Introduction and Preamble

​​

Caribbean Paradise Investments ("Company," "we," "us," or "our") is a real estate and investment services company operating the website caribbeanparadiseinvestments.com (the "Site") and providing related services to clients, prospective investors, and visitors throughout the Caribbean region and beyond. We are committed to protecting the privacy, confidentiality, and security of all personal information entrusted to us.

This Privacy Policy ("Policy") explains who we are, what personal information we collect, why we collect it, how we use and protect it, with whom we share it, how long we retain it, and what rights you have in relation to your personal data. We have prepared this Policy in plain language so that it is accessible and understandable to all readers, while remaining legally sound and compliant with applicable law.

​

This Policy applies to:

• All visitors to our website, regardless of location;

• Prospective investors and individuals who submit inquiries through our Site;

• Existing and former clients of Caribbean Paradise Investments;

• Any individual whose personal data we process in connection with our services.

 

By accessing or using our Site or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms set out in this Policy, please discontinue your use of our Site and services.

​

This Policy was last updated and is effective as of June 28, 2026. We will notify you of material changes as described in Section 11.

 

1. Information We Collect

We collect personal information in several ways — directly from you, automatically through your use of our Site, and from third parties. The following sub-sections describe each category in detail.

1.1 Information You Provide Directly

When you interact with us voluntarily — whether by filling out a form, registering an account, or communicating with our team — you may provide us with the following types of personal information:

• Contact Form Submissions: Your full name, email address, telephone number, and mailing address when you submit an inquiry or contact form on our Site.

• Account Registration Information: Username, password, and profile details if you create a registered account on our platform.

• Investment Inquiry Details: Information about your investment interests, preferred property types, budget ranges, preferred locations, and investment goals.

• Financial and Identification Documents: Where voluntarily submitted for the purpose of advancing a transaction or client relationship, documents may include proof of income, asset statements, investment portfolios, and copies of government-issued identification (see also Section 1.4 regarding Sensitive Information).

• Communications with Our Team: Records of emails, live chat transcripts, and notes from telephone conversations, which we may retain for quality assurance, compliance, and client relationship management purposes.

1.2 Information Collected Automatically

When you visit our Site, certain technical and behavioral information is collected automatically through cookies, log files, and similar technologies (see Section 3 for details on our cookie practices):

• Device and Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and language settings.

• Browsing and Interaction Data: Pages visited, time spent on each page, links clicked, referring URLs (the website you came from), and exit pages.

• Session and Clickstream Data: The sequence of pages you view during a session, scroll depth, and interactions with page elements. We may use session recording technology to understand how users navigate our Site.

• Geolocation Data: Country- and region-level geolocation inferred from your IP address. We do not collect precise GPS-level location data unless you specifically authorize it.

1.3 Information from Third Parties

We may receive personal information about you from third-party sources, which we combine with information we have collected directly:

• Real Estate Listing Partners: Property listing platforms and partner agencies may share contact or inquiry information with us when you express interest in a listed property.

• Identity Verification Services: Third-party Know Your Customer ("KYC") and Anti-Money Laundering ("AML") compliance service providers may share identity verification results or flag information with us as required by law.

• Marketing and Advertising Platforms: Advertising networks may share aggregated audience data or conversion information related to campaigns we run on those platforms.

• Social Media Integrations: If you choose to connect your social media account (e.g., Facebook, LinkedIn) to our Site or use social login features, we may receive profile information that you have authorized the social platform to share, subject to your privacy settings on that platform.

1.4 Sensitive Information

Certain categories of personal data require heightened protection under both Dominican Republic Law No. 172-13 (which identifies special categories of "sensitive data" in Article 4) and applicable U.S. law. We may process the following sensitive data categories in connection with our services:

• Financial Information: Income details, asset valuations, investment amounts, bank account information, and creditworthiness assessments submitted in connection with investment transactions.

• Government-Issued Identification: Passport numbers, national identification numbers, and other government-issued ID information collected solely for the purpose of satisfying KYC and AML legal obligations.

We collect and process sensitive information only to the extent required by law or necessary to deliver our services. We implement additional technical and organizational safeguards for sensitive data as described in Section 5. We never use sensitive information for marketing or profiling purposes without your explicit, separate consent.

