Privacy Policy

How we collect, use, and protect your personal data

Disclaimer: This document has been prepared as a framework and requires review by qualified legal counsel before being relied upon. It does not constitute legal advice.

Effective Date: March 2026

Contents

  1. Introduction
  2. Data Controller
  3. Information We Collect
  4. How We Collect Data
  5. Legal Basis for Processing
  6. How We Use Your Data
  7. Data Sharing and Disclosure
  8. International Data Transfers
  9. Data Retention
  10. Your Rights
  11. Cookies and Tracking
  12. Data Security
  13. Children's Privacy
  14. Changes to This Policy
  15. Contact Us

1. Introduction

Catalyst Asset Capital Ltd ("we," "us," "our," or "CAC") is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal data when you visit our website, use our platform services, and interact with us through various channels.

Catalyst Asset Capital is a real estate investment platform registered in Dubai, UAE, enabling investors and developer/landowner partners to connect and transact across our target markets, including the United Arab Emirates (UAE), Kingdom of Saudi Arabia (KSA), Greece, France, Lebanon, and select other jurisdictions globally.

Because we serve users in the European Union (Greece and France), this Privacy Policy complies with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable data protection laws in the UAE, including the Federal Decree-Law No. 45 of 2021 on data protection.

Please read this Privacy Policy carefully. By using our platform, you acknowledge that you have read and understood how we handle your personal data.

2. Data Controller

The data controller responsible for the collection and processing of your personal data is:

Catalyst Asset Capital Ltd
Dubai, UAE
Email: info@catalystassetcapital.com

For all inquiries regarding data protection and privacy matters, please contact us using the details above.

3. Information We Collect

We collect personal data in various categories to deliver our services and comply with regulatory requirements:

3.1 Account Registration Data

  • Full name
  • Email address
  • Phone number
  • Country of residence or incorporation
  • Investor type (individual, family office, institutional, etc.)
  • Investment preferences and focus areas
  • Accreditation status or investor classification

3.2 Partner/Developer Registration Data

  • Company name and registration details
  • Principal contact person name and contact information
  • Company address and jurisdiction
  • Portfolio and project information
  • Financial statements or development track record
  • Bank account information (if necessary for fund transfers)

3.3 Contact Form Submissions

When you submit inquiries or contact forms, we collect your name, email, phone number, message content, and any attachments you choose to include.

3.4 Newsletter and Communications

If you subscribe to our newsletter, we collect and store your email address.

3.5 Usage and Technical Data

  • Pages visited and time spent on each page
  • Referral source and links clicked
  • Device type and operating system
  • Browser type and version
  • IP address
  • Approximate geographic location (derived from IP)
  • Cookies and similar tracking technologies (see Section 11)

3.6 Regulatory and Compliance Data

When required for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance, we may collect additional data such as passport information, proof of address, beneficial ownership information, and source of funds verification.

4. How We Collect Data

We collect personal data through multiple channels:

4.1 Directly From You

  • When you create an account on our platform
  • When you submit registration forms (investor or partner profiles)
  • When you complete contact forms or send us inquiries
  • When you subscribe to our newsletter
  • When you communicate with us via email or phone
  • When you participate in webinars or events

4.2 Automatically

  • Cookies and web technologies: We use cookies, pixels, web beacons, and similar technologies to collect data about your browsing behavior.
  • Analytics tools: We use Google Analytics and similar tools to understand platform usage patterns.
  • Server logs: Our servers automatically log your IP address, browser type, pages accessed, and timestamps.

4.3 From Third Parties

  • KYC/AML verification providers: Third-party service providers who conduct background checks and identity verification.
  • Form processing services: Formspree processes and temporarily stores data from our contact forms.
  • Payment processors: If applicable, payment gateway providers handle financial transaction data.
  • Public databases and business registries: For company verification and regulatory checks.

Under GDPR, we process personal data only when we have a lawful basis to do so. Our processing activities are based on the following legal grounds:

5.1 Consent

We process certain data with your explicit consent, including:

  • Newsletter subscriptions and marketing communications
  • Cookies and tracking technologies (with your consent via cookie banner)
  • Profiling for investment opportunity recommendations

You may withdraw consent at any time.

5.2 Contractual Necessity

We process data necessary to enter into and perform our terms of service with you, including:

  • Account creation and profile management
  • Processing investment interest and applications
  • Sending transaction-related communications
  • Administering special purpose vehicles (SPVs) or joint ventures (JVs)

5.3 Legitimate Interest

We process data for our legitimate business interests (balanced against your rights and expectations), including:

  • Platform improvement and personalization
  • Fraud detection and prevention
  • Platform security and monitoring
  • Aggregated analytics and reporting
  • Hiring and recruitment (if you apply for employment)
  • Customer service improvements

5.4 Legal Obligation

We process certain data to comply with applicable laws and regulations, including:

  • AML/KYC compliance and reporting
  • Tax and financial reporting obligations
  • Response to lawful government requests
  • Legal proceedings and dispute resolution

6. How We Use Your Data

We use the personal data we collect for the following purposes:

6.1 Account and Profile Management

  • Creating and maintaining your user account
  • Verifying your identity and eligibility
  • Updating and managing your investor or partner profile
  • Enabling login and access to platform features

6.2 Investment Processing and Facilitation

  • Processing your investment interest in opportunities
  • Preparing investment documentation and agreements
  • Coordinating with legal, tax, and financial advisors
  • Managing SPVs or JV structures
  • Processing capital calls and distributions

6.3 Communications

  • Sending platform updates and new opportunity notifications
  • Responding to your inquiries and requests
  • Providing customer support
  • Sending administrative or transactional emails
  • Newsletter subscriptions (with consent)

6.4 Marketing and Business Development

  • Notifying you of new opportunities matching your investment criteria (with consent)
  • Sending market insights and industry news (with consent)
  • Inviting you to webinars, events, or investor conferences
  • Conducting market research and surveys

6.5 Regulatory Compliance

  • Conducting KYC and AML verification
  • Generating regulatory reports and filings
  • Maintaining audit trails for compliance purposes
  • Responding to regulatory investigations or inquiries

6.6 Platform Improvement and Analytics

  • Analyzing platform usage patterns and user behavior
  • Improving user experience and platform functionality
  • Conducting performance testing and optimization
  • Generating aggregated, anonymized analytics reports

6.7 Security and Fraud Prevention

  • Detecting and preventing fraudulent transactions
  • Securing our platform against unauthorized access
  • Monitoring for suspicious activity
  • Protecting against cyber threats

7. Data Sharing and Disclosure

We do not sell your personal data to third parties for marketing purposes. However, we may share data in the following limited circumstances:

7.1 Service Providers

We share data with third-party service providers who perform services on our behalf under confidentiality agreements:

  • Form Processing: Formspree (US-based) processes contact form submissions. Formspree's privacy practices are detailed in their privacy policy.
  • Analytics: Google Analytics collects usage data (see Section 11 for cookie details).
  • KYC/AML Providers: Third-party verification service providers conduct identity and compliance checks.
  • Cloud Hosting: Our platform infrastructure may be hosted by cloud service providers.
  • Payment Processors: Payment gateway providers (if applicable) handle transaction data.
  • Communication Platforms: Email service providers and SMS providers deliver communications.

We ensure these service providers have appropriate data protection safeguards in place.

7.2 Investment Vehicle Administrators

If you invest in an opportunity, we share relevant information with:

  • SPV or JV administrators and trustees
  • Investment managers and sponsors
  • Escrow agents and custodians
  • Accounting and audit firms

These entities require your data to manage the investment vehicle and distribute returns. This sharing is only for investors who commit capital to opportunities.

7.3 Legal and Regulatory Authorities

We may disclose personal data when required by law or in response to:

  • Court orders or legal processes
  • Regulatory agency requests
  • Government or law enforcement inquiries
  • AML/KYC and sanctions compliance requirements
  • Tax authorities and financial crime investigation

7.4 Professional Advisors

We may share data with our legal counsel, accountants, auditors, and consultants to the extent necessary for:

  • Legal and compliance matters
  • Audit and assurance functions
  • Tax and accounting services
  • Dispute resolution

7.5 Business Transfers

If Catalyst Asset Capital is involved in a merger, acquisition, bankruptcy, or sale of assets, your data may be transferred as part of that transaction. We will provide notice of any such change and any choices you may have regarding your data.

7.6 Anonymized and Aggregated Data

We may use and share aggregated, anonymized data that cannot identify you personally (e.g., market trends, platform statistics).

8. International Data Transfers

Catalyst Asset Capital is based in the UAE. Your personal data may be transferred to, processed, and stored in countries outside the UAE and European Economic Area (EEA), which may have different data protection laws than your country of residence.

When we transfer data internationally, we implement appropriate safeguards:

8.1 Standard Contractual Clauses (SCCs)

For transfers involving EU residents' data, we use EU-approved Standard Contractual Clauses to ensure compliant transfers.

8.2 Adequacy Decisions

We may rely on European Commission adequacy decisions for transfers to certain jurisdictions.

8.3 Explicit Consent

For certain transfers, we obtain your explicit consent before moving data internationally.

8.4 Formspree (Form Processing)

Formspree is a US-based service provider. Your contact form data is transferred to the United States. Formspree adheres to applicable privacy laws and maintains Privacy Shield or standard contractual clause protections.

8.5 Third-Party Service Providers

Third-party providers (analytics, hosting, KYC) may process data in their respective locations. We contractually require these providers to maintain adequate data protection safeguards.

9. Data Retention

We retain personal data only as long as necessary to provide services and comply with legal obligations:

Data Retention Periods

Data Category Retention Period Reason
Active Account Data Duration of account + 7 years Regulatory compliance, tax reporting, dispute resolution
Investment Records Duration of investment + 7 years Legal obligations, audit, financial reporting
Contact Form Submissions 2 years Customer service follow-up, relationship management
Newsletter Subscriptions Until unsubscribe Consent-based communications
Analytics and Usage Data 26 months Platform improvement, standard analytics retention
KYC/AML Records 7 years post-relationship termination Regulatory compliance and anti-fraud requirements
Website Access Logs 90 days Security and troubleshooting

After the applicable retention period, we securely delete or anonymize your data unless we are required by law to retain it longer.

