PRIVACY POLICY
Vesteri website and platform · Version 1.1 · Effective date: 13 August 2026
1. Who is the controller of your data
The controller of your personal data is Time2Show, Inc., a company registered in the State of Delaware (USA), address: 1111B S Governors Ave STE 20579, Dover, DE 19904, USA, providing services under the Vesteri brand ("Vesteri", "we"). We conduct operational activities in Poland; our lead supervisory authority in the EU is the President of the Personal Data Protection Office (UODO), Poland.
Contact for personal data matters: privacy@vesteri.com or by post to the address above, marked "Personal Data / Vesteri".
2. How Vesteri works — a transparent description of processing
Vesteri helps investors from Poland (and, over time, other EU countries) invest knowingly in property on selected markets abroad (currently: Cyprus, Thailand). We process your data at the following stages:
- Local marketing — you see our advertisements for developer projects (targeted by geography and language).
- Information and AI chat — we provide complete project information in your language; you can ask questions to an AI assistant.
- Webinar — you take part in a webinar hosted by a Vesteri moderator, at which the developer presents the project. During the webinar — with your consent — we record your behavioural signals (which project you stay at, what you ask, what you skip, when you disconnect).
- Interest profile and scoring — from these signals we build your interest profile and an automated purchase-readiness score. We segment by revealed preferences, not declarations.
- Handover to the developer — if your score passes the qualification threshold and you have consented, we share your contact details with the developer together with the full record of your questions and interests (intent profile).
- Support — at your request, we share contacts of verified, independent law firms on the target market.
- Retention — with your separate consent, we invite you to future webinars.
3. What data we collect
- Registration data: name, email address, preferred language, country.
- Survey/quiz answers (if completed): type of property sought, budget, investment goal, time horizon.
- Behavioural data from webinars and the website: time spent on individual projects, questions asked, content skipped, moment of disconnection, chat activity, reactions, returns.
- Conversations with the AI assistant: the content of questions and answers; we analyse the kinds of questions you ask to establish what property you are looking for.
- Intent profile (inferred data): property preferences (type, location, budget, features) and a purchase-readiness score. The profile concerns investment preferences only — we do not infer any protected characteristics (origin, religion, health, etc.).
- Technical data: truncated IP address, browser, device, session identifiers, cookies (see the Cookies Policy).
- Webinar recordings: if a webinar is recorded, we inform you before you join and obtain consent.
4. Purposes and legal bases
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Registration and participation in webinars, access to materials | registration, technical | Art. 6(1)(b) (contract) |
| Operating the AI chat (answering questions) | AI conversations | Art. 6(1)(b) (contract) |
| Analysis of questions and behaviour → interest profile, scoring | behavioural, AI conversations, surveys | Art. 6(1)(a) (consent) |
| Sharing contact details with the developer together with the full record of questions and interests | contact, intent profile, question record | Art. 6(1)(a) (consent) |
| Passing your contact to a law firm | contact | Art. 6(1)(b) (at your request) |
| Invitations to future webinars, newsletter | contact, profile | Art. 6(1)(a) (consent) + Polish Electronic Communications Law |
| Personalisation of presented content | preference profile | Art. 6(1)(a) (consent) |
| Advertising on external platforms | online identifiers | Art. 6(1)(a) (consent — cookies) |
| Improving the matching system (aggregated/pseudonymised data) | campaign statistics | Art. 6(1)(f) (legitimate interest) |
| Security and abuse prevention | technical | Art. 6(1)(f) (legitimate interest) |
| Settlements and tax obligations | billing data | Art. 6(1)(c) (legal obligation) |
Providing registration data is necessary to take part in a webinar. The consents (behavioural analysis, handover to the developer, marketing, personalisation) are voluntary and separate — you may attend a webinar without granting them; in that case we do not build a profile and do not share your data with the developer.