​

2. How We Use Your Information

We use the personal information we collect for the following clearly defined purposes. We process your data only where we have a lawful basis to do so — including your consent, the performance of a contract, compliance with a legal obligation, or our legitimate business interests, in each case as required under Law No. 172-13 and applicable U.S. law.

2.1 Service Delivery

The primary purpose for which we collect your personal information is to provide our real estate and investment services:

• Receiving, reviewing, and responding to property and investment inquiries;

• Opening and managing client accounts and ongoing client relationships;

• Facilitating real estate transactions, including property viewings, negotiations, and documentation;

• Providing personalized property recommendations based on your stated preferences and investment goals;

• Administering client agreements and post-transaction support.

2.2 Legal and Regulatory Compliance

We are subject to legal obligations in both the Dominican Republic and the United States that require us to collect and retain certain personal information:

• Performing KYC and AML due diligence as required by Dominican Republic Law No. 155-17 on Money Laundering and Terrorist Financing and applicable U.S. Treasury and FinCEN regulations;

• Responding to lawful requests from government authorities, courts, or regulators in either jurisdiction;

• Enforcing our Terms of Service and other agreements;

• Retaining records as required by tax and corporate law in the Dominican Republic and, where applicable, the United States.

2.3 Communications

We use your contact information to communicate with you in the following ways:

• Responding to your inquiries, requests, and support messages;

• Sending transactional communications related to your account or a specific transaction (no consent required for these);

• Sending property alerts, market updates, and investment opportunity announcements — with your consent, which you may withdraw at any time;

• Distributing newsletters and promotional content — only with your prior, express consent, as required by Law No. 172-13 and the CAN-SPAM Act.

2.4 Analytics and Product Improvement

We analyze how users interact with our Site in order to improve its content, structure, and functionality:

• Understanding which property listings and content attract the most engagement;

• Identifying and fixing technical issues or user experience problems;

• Developing new features and services based on aggregate user behavior;

• Conducting internal reporting and business intelligence.

2.5 Marketing and Advertising

We may use your personal information for marketing purposes only in accordance with your expressed preferences:

• Displaying targeted advertising on third-party platforms (e.g., social media, search engines) using anonymized or hashed identifiers — only where permitted and with appropriate consent;

• Conducting retargeting campaigns to show relevant property listings to previous Site visitors;

• Measuring the effectiveness of our marketing campaigns.

You may opt out of marketing communications at any time by clicking "Unsubscribe" in any marketing email, updating your account communication preferences, or contacting us using the details in Section 10. Opting out of marketing does not affect transactional communications required to service your account.

2.6 Security and Fraud Prevention

We process certain personal data to protect the integrity of our platform, our clients, and our business:

• Detecting and investigating fraudulent activity, unauthorized access, or suspicious behavior;

• Enforcing our Terms of Service and other applicable policies;

• Protecting the rights, property, and safety of Caribbean Paradise Investments, our clients, and the public;

• Conducting security audits and penetration testing of our systems.

3. Cookies and Tracking Technologies

This section explains how we use cookies and similar technologies on our Site and how you can control them.

3.1 What Are Cookies?

Cookies are small text files that are placed on your device (computer, smartphone, or tablet) when you visit a website. They allow the website to recognize your device on future visits, remember your preferences, and provide a more personalized experience. Cookies do not contain executable code and cannot access other files on your device. Similar technologies include web beacons, pixel tags, local storage, and session storage.

3.2 Types of Cookies We Use

We use the following categories of cookies on our Site:

• Essential / Strictly Necessary Cookies: These cookies are required for the Site to function. They enable core features such as user authentication, session management, security token validation, and the operation of our cookie consent mechanism. Without these cookies, the Site cannot be used. These cookies are set on the basis of our legitimate interest in providing a functional, secure website — no consent is required.

• Functional Cookies: These cookies remember choices you make, such as your preferred language, region, or currency display settings, to provide a more personalized experience. They are not strictly necessary but improve Site usability. These cookies require your consent.

• Analytics Cookies: These cookies collect information about how visitors use our Site — including which pages are most visited, time spent, and error messages encountered — to help us improve performance. We use Google Analytics (a service provided by Google LLC) and similar tools. The data collected is aggregated and does not directly identify individual users. These cookies require your consent.

