Cookies Policy

Effective Date: [Insert Effective Date]

1. Terms and Definitions

Policy means this Privacy Policy for Personal Data Processing and Cookies, available on the Internet at: infiniamaldives.com/cookies.

We, Us, Our, Operator means ExpertAgent Limited Liability Company (LLC), Tax Identification Number (TIN): 7810724325, Primary State Registration Number (OGRN): 1187847070608, registered address: Office 1, Premises 133, Building D, 14 Pulkovskoye Highway, Saint Petersburg, 196158, Russian Federation, email: infiniarealestatew@gmail.com.

You, Your, Data Subject means our counterparty under the User Agreement, namely any natural person who uses the Website in accordance with the terms and conditions of the User Agreement.

User Agreement means the public offer governing the use of the Website by Users, available at: infiniamaldives.com/policy.

Personal Data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing of Personal Data means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, anonymization, restriction, erasure, or destruction of Personal Data. Personal Data is processed using mixed methods, including automated processing where applicable.

Automated Processing of Personal Data means the processing of Personal Data by means of computer technology.

Confidentiality of Personal Data means the obligation imposed upon Us or any other person who has obtained access to Personal Data to prevent its disclosure without the consent of the Data Subject or another lawful basis.

Anonymization of Personal Data means actions resulting in the impossibility of determining, without the use of additional information, whether Personal Data belongs to a particular Data Subject.

Website means Our website located at infiniamaldives.com.

Cookies means small text files placed by the Website on Your computer or device when You visit certain sections of the Website and/or use certain Website features.

Federal Law No. 152-FZ means the Federal Law of the Russian Federation No. 152-FZ dated July 27, 2006, “On Personal Data.”

GDPR or Regulation means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, repealing Directive 95/46/EC, as amended from time to time.

California Online Privacy Protection Act (CalOPPA) means the California law governing online privacy protection.

California Consumer Privacy Act (CCPA) means the first comprehensive privacy law in the United States, enacted in June 2018, granting California consumers various privacy rights.

U.S. Privacy Act of 1974 (UPA) means the United States federal law governing the processing of personal information relating to U.S. citizens and lawful permanent residents.

Privacy and Electronic Communications Regulations (PECR) means the Privacy and Electronic Communications (EC Directive) Regulations 2003.

UAE Data Protection and Privacy Laws means any and all laws and regulations governing the Processing of Personal Data, including, without limitation:

• the Dubai Emirate Data Protection and Privacy Law;
• the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), effective January 2, 2022;
• the Constitution of the United Arab Emirates (Federal Law No. 1 of 1971);
• the Crimes and Penalties Law (Federal Decree-Law No. 31 of 2021, replacing Federal Law No. 3 of 1987);
• the Cybercrime Law (Federal Law No. 5 of 2012 on Combating Information Technology Crimes), as amended;
• the Telecommunications Regulatory Law and related TDRA regulations.

2. Purpose and Legal Basis for Processing Personal Data

2.1 Scope of the Policy

The provisions of this Policy apply to the relationship between You and Us concerning the Processing of Personal Data arising from Your use of the Website following Your acceptance of the User Agreement.

2.2 Legal Basis for Processing

The legal basis for Processing Your Personal Data is always Your consent. Without Your consent to this Policy, We will not be able to fully perform Our obligations under any agreements concluded with You, including, without limitation, the User Agreement.

3. Acceptance of the Policy

3.1 Acceptance of the Policy

This section explains which actions constitute Your consent to the Processing of Your Personal Data (the “Consent to Personal Data Processing”).

3.2 Content of the Consent

By providing Your Consent to Personal Data Processing, You confirm that You have fully read, understood, and accepted the User Agreement, this Privacy Policy for Personal Data Processing and Cookies, and You provide Your specific, informed, freely given, explicit, and unambiguous consent to the Processing of Your Personal Data.

3.3 Scope of the Consent

Your Consent to Personal Data Processing includes, among other things, Your consent to the Processing of Your Personal Data both by automated means and without the use of automated means, in accordance with the terms of this Policy and the Consent to Personal Data Processing.

