PRIVACY POLICY
Vesteri website and platform · Version 1.5 · Effective from: 28 October 2026
1. Who is the controller of your data
The controller of your personal data is Time2Show, Inc., a company registered in the State of Delaware (USA), address: 1111B S Governors Ave STE 20579, Dover, DE 19904, USA, providing services under the Vesteri brand ("Vesteri", "we"). We conduct operational activities in Poland; our lead supervisory authority in the EU is the President of the Personal Data Protection Office (UODO), Poland.
Contact for personal data matters: privacy@vesteri.com or by post to the address above, marked "Personal Data / Vesteri".
Contact person for data protection matters: Piotr Nawrocki, privacy@vesteri.com.
2. Policy scope and processing areas
This Policy covers processing associated with vesteri.com, Collective membership and Vesteri Channels administration, and selected webinars and projects in the Vesteri portfolio.
- Website and guides: information about Vesteri, contact with our team, and analytics and marketing tools according to your cookie choices.
- Vesteri Market: accounts, listings, agents’ LIVE presentations and enquiries operate at vesteri.estalara.com. The separate Platform Privacy Policy describes that processing.
- Collective and Channels: account data supports membership administration, manual community invitations and organisational communication. Section 12 explains profile and message visibility and retention.
- Selected Vesteri portfolio projects: below we describe project information, webinars, AI, profiling and sharing data with developers. This process is not a condition for Channels participation and does not automatically apply to every Vesteri Market property. The descriptions of behavioural data, scoring and developer sharing in sections 3–9 apply within this scope when you use the relevant features and give the required consents. We retain these disclosures to explain processing, not to extend consent to other services.
Process for selected Vesteri projects
- Local marketing — you see our advertisements for developer projects (targeted by geography and language).
- Information and AI chat — we provide complete project information in your language; you can ask questions to an AI assistant.
- Webinar — you take part in a webinar hosted by a Vesteri moderator, at which the developer presents the project. During the webinar — with your consent — we record your behavioural signals (which project you stay at, what you ask, what you skip, when you disconnect).
- Interest profile and scoring — from these signals we build your interest profile and an automated purchase-readiness score. We segment by revealed preferences, not declarations.
- Handover to the developer — if your score passes the qualification threshold and you have consented, we share your contact details with the developer together with the full record of your questions and interests (intent profile).
- Support — at your request, we share contacts of verified, independent law firms on the target market.
- Retention — with your separate consent, we invite you to future webinars.
3. What data we collect
- Registration data: name, email address, preferred language, country.
- Survey/quiz answers (if completed): type of property sought, budget, investment goal, time horizon.
- Behavioural data from webinars and the website: time spent on individual projects, questions asked, content skipped, moment of disconnection, chat activity, reactions, returns.
- Conversations with the AI assistant: the content of questions and answers; we analyse the kinds of questions you ask to establish what property you are looking for.
- Intent profile (inferred data): property preferences (type, location, budget, features) and a purchase-readiness score. The profile concerns investment preferences only — we do not infer any protected characteristics (origin, religion, health, etc.).
- Technical data: truncated IP address, browser, device, session identifiers, cookies (see the Cookies Policy).
- Webinar recordings: if a webinar is recorded, we inform you before you join and obtain consent.
4. Purposes and legal bases
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Membership administration, Channels invitations and organisational communication | account and contact data | Art. 6(1)(b) (contract); details in section 12 |
| Community security and moderation | profile data, messages and reports | Art. 6(1)(f) (legitimate interest); details in section 12 |
| Registration and participation in webinars, access to materials | registration, technical | Art. 6(1)(b) (contract) |
| Operating the AI chat (answering questions) | AI conversations | Art. 6(1)(b) (contract) |
| Analysis of questions and behaviour → interest profile, scoring | behavioural, AI conversations, surveys | Art. 6(1)(a) (consent) |
| Sharing contact details with the developer together with the full record of questions and interests | contact, intent profile, question record | Art. 6(1)(a) (consent) |
| Passing your contact to a law firm | contact | Art. 6(1)(b) (at your request) |
| Invitations to future webinars, newsletter | contact, profile | Art. 6(1)(a) (consent) + Polish Electronic Communications Law |
| Personalisation of presented content | preference profile | Art. 6(1)(a) (consent) |
| Vesteri.com visit analytics (Google Analytics) and marketing interaction measurement (HubSpot), only with consent to the relevant category | browser identifiers, device data, visited pages and interactions | Art. 6(1)(a) (consent) |
| Advertising on external platforms | online identifiers | Art. 6(1)(a) (consent — cookies) |
| Improving the matching system (aggregated/pseudonymised data) | campaign statistics | Art. 6(1)(f) (legitimate interest) |
| Security and abuse prevention | technical | Art. 6(1)(f) (legitimate interest) |
| Settlements and tax obligations | billing data | Art. 6(1)(c) (legal obligation) |
Providing registration data is necessary to take part in a webinar. The consents (behavioural analysis, handover to the developer, marketing, personalisation) are voluntary and separate — you may attend a webinar without granting them; in that case we do not build a profile and do not share your data with the developer.
5. Artificial intelligence — disclosures (AI Act, Art. 50)
- AI assistant: in the chat you are talking to an artificial intelligence system, not a human — we inform you of this at the start of each conversation. The assistant may make mistakes; its answers are informational and do not constitute legal, tax, or investment advice.