5. Artificial intelligence — disclosures (AI Act, Art. 50)
- AI assistant: in the chat you are talking to an artificial intelligence system, not a human — we inform you of this at the start of each conversation. The assistant may make mistakes; its answers are informational and do not constitute legal, tax, or investment advice.
- Translation: statements during a webinar may be translated by the moderator and assisted by AI; in case of discrepancy, the original statements prevail.
- Behavioural scoring — this is not emotion recognition: the purchase-readiness score and interest profile are built exclusively from behavioural signals (time, questions, activity). We do not analyse facial expressions, voice, or any biometric data; the system is not an "emotion recognition system" within the meaning of the AI Act and does not process special categories of data (Art. 9 GDPR). It remains profiling within the meaning of Art. 4(4) GDPR — see section 6.
- AI-generated advertising content is marked as artificially generated, in accordance with the AI Act.
Details: the "AI Notice" document in the website footer.
6. Profiling and automated assessment (Art. 22 GDPR)
The scoring assesses your purchase readiness (0–100) based on behavioural signals. The score determines whether the developer receives your data (qualification threshold). We have assessed that this does not produce legal or similarly significant effects on you: not passing the threshold does not limit your access to any offer — you can always contact the developer or us yourself, and participation in future webinars remains open.
Regardless, you have the right to: withdraw consent (we stop collecting signals and scoring), request human review of your score, express your point of view and contest the score, and obtain information about the scoring logic. Contact: section 1.
7. Who we share data with
- Developers — only with your consent and after the qualification threshold is passed. The developer receives your contact details and the full record of your questions and interests and becomes an independent controller of your data — responsible for it independently, under its own privacy policy and a data sharing agreement concluded with us (purpose limited to contact about the given project, no resale, obligation to honour your rights).
- Law firms — only at your request do we pass your contact to a selected firm; the firm acts as an independent controller.
- Technology providers (processors): hosting and cloud infrastructure, AI service providers (assistant, translation), analytics and communication tools — under data processing agreements (Art. 28 GDPR), with a prohibition on using your data to train their models.
- Advertising platforms (Meta, Google, TikTok, LinkedIn) — to the extent described in the Cookies Policy; they act as independent/joint controllers of their own advertising processing.
- Public authorities — where required by law.
We do not sell your data.
8. Transfers outside the EEA
Your data is stored and processed on servers located in the European Economic Area (EEA). As a rule, we do not transfer data outside the EEA. As Time2Show, Inc. is a US company, should any access from outside the EEA occur or a provider change involve a transfer, we will apply a valid transfer mechanism (the EU-US Data Privacy Framework for certified recipients, or Standard Contractual Clauses together with a transfer impact assessment) and update this Policy. You can obtain a copy of the safeguards by writing to the address in section 1. The advertising platforms listed in the Cookies Policy may transfer data under their own mechanisms as independent controllers.
9. How long we keep data
| Category | Period |
|---|---|
| Contact data, behavioural data, intent profile, scoring | 24 months from the last webinar, then deletion |
| Conversations with the AI assistant | 12 months |
| Webinar recordings | up to 24 months or until consent is withdrawn |
| Technical data (logs) | 90 days |
| Data handed to a developer | the developer is responsible as an independent controller |
| Consent register | 3 years from the last interaction |
| Billing data | periods required by tax law |
Following an effective withdrawal of consent, data not yet handed to a developer is deleted within 30 days.
10. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time, and to lodge a complaint with the President of UODO (uodo.gov.pl) or the authority in your country of residence. Details and how to exercise them: the "GDPR — Your rights" page in the footer. Data already handed to a developer cannot be recalled by us — the developer is independently obligated to honour your rights; at your request we will forward your request to them.
11. Other
The service is intended for adults (18+). We apply appropriate technical and organisational measures (encryption in transit and at rest, access control, monitoring). We will notify material changes to this Policy by email 30 days in advance. Current version: vesteri.com/en/privacy-policy.
In case of discrepancies, for consumers habitually resident in Poland the Polish version prevails.