Privacy Policy

Vespermont Group ("Vespermont", "we", "us", "our") is a luxury real estate advisory firm incorporated in England and Wales (Company No. 04271832), with registered offices at One Canary Wharf, London, E14 5AB. We also operate offices in Dubai (UAE), Gurugram (India), and Singapore. We are regulated by the Financial Conduct Authority (FCA Reference No. 782341) for certain investment advisory activities in the United Kingdom, and hold a Dubai Land Department (DLD) brokerage licence for real estate activities in Dubai. This Privacy Policy applies to all personal data collected through our website (vespermont.com), our investor portal, our mobile applications, and through our direct client advisory services.

We collect personal information in the following circumstances: Contact & Enquiry Forms: Name, email address, phone number, investment budget, preferred location, and any additional details you provide when submitting an enquiry via our website or consultation forms. Client Onboarding: For formal advisory mandates, we collect identity verification documents (passport, PAN, Aadhaar for India clients), proof of address, source of funds declarations, and financial profile information — as required by applicable AML/KYC regulations. Investor Portal: If you access our private investor portal, we collect login credentials, portfolio data, document uploads, and usage analytics to deliver and improve the service. Website Analytics: We collect anonymised browsing data (pages visited, time on site, referral source) via cookies and analytics tools. This data is aggregated and does not identify you personally. Communications: When you email us or engage through WhatsApp, we retain those communications for client service and compliance purposes.

We use your personal information to: • Respond to your enquiries and provide property advisory services • Conduct KYC and AML due diligence as required by FCA, RERA, and DLD regulations • Send you property recommendations, market reports, and investment opportunities that match your stated criteria • Manage your investor portal account and portfolio data • Send transactional communications (booking confirmations, document notifications, appointment reminders) • Analyse website usage to improve our digital services • Comply with legal obligations including tax reporting, anti-money laundering checks, and regulatory filings • Protect against fraud and unauthorised access to our systems We do not sell, rent or share your personal data with third parties for their own marketing purposes under any circumstances.

For clients in the United Kingdom and European Union, we process your personal data on the following legal bases under the UK GDPR and EU GDPR: Contractual Necessity: Processing required to fulfil our advisory mandate or provide services you have requested. Legal Obligation: Processing required to comply with FCA regulations, anti-money laundering obligations, tax reporting requirements and other applicable law. Legitimate Interests: Processing for fraud prevention, network security, service improvement, and direct marketing of similar services to existing clients — where your interests and rights do not override our legitimate interests. Consent: Where we send marketing communications to prospective clients or use non-essential cookies, we do so only with your explicit consent, which you may withdraw at any time.

We share your personal data only with: Empanelled Service Partners: Lawyers, surveyors, mortgage brokers and property managers we engage to fulfil your mandate — bound by confidentiality agreements. Regulatory Bodies: FCA (UK), DLD (Dubai), RERA (India), HMRC, Income Tax Department of India, and other regulators as required by applicable law. Technology Providers: Our CRM, portal infrastructure, email delivery and analytics providers — all subject to data processing agreements that restrict use of your data to service delivery only. Developer Partners: With your explicit consent, we may share your enquiry details with developer sales teams when you express interest in a specific project. We do not transfer your data outside the UK/EU/India/UAE except where necessary for your specific advisory requirements and appropriate transfer safeguards are in place.

We retain personal data for the following periods: • Enquiry data (non-clients): 24 months from last contact • Client onboarding & KYC documents: 7 years from the end of the client relationship (as required by AML regulations) • Transaction documents: 10 years from completion (as required by HMRC / Income Tax requirements) • Investor portal data: For the duration of the client relationship, plus 7 years • Marketing preferences: Until you opt out or request deletion After the applicable retention period, data is securely deleted or anonymised.

Depending on your jurisdiction, you have the following rights in respect of your personal data: UK/EU (UK GDPR / GDPR): Right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. India (DPDP Act 2023): Right to access, correction, erasure, and grievance redressal. You may raise concerns with our Grievance Officer (see Section 10). UAE: Data subject rights under the UAE Personal Data Protection Law (PDPL), including access and correction rights. To exercise any of these rights, email privacy@vespermont.com. We will respond within 30 days.

We use cookies and similar technologies on our website. Please see our Cookie Policy for full details on what cookies we use, why, and how to manage your preferences. In summary: we use essential cookies (required for the website to function), analytics cookies (anonymised traffic analysis), and marketing cookies (with your consent only, to personalise content and advertisements on third-party platforms).

We implement industry-standard security measures to protect your personal data, including: • 256-bit AES encryption for all data at rest and in transit • Two-factor authentication on all internal systems • Role-based access controls limiting staff access to data on a need-to-know basis • SOC 2 Type II compliant infrastructure for our investor portal • Regular penetration testing and security audits • Employee data protection training and background checks In the event of a data breach that affects your rights and freedoms, we will notify you and relevant regulators within 72 hours of becoming aware of the breach, as required by applicable law.

For any privacy-related enquiries, data subject requests, or complaints: Email: privacy@vespermont.com Post: Data Protection Officer, Vespermont Group, One Canary Wharf, London, E14 5AB, United Kingdom India Grievance Officer (under DPDP Act 2023): Rajan Mehta, Director — India Operations Email: grievance.india@vespermont.com Address: Vespermont India, DLF Cyber City, Tower A, Gurugram, Haryana 122002 UAE Data Controller Contact: Email: privacy.uae@vespermont.com

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes, we will notify you by email (if you are a client or subscriber) and update the "Last Updated" date at the top of this page. We encourage you to review this Policy periodically. Last Updated: 14 August 2026 Effective Date: 1 January 2024