10. Your Rights

Under GDPR and UAE data protection law, you have the following rights regarding your personal data:

10.1 Right of Access (GDPR Article 15)

You have the right to request and obtain a copy of all personal data we hold about you, including the purposes of processing, recipients, and retention periods.

10.2 Right of Rectification (GDPR Article 16)

You may request that we correct inaccurate, incomplete, or outdated personal data.

10.3 Right of Erasure ("Right to be Forgotten") (GDPR Article 17)

You may request deletion of your personal data, subject to exceptions for legal obligations, legitimate interests, or contractual necessity. Note: We may retain data as required by regulatory and tax laws.

10.4 Right to Restrict Processing (GDPR Article 18)

You may request that we limit our processing of your data to specific, legitimate purposes while we investigate a dispute or verify the accuracy of data.

10.5 Right to Data Portability (GDPR Article 20)

You may request that we provide your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, if technically feasible.

10.6 Right to Object (GDPR Article 21)

You may object to processing based on legitimate interest or direct marketing. We will cease processing unless we have compelling legitimate grounds that override your rights.

10.7 Right to Withdraw Consent

If processing is based on your consent (e.g., newsletter, marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

10.8 Right to Lodge a Complaint

If you believe your data rights have been violated, you may lodge a complaint with your data protection authority:

  • EU Residents: Your national data protection authority (e.g., CNIL in France, DPA in Greece)
  • UAE Residents: UAE Data Protection Authority (if applicable under UAE law)

10.9 How to Exercise Your Rights

To exercise any of the above rights, please contact us at:

Email: info@catalystassetcapital.com
Mail: Catalyst Asset Capital Ltd, Dubai, UAE

Include the following in your request:

  • Your full name and email address
  • The specific right you wish to exercise
  • A clear description of the data concerned
  • Your signature or confirmation of identity (for security purposes)

We will respond to requests within 30 days of receipt (or within the timeframe required by applicable law). If a request is complex or involves large amounts of data, we may extend this period by an additional 60 days, with prior notice.

11. Cookies and Tracking Technologies

Our website uses cookies, pixels, web beacons, and similar technologies to enhance your experience and collect usage data.

11.1 Types of Cookies

  • Essential Cookies: Necessary for platform functionality, security, and user authentication. These are not subject to consent requirements.
  • Performance/Analytics Cookies: Collected via Google Analytics to understand user behavior, track page views, and improve our services.
  • Targeting/Marketing Cookies: Used to deliver relevant content and track marketing campaign effectiveness (subject to consent).
  • Functional Cookies: Remember user preferences and settings for a better experience.

11.2 Cookie Management

You can control cookies through your browser settings or our cookie consent banner. Most browsers allow you to decline non-essential cookies. Note that disabling cookies may limit platform functionality.

11.3 Third-Party Analytics

We use Google Analytics to collect anonymized usage data. Google processes this data under its own privacy policy. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

11.4 External Embeds

Our website may include embedded content from third parties (e.g., Google Maps on the contact page, fonts from Google Fonts, images from Unsplash). These services may collect data according to their own privacy policies.

11.5 Cookie Policy

For detailed information about cookies, please see our dedicated Cookie Policy.

12. Data Security

We implement industry-standard technical, administrative, and physical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction.

12.1 Security Measures

  • Encryption: Data in transit uses HTTPS/TLS encryption. Sensitive data at rest is encrypted.
  • Access Controls: Only authorized personnel can access personal data, subject to role-based permissions.
  • Firewalls and Intrusion Detection: Network security systems monitor and prevent unauthorized access.
  • Regular Security Audits: We conduct periodic security assessments and penetration testing.
  • Secure Data Deletion: When data is no longer needed, it is securely deleted or anonymized.
  • Vendor Security: Third-party service providers are contractually required to maintain adequate security.

12.2 Limitations

While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet. If you believe your data has been compromised, please contact us immediately at info@catalystassetcapital.com.

13. Children's Privacy

Catalyst Asset Capital's platform is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we discover that a child has provided data without parental consent, we will promptly delete such information. If you believe a child's data has been collected, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

  • Posting the updated policy on our website with a new effective date
  • Sending you an email notification (for registered users)
  • Obtaining your explicit consent (for material changes affecting your rights)

Your continued use of the platform following the posting of revised terms means you accept and agree to the changes. Please review this policy periodically to stay informed of how we protect your data.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Catalyst Asset Capital Ltd
Data Protection & Privacy Team
Dubai, UAE

Email: info@catalystassetcapital.com
Website: catalystassetcapital.com

We typically respond to data protection inquiries within 5 business days.

Last Updated: March 2026. This Privacy Policy is effective for all users regardless of when they created their account.