• Marketing / Advertising Cookies: These cookies are used to deliver advertisements relevant to your interests, to limit the number of times you see an advertisement, and to measure the effectiveness of advertising campaigns. They may be placed by us or by our advertising partners. These cookies require your prior, express consent.

3.3 Third-Party Tracking Technologies

In addition to cookies, our Site may use the following third-party tracking technologies:

• Pixel Tags / Web Beacons: Small transparent image files embedded in web pages or emails that allow us and third parties to track whether a page or email has been opened and to log certain interactions.

• Conversion Tracking Scripts: JavaScript-based scripts embedded in our Site pages that report to advertising platforms (such as Google Ads or Meta Ads) when a user completes a specified action (e.g., submitting an inquiry form).

• Retargeting Scripts: Scripts that allow advertising networks to display our ads to users who have previously visited our Site while browsing other websites.

We exercise reasonable oversight over third-party tracking technologies deployed on our Site; however, we are not responsible for the independent data collection practices of third-party platforms. Please review the privacy policies of those platforms directly.

3.4 Cookie Consent

In compliance with Law No. 172-13 and applicable U.S. state law requirements regarding consent for non-essential data collection, we display a cookie consent banner when you first visit our Site. You may accept all cookies, reject non-essential cookies, or manage your preferences by category through our Cookie Preference Center accessible via the banner or a persistent link in our Site footer.

You may also manage or delete cookies at any time through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the Site. For guidance on managing cookies in common browsers, visit the browser's help documentation directly.

3.5 Do Not Track Signals

Some web browsers offer a "Do Not Track" ("DNT") setting that signals to websites that the user does not wish to be tracked across websites. We honor DNT browser signals to the extent technically feasible. When a valid DNT signal is detected from your browser, we will not deploy marketing or retargeting cookies or scripts during your session. Because there is no universal technical standard for DNT signals, our ability to honor them comprehensively depends on the implementation of the signal in your browser.

4. Third-Party Services and Sharing

We do not sell your personal information. We may share personal information with carefully selected third parties only for the purposes described in this Policy and subject to appropriate legal safeguards.

4.1 Service Providers (Data Processors)

We engage trusted third-party companies to perform functions on our behalf. These service providers act as "data processors" under Law No. 172-13 — they process your data only on our instructions and may not use it for their own purposes. Current categories of service providers include:

• Cloud Hosting and Infrastructure: Providers of cloud computing, data storage, and server infrastructure who host our website and databases in secure, compliant environments;

• Payment Processors: Licensed payment processing services that handle financial transactions on our behalf and are subject to PCI-DSS compliance requirements;

• Email Marketing Platforms: Services used to manage and deliver email communications to subscribers and clients;

• Analytics Providers: Including Google Analytics and similar platforms used to analyze Site traffic and user behavior;

• Legal and Compliance Services: Law firms, KYC/AML service providers, and regulatory compliance consultants engaged to fulfill our legal obligations.

All service providers are bound by written data processing agreements that require them to maintain confidentiality, implement appropriate security measures, and process personal data only in accordance with our instructions and applicable law.

4.2 Business Partners

We work with referral partners, property developers, and co-listing agencies in the Caribbean region. We may share limited personal information (such as name and contact details) with relevant business partners when you have expressed interest in a property or service they are associated with. All such sharing is governed by written data-sharing or referral agreements that restrict the use of your data to the specific purpose for which it was shared.

4.3 Legal Disclosures

We may disclose personal information to law enforcement authorities, courts, regulatory bodies, or other government agencies when required to do so by law, or when we reasonably believe that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or lawful government request in the Dominican Republic, the United States, or another applicable jurisdiction;

• Enforce our legal rights or defend against legal claims;

• Protect the safety of any person or prevent fraud or financial crime;

• Comply with AML/KYC reporting obligations under Dominican Republic Law No. 155-17 or applicable U.S. federal law.

Where legally permitted, we will notify you of such requests before disclosing your information.

4.4 Business Transfers

In the event of a merger, acquisition, corporate restructuring, sale of assets, or transfer of all or a portion of our business, your personal information may be disclosed to prospective or actual acquirers and their advisors as part of due diligence, and subsequently transferred as part of the transaction. In such an event, we will take reasonable steps to notify registered users via email and a prominent notice on our Site before your personal information is transferred and becomes subject to a different privacy policy. You will be given reasonable notice and, where required by law, the opportunity to opt out.

