Privacy Policy

• Data Controller: Atoll Property acts as the primary data controller for personal data collected through atollproperty.com.
• Technology Provider & Data Processor: Atoll Property has appointed MothForest Ltd as its technology provider and technical data processor responsible for integrating and managing our digital identity verification and compliance infrastructure.
• Authorised Sub-Processor: MothForest Ltd utilises Sumsub (Sum and Substance Ltd) as an authorised compliance sub-processor for configured identity document checks, biometric verification and global AML watchlist screening.

When you use our platform or engage in real estate transactions requiring identity checks, we may collect and process the following, depending on the service used:

• Personal Identification Information: Full legal name, date of birth, gender, nationality, residential address, telephone number and email address.
• Identification Documentation: Copies or photographic scans of government-issued identification, such as passports, national identity cards and driving licences.
• Biometric and Liveness Data: Facial geometry data, facial images, video liveness recordings and biometric selfie checks processed during provider verification to confirm identity and prevent identity theft. These are not collected by the simulated identity option.
• Technical & Security Data: IP address, browser type, device identifiers and timestamp metadata collected during a verification session.
• Account and Transaction Records: Account details, reservation or purchase records, supporting documents, source-of-funds declarations, sample agreement acceptances and handover requests submitted through the purchase journey.

We and our appointed processors process personal data for the following purposes and legal bases, where applicable to your jurisdiction and the service provided:

• Compliance with Legal Obligations: Conducting required AML, Counter-Terrorist Financing (CTF) and KYC checks against international watchlists, politically exposed persons (PEP) databases and sanctions lists when legally required and the screening service is enabled.
• Contractual Necessity: Authenticating buyer and seller identities where necessary before facilitating property agreements or transactions. The public demo valuation does not require real identity documents.
• Legitimate Interests: Protecting our services, users and marketplace against fraud, unauthorised transactions and cyber threats, subject to applicable balancing and legal requirements.

Where biometric data is subject to additional protection, we must establish the applicable legal condition, including explicit consent where required, before processing. We will provide the relevant verification notice and consent request when required.

We do not sell, rent or trade your personal data. Data is shared on a confidential, need-to-know basis:

• Verification Processing: When configured, verification data is transmitted through encrypted channels to Sumsub for document processing, biometric matching and activated watchlist screening. MothForest Ltd manages the integration and may access data only as necessary for authorised technical support and processing.
• Cloud Hosting: Lovable Cloud provides the account database, authentication and private document storage used by this platform.
• Regulatory Authorities: Information may be disclosed to law enforcement bodies, financial regulators or competent government authorities where required by applicable law.

We use HTTPS/TLS to protect data in transit. Identity documents uploaded to the platform are held in private cloud storage with access controls restricting access to the account holder and authorised review staff. Payment steps are simulated; no payment card details are collected by this demo.

Our cloud and verification providers may process information outside your country. Before enabling processing that requires international-transfer safeguards, appropriate data processing agreements and transfer mechanisms, such as Standard Contractual Clauses (SCCs) where applicable, must be established with MothForest Ltd, Sumsub and relevant providers.

This notice does not represent that provider certifications or particular transfer agreements have already been independently verified or executed. No method of storage or transmission can guarantee absolute security. Contact us for information about applicable processing locations and safeguards.

Verification records, audit logs and AML screening results are retained only for as long as necessary for their stated purpose and applicable statutory, regulatory, tax and anti-money laundering obligations. Such requirements commonly provide for retention of around five years after a transaction or account closure, but the exact period depends on applicable law and the record involved; this is not a confirmed statutory period for every property transaction.

When applicable retention obligations expire, data should be securely deleted or irreversibly anonymised, subject to lawful preservation requirements. A production retention schedule and deletion arrangements with processors must be confirmed before live transactions. This demonstration does not currently implement an automatic five-year deletion schedule.

Depending on your jurisdiction and subject to legal exemptions, including those relating to AML compliance, you may have the right to:

• Access and receive a copy of the personal data held about you.
• Request rectification of incorrect or outdated personal data.
• Request erasure where processing is no longer legally necessary.
• Restrict or object to certain aspects of processing.
• Request data portability in a structured, machine-readable format.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.
• Raise a complaint with the competent data protection authority where applicable.

Contact us to exercise your rights or request review of a verification decision. We may need to verify your identity before acting on a request; some records may need to be retained by law.

For inquiries or requests regarding your personal data or this Privacy Policy, please contact:

• Atoll Property Data Protectionprivacy@atollproperty.com
• Technical Infrastructure & Data Processing — MothForest Ltdprivacy@mothforest.com

Sample listings, prices and availability are illustrative. Purchases, agreements, external approvals, payments, registration and handover are simulated; no binding property agreement or legal title is created. The public valuation demo keeps acceptance state in memory and generates a non-legal PDF certificate; use a made-up buyer ID, not real identity details.

Live deployment requires approved project-specific lease documents, configured verification and screening, confirmed processor and transfer agreements, and review of this policy against applicable law. This notice is not a statement of government approval or a guarantee of regulatory compliance.