Effective Date: April 1st 2025

1. Introduction

Welcome to PT. PARADYSE PROJECTS BALI (“Company”, “we”, “our”, “us”). We operate a digital real estate marketplace under the domain https://www.paradysehomes.com, primarily facilitating the promotion of property listings online and the execution of real estate sales offline via live processes.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with applicable data protection laws, including:

• General Data Protection Regulation (EU) 2016/679 (GDPR)
• UK Data Protection Act 2018
• Australia Privacy Act 1988 (Cth)
• New Zealand Privacy Act 2020
• Singapore Personal Data Protection Act 2012 (PDPA)
• Indonesia Personal Data Protection Law (2022)
• UAE Federal Decree-Law No. 45 of 2021 and DIFC Data Protection Law 2020
• Hong Kong Personal Data (Privacy) Ordinance (PDPO)
• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)

By accessing our website, engaging with our services, or interacting with our platforms (including social media), you acknowledge and consent to the practices described in this Privacy Policy.

2. Data Controller Contact Details
3. PARADYSE PROJECTS BALI
   Jl. Raya Semat No.17B, Tibubeneng, Kec. Kuta Utara, Kabupaten Badung, Bali 80361
   Email: hello@paradysehomes.com
   Phone: +62 813 3084 3963

We are currently not required to appoint a Data Protection Officer under Article 37 GDPR. However, inquiries related to this policy may be directed to the above contact.

3. Categories of Personal Data Processed

We process the following categories of personal data:

• Identification Data: Name, contact information (email, phone, address)
• Technical Data: IP address, browser type/version, operating system, device identifiers
• Usage Data: Website visits, time on site, click paths, referral source
• Marketing Data: User preferences, responses to campaigns, cookies and tracking pixels
• Location Data: General geolocation based on IP address
• Social Media Data: Interactions via platforms such as Facebook, Instagram, LinkedIn, YouTube
• Job Application Data: CVs, cover letters, educational and employment history
• Appointment Scheduling Data: Metadata and user-submitted scheduling information

4. Legal Bases for Processing

We rely on the following legal bases under Article 6(1) GDPR and equivalent principles in other jurisdictions:

• Consent (Art. 6(1)(a)) – For email marketing, cookie tracking, newsletter subscriptions
• Contractual Necessity (Art. 6(1)(b)) – For pre-contractual interactions and transactions
• Legal Obligation (Art. 6(1)(c)) – For compliance with regulatory and tax laws
• Legitimate Interests (Art. 6(1)(f)) – For analytics, website functionality, fraud prevention

For Canada (PIPEDA), we rely on knowledge and consent, except where exceptions apply. For Hong Kong (PDPO), we ensure fair and lawful collection, use for direct marketing with consent, and implement data access and correction rights.

5. Data Collection Sources

Personal data may be collected:

• Directly from users (e.g., contact forms, job applications)
• Automatically through website analytics and tracking tools
• Via social media platforms where users engage with our content
• From third-party platforms used for customer relationship management or marketing

6. Cookies and Tracking Technologies

We use cookies and similar technologies for performance, marketing, and functionality. Technologies used include:

• Google Analytics (analytics.google.com)
• Meta Pixel (facebook.com/business/tools/meta-pixel)
• HubSpot (hubspot.com)
• Hotjar (hotjar.com)
• Microsoft Clarity (clarity.microsoft.com)

Users may manage cookies via browser settings. Where required, we obtain user consent before placing non-essential cookies (per GDPR, PIPEDA, and ePrivacy Directive).

7. Data Transfers to Third Countries

Data may be transferred to service providers in countries outside the EEA. These transfers are safeguarded by:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions where applicable (e.g., UK, New Zealand, Canada)
• Supplementary measures such as encryption, access restrictions, and contractual obligations

8. Social Media Data Processing

We operate official company profiles on platforms including:

• Facebook & Instagram – Meta Platforms Ireland Ltd.
• LinkedIn – LinkedIn Ireland Unlimited Company
• YouTube – Google Ireland Limited

Data collected via interactions (e.g., likes, messages, comments) is processed under joint controllership (Art. 26 GDPR) where applicable. Each platform’s privacy policy also applies.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention timelines include:

• Contact inquiries: 12 months
• Newsletter subscribers: until unsubscribe or withdrawal of consent
• Job applicants: 6 months post-application unless consent for longer storage is provided
• Analytics data: anonymized or deleted after 26 months

10. Third-Party Processors

We engage third-party processors under data processing agreements compliant with Article 28 GDPR and equivalent safeguards in other jurisdictions. These include:

• Web hosting: AWS or equivalent
• CRM and Marketing: HubSpot, Meta
• Analytics: Google Analytics, Hotjar, Microsoft Clarity
• Newsletter and Email: HubSpot, Gmail (Google Workspace)

11. Data Subject Rights

Under applicable law, you have the following rights:

• Right of Access (Art. 15 GDPR, Sec. 18 PDPO, PIPEDA principle 9)
• Right to Rectification (Art. 16 GDPR, PDPO, PIPEDA)
• Right to Erasure (Art. 17 GDPR, limited under PDPO and PIPEDA)
• Right to Restriction of Processing (Art. 18 GDPR)
• Right to Data Portability (Art. 20 GDPR)
• Right to Object to Processing (Art. 21 GDPR)
• Right to Withdraw Consent at any time (Art. 7 GDPR)

Requests can be made via email to hello@paradysehomes.com. We may require proof of identity before fulfilling such requests.

12. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects or similarly significant impacts on individuals (Art. 22 GDPR).

13. Job Applications

If you apply for a position through our website or a recruitment platform, we process your data to assess and manage your application. Sensitive information (e.g., political opinions, religious beliefs) should not be included unless legally required. Data is deleted 6 months after rejection or retained with consent for future roles.

14. Appointment Scheduling

If you use our booking system, your metadata, preferred times, and personal contact details may be processed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in appointment management).

15. Direct Marketing and Newsletters

Users may subscribe to newsletters or be contacted based on prior consent or legitimate interest. Each email includes an unsubscribe option. We track:

• Email opens
• Link clicks

Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interest), PDPO and PIPEDA (express or implied consent).

16. Security Measures

We implement appropriate technical and organizational measures under Art. 32 GDPR and industry best practices, including:

• Data encryption in transit and at rest
• Multi-factor authentication
• Firewalls and access controls
• Security awareness training

17. Policy Updates

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated effective date. If the changes are material, users will be notified via email or a banner notice on our website.

18. Supervisory Authority Contact

If you are in the EU or UK, you have the right to lodge a complaint with your local data protection authority. A list of EU regulators is available at: https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html

For Canada, complaints may be filed with the Office of the Privacy Commissioner: https://www.priv.gc.ca/

For Hong Kong, contact the Privacy Commissioner for Personal Data: https://www.pcpd.org.hk