3.4 Callback Request

If You request a callback using the relevant functionality available on the Website, You shall be deemed to have provided Your Consent to Personal Data Processing at the moment You click the “Request a Call” button (or any equivalent button).

3.5 Telephone Calls

If You initiate a telephone call to the Operator and continue the conversation with the Operator's representative, You thereby provide Your Consent to Personal Data Processing.

3.6 Communication via Messenger Applications

If You send Us a message through any messenger application, Your Consent to Personal Data Processing shall be deemed to have been provided upon sending Your first message to Us.

3.7 Browsing the Website

If You simply browse the Website, You shall be deemed to have provided Your Consent to the Processing of Personal Data to the extent described in this Policy, including the processing of technical information and Cookies (unless a separate consent mechanism for Cookies has been implemented on the Website).

3.8 Retention of Consent Records

We may retain records of Your actions confirming Your Consent to Personal Data Processing (including system logs or equivalent records) for a period of three (3) years from the date on which You provided such consent, unless a different retention period is required by applicable law.

4. Duration of the Policy and Personal Data Processing

4.1 Duration of the Policy

Once accepted, this Policy shall remain in force indefinitely. However, the duration of this Policy does not determine the period during which Your Personal Data is processed.

4.2 Retention Period for Personal Data

As a general rule, We process Your Personal Data until We have responded to Your request or inquiry and for an additional period of three (3) years thereafter, unless a different retention period is required by applicable law, the User Agreement, or any other agreement relating to Your use of the Website.

In all other cases, We will cease Processing Your Personal Data if You object to such Processing or withdraw Your previously given consent in accordance with this Policy and applicable law.

Please note that withdrawal of consent or objection to Processing may prevent Us from fulfilling Our obligations under agreements concluded with You.

4.3 Amendments to the Policy

We reserve the right to amend this Policy at any time. Such amendments may result from changes to Our business processes, legal requirements, operational needs, or other circumstances.

Any updated version of this Policy will be published on the Website immediately after its adoption so that You may review the revised version.

Your continued use of the Website following the publication of an updated Policy shall constitute Your unconditional acceptance of the revised Policy.

5. Legal Basis, Purpose, and Principles of the Policy

5.1 Legal Basis

This Policy has been developed in accordance with the requirements of:

• the General Data Protection Regulation (GDPR);
• the California Online Privacy Protection Act (CalOPPA);
• the California Consumer Privacy Act (CCPA);
• the Privacy and Electronic Communications Regulations (PECR);
• the Federal Law of the Russian Federation No. 152-FZ “On Personal Data”;
• the UAE Data Protection and Privacy Laws; and
• all other applicable laws and regulations governing the Processing of Personal Data.

5.2 Purpose of the Policy

This Policy is intended to:

• ensure the protection of the rights and freedoms of individuals in connection with the Processing of Personal Data;
• prevent unauthorized or accidental access by third parties to Your Personal Data;
• establish an appropriate legal and organizational framework for maintaining the confidentiality and security of Your Personal Data;
• protect constitutional and fundamental privacy rights relating to Personal Data.

Accordingly, the primary purpose of this Policy is to provide You with a clear and transparent understanding of:

• the legal basis for collecting and Processing Your Personal Data;
• the categories of Personal Data We may collect;
• how Your Personal Data is processed and used;
• where Your Personal Data is processed;
• how long We retain Your Personal Data;
• with whom Your Personal Data may be shared; and
• Your rights as a Data Subject under applicable data protection laws.

5.3 Principles of Personal Data Processing

We adhere to the following principles when Processing Personal Data:

• Personal Data shall be processed lawfully, fairly, and transparently.
• Personal Data shall be collected for specified, explicit, and legitimate purposes and shall not be further processed in a manner incompatible with those purposes.
• The Personal Data processed shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• We shall take reasonable measures to ensure that Personal Data is accurate, complete, and, where necessary, kept up to date.
• Personal Data shall not be retained for longer than is necessary to achieve the purposes for which it was collected.

6. Categories of Personal Data Collected

6.1 Callback Requests

You may request a callback through the Website. To do so, You will be asked to provide the following information:

• Your mobile telephone number; and
• Your name.

Please note that if You provide Personal Data relating to a third party, You represent and warrant that You have complied with all requirements set forth in this Policy.

You may enter any name in the form, including a name other than Your legal name. However, any name provided must comply with generally accepted standards of ethics, morality, and public decency.

6.2 Messenger Data

The Website provides the option to contact Us through WhatsApp, Telegram, and other messenger applications (where available).

When You send Us a message through such services, We may receive:

• Your messenger account identifier or username;
• information contained in Your public messenger profile; and
• any additional information that You voluntarily provide in Your message.

6.3 Technical Information

While You use the Website, We automatically collect certain technical information, including, where applicable:

• Internet Protocol (IP) address;
• login information;
• browser type and version;
• time zone settings;
• browser plug-in types and versions;
• operating system;
• device platform;
• information regarding Your visits to the Website;
• pages viewed;
• referring websites; and
• other technical usage information.

6.4 Additional Personal Data

In exceptional circumstances, We may ask You to provide additional Personal Data. Whenever this occurs, We will notify You in advance and, where required by applicable law, obtain Your separate consent.

6.5 Personal Data of Third Parties

If You provide Us with Personal Data relating to third parties, You represent and warrant that:

• You have obtained all necessary consents from those individuals, including consent for the transfer of their Personal Data;
• You have obtained any other documents required under applicable law;
• such consents and documents comply with the laws applicable to those individuals; and
• where You act as a data controller with respect to such Personal Data, You maintain data protection and security measures that provide a level of protection no less stringent than those established by this Policy.

Such third-party consent must be obtained in writing.

Upon Our request, You shall provide the original written consent within seven (7) calendar days from the date of Our request.

7. Rights of the Data Subject

7.1 Right to Information

You have the right to obtain information about:

• Our identity and contact details;
• Our location;
• whether We Process Your Personal Data; and
• access to such Personal Data.

7.2 Right to Rectification, Restriction, and Erasure

You have the right to request that We correct, update, restrict, block, or erase Your Personal Data where such data is incomplete, inaccurate, outdated, unlawfully obtained, unlawfully processed, or no longer necessary for the purposes for which it was collected.

You are also entitled to exercise any other rights provided by applicable law.

7.3 Form of Disclosure

Information regarding the Processing of Your Personal Data shall be provided in an intelligible and accessible form.

Any information disclosed to You will not include Personal Data relating to other Data Subjects unless otherwise permitted or required by law.

7.4 Access Procedure

You, or Your duly authorized legal representative, may request access to Your Personal Data by submitting a written request or an electronic request where permitted by applicable law.

Your request should include identification document details, the date of issue, the issuing authority, and Your signature (or an equivalent electronic authentication where legally recognized).

We will respond to Your request within thirty (30) days of receipt. Where permitted by applicable law, this period may be extended by up to an additional thirty (30) days, for a maximum response period of sixty (60) days.

7.5 Information Available Upon Request

Upon request, You may obtain information regarding the Processing of Your Personal Data, including confirmation of processing, purposes, methods and legal basis, the identity and location of the Operator, recipients, retention period, legal consequences, and any other information required under applicable data protection legislation.

7.6 Right to Withdraw Consent

You have the right, at any time, to withdraw Your consent to the Processing of Personal Data, restrict the methods or scope of Processing, object to certain Processing activities where permitted by law, and prohibit the disclosure or dissemination of Your Personal Data without Your prior consent.

7.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection authority or any other supervisory authority having jurisdiction, or to seek judicial protection of Your rights in accordance with applicable law.

7.8 Right to Judicial Protection

You have the right to protect Your lawful rights and interests through judicial proceedings, including the right to claim compensation for damages and, where provided by applicable law, compensation for non-material (moral) harm.

8. Rights of the Data Subject under the GDPR

If You are a citizen or resident of a Member State of the European Economic Area (EEA) or the United Kingdom, or You lawfully provide Us with the Personal Data of such an individual, You are also entitled to the rights set out below. You may exercise these rights by contacting Us using the contact details provided in this Policy.

8.1 Right to Be Informed (Articles 12–14 GDPR)

You have the right to receive clear and transparent information regarding the collection and use of Your Personal Data, including the purposes, categories, retention period, and recipients.

8.2 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether We Process Personal Data concerning You and, where that is the case, access to that Personal Data together with the information specified in Article 15 GDPR.

Upon request, We shall provide one copy of the Personal Data undergoing Processing free of charge. We may charge a reasonable administrative fee for any additional copies requested.

8.3 Right to Rectification (Article 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate or incomplete Personal Data concerning You.

Requests for rectification may be submitted orally or in writing. We will respond within one (1) calendar month, unless an extension is permitted under the GDPR.

8.4 Right to Erasure (“Right to be Forgotten”) (Article 17 GDPR)

You have the right to request the erasure of Your Personal Data under the circumstances specified in Article 17 of the GDPR. We will respond within one (1) month of receipt of Your request.

Please note that this right is not absolute and applies only where the conditions set out in Article 17 GDPR are satisfied.

8.5 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request the restriction of the Processing of Your Personal Data under the circumstances provided by Article 18 GDPR. Where Processing has been restricted, Personal Data may, with the exception of storage, only be processed with Your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

8.6 Right to Data Portability (Article 20 GDPR)

You have the right to receive the Personal Data concerning You in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance. Where technically feasible, You also have the right to request that Personal Data be transmitted directly from one controller to another.

8.7 Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to Your particular situation, to the Processing of Your Personal Data.

Where Personal Data is processed for direct marketing purposes, You have the absolute right to object at any time to such Processing, including profiling to the extent that it relates to direct marketing.

8.8 Rights Relating to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated Processing, including profiling, where such decision produces legal effects concerning You or similarly significantly affects You. This right applies only in the circumstances provided by Article 22 GDPR.

9. Transfer of Personal Data

9.1 Transfer of Personal Data

To achieve the purposes described in this Policy, We may disclose or transfer Your Personal Data to Our service providers, business partners, contractors, and other third parties acting on Our behalf.

This includes, without limitation, JSC “amoCRM” (Tax Identification Number (TIN): 7709477879, Primary State Registration Number (OGRN): 5157746087681) as a customer relationship management (CRM) service provider.

We may also disclose Your Personal Data to governmental authorities, regulatory bodies, courts, law enforcement agencies, or other public authorities where such disclosure is required by law or pursuant to a lawful request.

9.2 Mandatory and Optional Data Transfers

Certain categories of information may be transferred as a mandatory technical requirement for the operation of the Website, including IP address, operating system, geographical location data, device identifier and type, browser or application information, payment authorization information, and authentication and identity verification data.

Other categories may be transferred on an optional basis, including address matching indicators, account information, user preferences, and other optional account-related information.

10. Storage of Personal Data

10.1 Data Localization

Where required by applicable data protection laws, We store and Process Personal Data within the jurisdiction prescribed by such laws.

If You are a citizen of the Russian Federation, Your Personal Data is stored on servers located within the territory of the Russian Federation in accordance with applicable Russian data localization requirements.

If You are a citizen or resident of a Member State of the European Economic Area (EEA), the United Kingdom, or any other country whose laws require Personal Data to be stored and processed within its territory, Your Personal Data will be collected, stored, and processed within the EEA, the United Kingdom, or such jurisdiction, as applicable, unless another lawful basis for international data transfers exists under applicable law.

11. Principles and Measures for the Protection of Personal Data

11.1 Security Principles

We implement appropriate legal, organizational, administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and security of Your Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage.

11.2 Security Measures

Our security measures are designed and implemented to comply with applicable data protection legislation and recognized information security standards. Without limitation, We protect Personal Data by implementing the following measures:

• restricting access to Personal Data solely to authorized personnel whose duties require such access;
• appointing a person responsible for organizing and supervising Personal Data Processing;
• developing and implementing internal policies and procedures governing the Processing of Personal Data;
• identifying and assessing security risks relating to information systems used for Processing Personal Data;
• implementing appropriate organizational and technical safeguards to protect Personal Data;
• using certified or otherwise legally compliant information security technologies where required by applicable law;
• maintaining records of electronic storage media containing Personal Data;
• establishing and enforcing access control procedures for Personal Data;
• restricting physical access to facilities, servers, and equipment used for Processing or storing Personal Data;
• detecting unauthorized access or attempted unauthorized access to Personal Data and taking corrective and preventive measures;
• classifying non-public Personal Data as confidential information subject to enhanced protection;
• requiring employees involved in the Processing of Personal Data to execute confidentiality and non-disclosure obligations;
• restoring Personal Data where it has been modified or destroyed due to unauthorized access;
• providing regular training to employees involved in Personal Data Processing; and
• continuously monitoring the effectiveness of the technical and organizational measures implemented to protect Personal Data.

12. Cookies

12.1 Use of Cookies

The Website uses Cookies and similar technologies.

When You visit the Website, Your web browser automatically transmits certain technical information to Our servers, including the date and time of access, browser type and version, preferred language settings, operating system, and other technical connection information.

This information is recorded in server log files for a limited period of time (from the duration of a browsing session up to one (1) year) for the purposes of maintaining Website security, ensuring proper operation, diagnosing technical issues, and generating statistical information.

12.2 Categories and Functions of Cookies

The Website uses several categories of Cookies.

Essential and Functional Cookies. These Cookies are necessary for the proper functioning of the Website and enable the server to recognize information relating to Your browsing session, preferred language, browser type, authentication status, and other technical settings. They also enable the Website to recognize You when You return, remember Your preferences, and personalize Website content according to Your settings.

Analytics Cookies. Analytics Cookies allow Us to measure and analyze Website traffic, count visitors, understand how users navigate the Website, evaluate Website performance, and improve the usability and functionality of the Website.

You may refuse the use of Analytics Cookies at any time by changing the settings in Your web browser or through any Cookie preference tool provided on the Website.

12.3 Cookie Retention Period

Depending on their duration, Cookies are classified as follows:

• Session Cookies are temporary Cookies stored on Your device only until You close Your web browser.
• Persistent Cookies remain stored on Your device until their expiration date or until You manually delete them.

12.4 Managing and Disabling Cookies

You may accept, reject, or delete Cookies at any time by adjusting the settings in Your web browser.

The method for managing Cookies varies depending on the browser You use. Disabling certain Cookies may affect the availability or functionality of some features of the Website.

For further information about managing Cookies, please refer to Your browser's documentation or visit:

www.aboutcookies.org  ·  www.allaboutcookies.org

If You access the Website from multiple devices (such as a smartphone, tablet, or computer), You should ensure that each browser on each device is configured according to Your Cookie preferences.

13. Contact Details for Legally Significant Communications

13.1 Official Contact Details

For the purposes of performing obligations arising under this Policy and any related legal relationship, the Parties may exchange legally significant notices and communications in written form or by electronic means, both of which shall have equal legal effect where permitted by applicable law.

Our official contact details are set out in the Official Notice at the end of this Policy.

Your official contact details shall be those provided by You when submitting a callback request, contacting Us through a messenger application, or communicating with Us through any other available communication channel.

You are solely responsible for ensuring that Your contact information remains accurate and up to date. We shall not be liable for any consequences resulting from Your failure to update such contact information.

13.2 Correspondence

Official correspondence between the Parties shall be exchanged exclusively using the contact details determined in accordance with this Policy.

Final Provisions

Severability

If any provision of this Policy is held to be invalid, illegal, unenforceable, or otherwise ineffective by a court or other competent authority, such provision shall be deemed replaced by a valid and enforceable provision that most closely reflects the original intent and economic purpose of the invalid provision.

The invalidity or unenforceability of any individual provision shall not affect the validity or enforceability of the remaining provisions of this Policy, which shall remain in full force and effect.

Under no circumstances shall this Policy be deemed invalid in its entirety solely because one or more of its provisions are found to be invalid or unenforceable.

A Project of EXPERTAGENT LLC