This Privacy Notice describes how we collect, use, disclose and store your personal data when you use the Fractual Platform and its services, in compliance with the applicable legal framework.

Which personal data do we collect from you?

When you create an account on our Platform, we collect the following personal data:

Full name
Primary e-mail
Verified phone number
Time zone
Account creation & last login timestamps
Alternate e-mail (optional)
Profile photo (optional)

If you choose to register or sign in using a third-party provider such as Google or Apple, we only process the personal data made available to us by that provider, in accordance with their privacy settings and permissions.

For you to be able to invest in properties uploaded on Fractual, and in compliance with all applicable laws and regulations, we also collect the following data:

Your KYC documents, including their status & expiry date
Your advanced electronic signature (AES), as filled on the Bond Issuance Agreement, as well as the Agreement's Document ID & URL
Your selected payment method
Stripe session ID, if Stripe is used for payment
Last four (4) digits of your IBAN, if SEPA used for payment (via Stripe)
Last four (4) digits & expiry date of your bank card, if this is used for payment (via Stripe)
Time of payment initiation
Time of payment completion
Total amount of shares purchased
Total amount of money paid

Who controls and processes your personal data?

The Data Controller for your data is FRACTUAL LTD, a company incorporated in Cyprus, with registered office at Omonoias 52, TROODOS COURT, 1st Floor, Flat/Office 3, 3052, Limassol.

Your data might be shared with the following trusted third parties:

DigitalOcean: Hosts our backend systems and databases in a secure cloud environment.
Amazon Cognito: Manages user authentication and identity verification services securely.
Astrodon Corporation (Loops): Facilitates bulk email communication and user engagement.
Intercom: Enables customer support and live chat functionality on the Platform.
SumSub: Provides Know Your Customer (KYC) verification services to ensure regulatory compliance.
Stripe (Payments Europe Limited & Stripe Technology Europe Limited): Handles secure processing of payment transactions.
Dropbox Sign (formerly HelloSign): Enables digital signing of legally binding documents.
Twilio: Used for SMS-based phone number verification.

All the above-mentioned parties act as Data Processors and are bound by confidentiality obligations.

Moreover, your data shall be shared with the authorized personnel of EMPIRICAL P.C. and trusted associates, who may process your personal data under strict confidentiality and access control protocols to provide the Platform's Services.

Why and on which legal basis do we process your personal data?

We shall process your personal data for the following purposes and on the following legal bases:

Purpose	Legal Basis
Create a user account and authenticate access	Performance of a contract
Verify identity to comply with regulatory requirements	Legal obligation
Signing legal agreement prior to investment	Performance of a contract
Facilitate investment transactions	Performance of a contract
Provide documentation of transaction	Performance of a contract
Provide investment overview and tracking	Performance of a contract
Facilitate deposits and flexible investment options	Performance of a contract
Inform users about new offerings/investment opportunities and company updates	Consent
Carry out company’s legal obligations, providing the necessary information to the competent authorities	Legal obligation
Facilitate your subscription to the Fractual platform, when it is finalized	Consent

How long do we keep your data for and where?

We will keep your data for one (1) year upon your registration to validate our MVP.

If you provide your consent consent, we shall retain your data for a longer period of time in order to ensure your automatic and smooth subscription to the Fractual Platform, when it is finalized. In this case, you will not be requested to provide your data once again to subscribe to the Full Platform.

We retain your data within the European Union on Amazon Web Services servers. Nonetheless, your data may be transmitted to the United States of America by some of our Data Processors mentioned above, based on the EU-U.S. Data Privacy Framework.

If the EU-U.S. Data Privacy Framework is declared invalid, or if a Data Processor fails to re-certify for the EU-U.S. Data Privacy Framework, then the transfer of personal data will be subject to the Standard Contractual Clauses Schedules 1-3, which shall be enforced between such Data Processor(s) and us.

Which rights do you have?

You may ask us to:

Provide you with a copy of the personal data we keep for you.
Correct some data if it is not correct.
Erase your data.
Stop processing your data or delimit its processing to certain uses.
Send your data to another company or entity via logical means.
Withdraw your consent if you have provided it to us.

How can you exercise your data rights?

If, at any time, you would like to exercise your rights or ask any question regarding your personal data, please refer to the following e-mail address: dpo@fractual.com

We will respond to you within thirty (30) days of your request's receipt.

If you feel that the protection of your personal data has been violated, you may file a complaint with the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy)