Privacy Policy

By using the Platform, you consent to the data practices described in this policy.

Effective Date: September 1, 2026

Privacy Policy

Welcome to Vestra ("Vestra," "we," "our," or "us"). We value your trust and are committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use the Vestra website, mobile applications, and related products and services (collectively, the "Platform").

Vestra is a digital real estate investment platform that enables eligible users to discover, invest in, and manage fractional real estate investment opportunities. Because our services involve financial transactions and regulatory compliance, we collect and process certain personal information necessary to operate the Platform safely, securely, and in accordance with applicable laws.

Please read this Privacy Policy carefully. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required by applicable law, we will obtain your consent before processing your information for those specific purposes.

This Privacy Policy should be read together with our:

• Terms of Service

• KYC/AML Policy

• Cookie Policy

• Account & Data Deletion Policy

1. Scope of this Privacy Policy

This Privacy Policy applies to all personal information collected by Vestra through:

• Our website;

• Our mobile applications;

• Investor registration and onboarding;

• Identity verification processes;

• Customer support communications;

• Investment activities conducted through the Platform;

• Marketing communications;

• Live chat;

• Contact forms; and

• Any other services operated by Vestra.

This Privacy Policy does not apply to third-party websites, services, or applications that may be linked from our Platform.

2. Information We Collect

To provide our services, comply with legal obligations, and maintain a secure investment platform, we collect several categories of information.

2.1 Information You Provide

When you create an account or interact with Vestra, you may provide information including:

Personal Information

• Full name

• Date of birth

• Residential address

• Mailing address

• Email address

• Telephone number

• Nationality

• Government-issued identification information

• Selfie or biometric verification information where required

• Tax identification information where legally required

Account Information

• Username

• Encrypted password

• Account preferences

• Communication preferences

• Notification settings

Financial Information

Depending on the services you use, we may collect:

• Bank account information

• Payment method information

• Deposit records

• Withdrawal requests

• Transaction references

• Wallet information where applicable

For your security, Vestra does not intentionally store complete payment card information. Payment card transactions are processed by regulated third-party payment providers using industry-standard security practices.

Investment Information

We collect information relating to your activities on the Platform, including:

• Investment history

• Portfolio information

• Fractional ownership interests

• Investment preferences

• Property watchlists

• Income distributions

• Capital distributions

• Transaction records

• Investment agreements

• Electronic acknowledgements

Communications

We collect information you provide when you communicate with us through:

• Contact forms

• Live chat

• Email

• Customer support requests

• Surveys

• Feedback submissions

2.2 Information Collected Automatically

When you use the Platform, certain information is collected automatically.

This may include:

• IP address

• Device identifiers

• Browser type

• Operating system

• Language preferences

• Internet service provider

• Pages visited

• Features used

• Time spent on the Platform

• Login activity

• Referral URLs

• Device location derived from IP address

• Diagnostic information

• Crash reports

• Security logs

This information helps us maintain Platform security, improve performance, and understand how our services are used.

2.3 Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you securely signed in

• Remember your preferences

• Improve Platform performance

• Understand user behaviour

• Detect fraud and unauthorized activity

• Measure Platform usage

Additional information about our use of cookies is available in our Cookie Policy.

2.4 Information from Third Parties

We may receive information about you from trusted third parties including:

Identity Verification Providers

To verify your identity and comply with:

• Know Your Customer (KYC)

• Anti-Money Laundering (AML)

• Counter-terrorism financing regulations

• Politically Exposed Person (PEP) screening

• Sanctions screening

• Fraud prevention requirements

Financial Institutions and Payment Providers

Where necessary, we receive transaction-related information from:

• Banks

• Licensed payment processors

• Digital payment providers

• Financial institutions

• Payment gateways

• Escrow providers

• Custodial partners

Referral Participants

If another user refers you to Vestra, we may receive limited information necessary to administer our referral program.

Analytics Providers

We may receive aggregated or statistical information that helps us understand how users interact with the Platform.

3. How We Use Your Information

We use your personal information to operate, improve, and secure the Platform.

These purposes include:

• Creating and managing your account;

• Verifying your identity;

• Processing investment applications;

• Managing investment portfolios;

• Processing deposits and withdrawals;

• Facilitating distributions and investor payments;

• Providing customer support;

• Responding to inquiries;

• Sending important account notifications;

• Preventing fraud and financial crime;

• Conducting sanctions and compliance screening;

• Meeting legal and regulatory obligations;

• Managing investor communications;

• Improving Platform functionality;

• Conducting analytics and performance monitoring;

• Detecting security incidents;

• Protecting our users and business;

• Maintaining business records;

• Conducting internal audits;

• Enforcing our legal rights and agreements.

We process only the information reasonably necessary to achieve these purposes.

4. Legal Basis for Processing

Where applicable, Vestra processes personal information based on one or more of the following legal grounds:

• Your consent;

• Performance of a contract with you;

• Compliance with legal and regulatory obligations;

• Protection of vital interests where applicable;

• Our legitimate business interests, provided those interests do not override your rights and freedoms.

