privacy rules for EU users).

We use advertising tracking technologies, including Meta Pixel, Conversions API, Google Ads Conversion Tracking and Google Analytics 4, to measure campaign effectiveness, create custom and lookalike audiences, and display relevant advertising on social media platforms and search engines.

4.4. Formalization of Investment Relationships

Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations relating to tax, corporate matters and anti-money laundering requirements (Article 6(1)(c) GDPR).

4.5. Compliance with Legal Obligations and Defense Against Claims

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f) GDPR).

We retain certain data for the periods required under Indonesian tax legislation, PPATK anti-money laundering requirements, and for the potential defense of administrative, civil or criminal claims.

5.Recipients and Data Processors

Personal data may be disclosed to the following categories of recipients, in all cases under data processing agreements compliant with Article 28 GDPR and equivalent safeguards:

• Advertising platforms: Meta Platforms Ireland Ltd. (Facebook / Instagram) and Google Ireland Ltd. / Google LLC, for the management and measurement of advertising campaigns.
• Web analytics provider: Google Analytics 4, with IP anonymization and GDPR-compatible configuration.
• Email marketing platform: [Mailchimp / Brevo / specific provider], for the management of mailing lists and commercial communications.
• CRM: [HubSpot / Pipedrive / specific provider], for lead and investor lifecycle management.
• Calendly: Calendly LLC, for scheduling and managing video call bookings.
• Hosting and email provider: [Specific provider, jurisdiction].
• Professional advisors: lawyers, notaries and tax advisors, subject to professional confidentiality obligations, where necessary to formalize an investment.
• Competent authorities: the Indonesian tax authority (DJP), PPATK, Kominfo, judicial authorities or data protection supervisory authorities, where disclosure is legally required.

6.International Data Transfers

Due to the international nature of the UNUM project, your personal data may be transferred outside the European Economic Area, in particular to:

• Indonesia, where the Data Controller, PT Tropical Business Solutions, is based.
• The United States and other countries where the technology providers mentioned above, including Meta, Google, Calendly, CRM and email marketing providers, operate their servers.

The European Commission has not currently issued an adequacy decision for Indonesia. Therefore, all international data transfers are based on appropriate safeguards under Chapter V of the GDPR, specifically:

• Standard Contractual Clauses approved by the European Commission through Commission Implementing Decision (EU) 2021/914.
• Transfer Impact Assessments in accordance with the requirements arising from the CJEU’s Schrems II judgment.
• For US-based providers participating in the EU-U.S. Data Privacy Framework (DPF), participation in that framework as an additional safeguard.
• Supplementary technical and organizational measures, including encryption in transit and at rest, access controls and pseudonymization where applicable.

Users may request a copy of the applicable safeguards by contacting privacy@unumverse.com.

7.Data Retention Periods

We retain personal data for as long as strictly necessary to fulfill the purposes for which it was collected:

• Non-converted leads: 24 months from the last contact, after which the data will be anonymized or deleted.
• Marketing subscribers: until consent is withdrawn, with an activity review every 24 months.
• Formalized investors: throughout the contractual relationship and for up to 10 years after its termination, in accordance with Indonesian anti-money laundering requirements (PPATK) and applicable tax and commercial limitation periods.
• Accounting and tax data: 10 years in accordance with Indonesian legislation.
• Cookies and advertising data: according to the retention periods specified in the Cookie Policy, and in no event longer than 13 months for advertising cookies.

8.Cookies and Tracking Technologies

The Website uses first-party and third-party cookies for different purposes. When accessing the Website, a consent banner is displayed in accordance with Article 22 of Spanish Law 34/2002 (LSSI) and the e-Privacy Directive, allowing users to accept, reject or granularly configure the use of cookies that are not strictly necessary.

8.1. Cookie Categories

• Technical cookies (always active): essential for the operation of the Website.
• Analytics cookies: Google Analytics 4 with IP anonymization.
• Advertising and tracking cookies: Meta Pixel, Meta Conversions API and Google Ads, for campaign measurement, retargeting and audience creation.

Users may change their preferences at any time through the “Cookie Settings” link available in the footer.

9.User Rights

In accordance with the GDPR, Indonesia’s UU PDP and other applicable data protection laws, users have the following rights:

• The right to access their personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (“right to be forgotten”).
• The right to restriction of processing.
• The right to data portability.
• The right to object to processing, including processing for direct marketing purposes.
• The right not to be subject to automated decision-making producing significant legal effects.
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• For California residents: the right to know, the right to delete, the right to opt out of the “sale” or “sharing” of personal data, and the right to non-discrimination under the CCPA/CPRA.

Users may exercise these rights by emailing privacy@unumverse.com and providing a copy of a valid identification document. We will respond to requests within a maximum period of 30 days, subject to any extensions permitted under applicable law.

Users also have the right to lodge a complaint with the competent supervisory authority:

• Spain: Spanish Data Protection Agency (www.aepd.es).
• Other EU countries: the relevant national supervisory authority.
• Indonesia: Kementerian Komunikasi dan Informatika (Kominfo).
• United Kingdom: Information Commissioner’s Office (ICO).

10.Security Measures

UNUM implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including TLS encryption in transit, access controls based on the principle of least privilege, two-factor authentication for administrative accounts, regular backups and incident response procedures.

In the event of a security breach that may pose a risk to the rights and freedoms of affected individuals, UNUM will notify the competent supervisory authority within 72 hours (GDPR) or 3×24 hours (Indonesia’s UU PDP) of becoming aware of the breach, and will notify affected individuals where the risk is high.

11.Children

The Website is not intended for individuals under the age of 18. UNUM does not knowingly collect personal data from minors. If we become aware that personal data belonging to a minor has been collected without the required parental consent, we will promptly delete such data.

12.Specific Investment Disclaimer

13.Changes to this Policy

UNUM may amend this Privacy Policy to reflect legal, technical or business changes. The current version will always be the version published at this URL, together with the date of the latest update. In the event of material changes, registered users will be notified by email within a reasonable period before the changes take effect.

14.Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Republic of Indonesia, without prejudice to the mandatory application of the GDPR and other applicable data protection laws to users residing in their respective jurisdictions.

For any dispute arising from the processing of personal data, users residing in the European Economic Area may bring proceedings before the courts of their habitual place of residence or before the competent courts in Indonesia, at their choice.