- Translation: statements during a webinar may be translated by the moderator and assisted by AI; in case of discrepancy, the original statements prevail.
- Behavioural scoring — this is not emotion recognition: the purchase-readiness score and interest profile are built exclusively from behavioural signals (time, questions, activity). We do not analyse facial expressions, voice, or any biometric data; the system is not an "emotion recognition system" within the meaning of the AI Act and does not process special categories of data (Art. 9 GDPR). It remains profiling within the meaning of Art. 4(4) GDPR — see section 6.
- AI-generated advertising content is marked as artificially generated, in accordance with the AI Act.
Details: the "AI Notice" document in the website footer.
6. Profiling and automated assessment (Art. 22 GDPR)
The scoring assesses your purchase readiness (0–100) based on behavioural signals. The score determines whether the developer receives your data (qualification threshold). We have assessed that this does not produce legal or similarly significant effects on you: not passing the threshold does not limit your access to any offer — you can always contact the developer or us yourself, and participation in future webinars remains open.
Regardless, you have the right to: withdraw consent (we stop collecting signals and scoring), request human review of your score, express your point of view and contest the score, and obtain information about the scoring logic. Contact: section 1.
7. Who we share data with
- Developers — only with your consent and after the qualification threshold is passed. The developer receives your contact details and the full record of your questions and interests and becomes an independent controller of your data — responsible for it independently, under its own privacy policy and a data sharing agreement concluded with us (purpose limited to contact about the given project, no resale, obligation to honour your rights).
- Law firms — only at your request do we pass your contact to a selected firm; the firm acts as an independent controller.
- Technology providers (processors): hosting and cloud infrastructure, AI service providers (assistant, translation), analytics and communication tools — under data processing agreements (Art. 28 GDPR), with a prohibition on using your data to train their models.
- Advertising platforms (Meta, Google, TikTok, LinkedIn) — to the extent described in the Cookies Policy; they act as independent/joint controllers of their own advertising processing.
- Public authorities — where required by law.
We do not sell your data.
Optional tools on Vesteri.com include Google Analytics (Google Ireland Limited / Google LLC) and HubSpot (HubSpot Ireland Limited / HubSpot, Inc.). We load them only with consent to the relevant banner category. Change or withdraw consent using “Cookie settings” in the footer. Our Cookies Policy describes categories, cookies and their lifetimes.
8. Transfers outside the EEA
As a rule, Vesteri service data is stored and processed in the European Economic Area (EEA). Optional Google Analytics and HubSpot tools, loaded with your consent, may be an exception: their providers may process data outside the EEA, including in the USA, with appropriate safeguards described in the Cookies Policy. As Time2Show, Inc. is a US company, should any access from outside the EEA occur or a provider change involve a transfer, we will apply a valid transfer mechanism (the EU-US Data Privacy Framework for certified recipients, or Standard Contractual Clauses together with a transfer impact assessment) and update this Policy. You can obtain a copy of the safeguards by writing to the address in section 1. The advertising platforms listed in the Cookies Policy may transfer data under their own mechanisms as independent controllers.
9. How long we keep data
| Category | Period |
|---|---|
| Contact data, behavioural data, intent profile, scoring | 24 months from the last webinar, then deletion |
| Conversations with the AI assistant | 12 months |
| Webinar recordings | up to 24 months or until consent is withdrawn |
| Technical data (logs) | 90 days |
| Data handed to a developer | the developer is responsible as an independent controller |
| Browser cookie category preferences | 180 days; details in the Cookies Policy |
| Consent register | 3 years from the last interaction |
| Billing data | periods required by tax law |
Following an effective withdrawal of consent, data not yet handed to a developer is deleted within 30 days.
10. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time, and to lodge a complaint with the President of UODO (uodo.gov.pl) or the authority in your country of residence. Details and how to exercise them: the "GDPR — Your rights" page in the footer. Data already handed to a developer cannot be recalled by us — the developer is independently obligated to honour your rights; at your request we will forward your request to them.
11. Other
The service is intended for adults (18+). We apply appropriate technical and organisational measures (encryption in transit and at rest, access control, monitoring). We will notify material changes to this Policy by email 30 days in advance. Current version: vesteri.com/en/privacy-policy.
In case of discrepancies, for consumers habitually resident in Poland the Polish version prevails.
12. Vesteri Channels and Collective membership
As part of Collective, we administer Vesteri Channels invitations, organisational communications and community moderation. We use agent account details, including name, professional information and email address. Our team manually sends an invitation to every agent after registration. Membership and access administration rely on Art. 6(1)(b) GDPR; security and moderation rely on Art. 6(1)(f) GDPR.
Profiles, messages and materials you publish are visible to recipients of the relevant conversation or channel according to workspace settings. Administrators have access as needed for administration and moderation. Do not publish client data or confidential documents; anonymise professional examples.
The space uses an external communication service provider. Data is shared with that provider as necessary to operate the service. Review the provider terms and privacy settings presented when joining. Processing may involve countries outside the EEA; appropriate transfer safeguards described in section 8 are required in that case. Section 8's statement about EEA storage is not an assurance about the location of Vesteri Channels data.
We process access data during participation. After participation ends, we limit processing to data needed for legal obligations, handling reports or establishing, exercising or defending claims. Discussion content may require individual consideration when handling an erasure request, taking account of other participants' rights. For data matters, available provider information, retention and profile deletion, contact privacy@vesteri.com. The rights in section 10 also apply to Channels data.