Our legal obligations may include compliance with financial services regulations, anti-money laundering requirements, fraud prevention obligations, tax reporting requirements, sanctions regulations, and other applicable laws.

5. Identity Verification and Financial Compliance

As a real estate investment platform, Vestra is required to maintain robust compliance procedures.

We may collect, verify, monitor, and retain information necessary to:

• Verify your identity;

• Confirm your eligibility to use the Platform;

• Detect fraud;

• Prevent money laundering;

• Prevent terrorist financing;

• Comply with sanctions regulations;

• Monitor suspicious activities;

• Meet financial reporting obligations;

• Respond to lawful requests from regulatory authorities.

Failure to provide requested information may prevent us from opening or maintaining your account or providing certain services.

6. How We Share Your Information

Vestra does not sell your personal information.

We disclose personal information only where necessary to operate the Platform or where required by law.

Service Providers

We work with trusted service providers that assist with:

• Cloud hosting

• Data storage

• Cybersecurity

• Customer support

• Email communications

• Analytics

• Identity verification

• Payment processing

• Financial compliance

• Platform infrastructure

These providers are contractually required to safeguard your information and use it only for authorized purposes.

Financial Institutions

Where necessary, information may be shared with:

• Banks

• Licensed payment providers

• Custodial institutions

• Escrow providers

• Settlement partners

solely for processing financial transactions or complying with regulatory requirements.

Professional Advisers

We may share information with our:

• Lawyers

• Auditors

• Accountants

• Compliance advisers

• Tax advisers

where necessary to operate our business or comply with legal obligations.

Regulatory Authorities

We may disclose information where required by law to:

• Courts

• Government agencies

• Financial regulators

• Tax authorities

• Law enforcement agencies

or where necessary to protect our legal rights or those of our users.

Business Transfers

If Vestra undergoes a merger, acquisition, restructuring, financing, or sale of assets, your information may be transferred as part of that transaction.

Where required by law, users will be notified before such transfer becomes effective.

7. International Data Transfers

Your information may be processed or stored in the United States or other jurisdictions where Vestra or its trusted service providers operate.

Where personal information is transferred internationally, we implement appropriate safeguards designed to protect your information in accordance with applicable laws.

8. Data Retention

We retain personal information only for as long as necessary to:

• Provide our services;

• Maintain your account;

• Comply with legal obligations;

• Resolve disputes;

• Prevent fraud;

• Enforce our agreements;

• Meet regulatory record-keeping requirements.

Retention periods vary depending on the nature of the information and applicable legal requirements.

When information is no longer required, it is securely deleted, anonymized, or permanently destroyed using appropriate security procedures.

9. Protecting Your Information

Protecting your information is one of our highest priorities.

We maintain administrative, technical, and organizational safeguards including:

• Encryption of sensitive data;

• Secure cloud infrastructure;

• Access controls;

• Multi-factor authentication where appropriate;

• Continuous security monitoring;

• Vulnerability assessments;

• Security logging;

• Employee confidentiality obligations;

• Regular security reviews.

Although we use commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

10. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Access your personal information;

• Correct inaccurate information;

• Request deletion of personal information;

• Request restriction of processing;

• Object to certain processing activities;

• Request data portability where applicable;

• Withdraw consent where processing relies on consent;

• Lodge a complaint with an appropriate supervisory authority.

To exercise your rights, please contact us using the contact methods provided at the end of this Privacy Policy.

We may request additional information to verify your identity before responding to certain requests.

11. Marketing Communications

We may send communications relating to:

• Platform updates;

• Product announcements;

• Educational content;

• Investment opportunities;

• Newsletters;

• Promotional campaigns.

You may opt out of marketing communications at any time by using the unsubscribe link contained in our emails.

Certain communications relating to your account, investments, security, or legal obligations cannot be opted out of.

12. Children's Privacy

The Platform is intended only for individuals who are at least eighteen (18) years old or the age of legal majority in their jurisdiction.

We do not knowingly collect personal information from children.

If we become aware that personal information has been collected from a child, we will take reasonable steps to delete that information promptly.

13. Third-Party Websites and Services

Our Platform may contain links to third-party websites or services for your convenience.

Vestra does not control and is not responsible for the privacy practices, content, or security of third-party services.

We encourage you to review the privacy policies of any third-party services you choose to access.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or business practices.

When material changes are made, we will publish the revised Privacy Policy on the Platform and, where required by applicable law, notify users before those changes become effective.

The Effective Date at the top of this Privacy Policy indicates the date of the most recent revision.

15. Contact Us

If you have questions about this Privacy Policy or how Vestra handles your personal information, please contact us through:

Email: support@vestraproperties.pro

Contact Form: Available through the Platform

Live Chat: Available through the Platform

We will make reasonable efforts to respond to privacy-related inquiries in a timely manner.