4.5 What We Never Do

We wish to be unambiguous about data practices we do not engage in:

• We do not sell personal data to data brokers or any other third party for monetary or other valuable consideration.

• We do not share personal data for purposes incompatible with the original purpose for which it was collected, without your separate, explicit consent.

• We do not rent or lease our mailing lists or client databases to any third party.

• We do not use your personal data to make fully automated legal or similarly significant decisions about you without human review.

5. Data Protection and Security

We take the security of your personal information seriously and implement a comprehensive set of technical and organizational measures to protect it against unauthorized access, disclosure, alteration, and destruction.

5.1 Technical Security Measures

• Encryption in Transit: All data transmitted between your browser and our servers is protected using Transport Layer Security (TLS 1.2 or higher), enforced via HTTPS across all pages of our Site;

• Encryption at Rest: Sensitive data stored in our databases — including financial information and identification documents — is encrypted using industry-standard algorithms (AES-256 or equivalent);

• Access Controls: Access to personal data is restricted to authorized personnel only, using role-based access control (RBAC) principles to ensure each team member can access only the data necessary for their role;

• Two-Factor Authentication (2FA): All internal systems and administrative interfaces that access personal data require two-factor authentication for all staff;

• Regular Security Audits and Penetration Testing: We conduct periodic security audits and commission independent penetration testing to identify and remediate vulnerabilities;

• Secure Software Development: Our development team follows secure coding practices and conducts code reviews with security in mind.

5.2 Organizational Security Measures

• Staff Training: All employees and contractors who handle personal data receive mandatory privacy and data security training at onboarding and annually thereafter;

• Data Minimization: We collect only the personal data that is adequate, relevant, and limited to what is necessary for the specified purpose, consistent with Article 6 of Law No. 172-13;

• Need-to-Know Access: Access to personal data is granted on a strict need-to-know basis and is regularly reviewed and revoked when no longer required;

• Confidentiality Agreements: All employees, contractors, and service providers with access to personal data are bound by written confidentiality obligations;

• Internal Privacy Policies: We maintain internal data governance policies, a data inventory, and a record of processing activities consistent with best practices under applicable law.

5.3 Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our general retention schedule is as follows:

Data CategoryRetention PeriodLegal Basis for Retention

Active client records (contracts, transactions, KYC/AML files)7 years from the end of the client relationshipDominican Republic tax, corporate, and AML law; U.S. federal recordkeeping requirements

Prospect and inquiry data (non-converted leads)2 years from last contact, unless converted to clientLegitimate interest in managing business pipeline

Marketing opt-in / consent recordsDuration of consent + 3 years after withdrawalObligation to demonstrate lawful processing basis

Cookie and analytics dataAs per third-party provider settings (typically 13–26 months)Operational analytics and Site improvement

Security and access logs12 months from creationSecurity incident detection and response

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be linked to an individual. You may request deletion of your data before the end of the retention period (see Section 7 and Section 8), subject to any legal obligations that require us to retain the data.

5.4 Data Breach Response

In the event of a personal data breach, we have established and maintain a formal Incident Response Plan. Our response procedures include:

• Detection and Containment: Immediate steps to identify the scope and contain the breach upon discovery;

• Assessment: Evaluation of the likely risk to affected individuals' rights and freedoms;

• Notification — Affected Individuals: Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected individuals without undue delay and, where technically feasible, within 72 hours of becoming aware of the breach, in accordance with applicable law;

• Regulatory Notification: We will notify the competent supervisory authority in each applicable jurisdiction within the legally prescribed timeframe;

• Remediation: Implementation of corrective measures to prevent recurrence and improvement of security posture.

6. International Data Transfers

As a company operating across the Caribbean and serving clients internationally, personal data may be transferred across national borders. This section explains how we safeguard your data during international transfers.

6.1 Cross-Border Data Transfers

Personal information collected through our Site or in the course of our services may be transferred between the Dominican Republic and the United States, and may also be processed by cloud service providers and software-as-a-service platforms with infrastructure located in other countries, including within the European Economic Area, Canada, and other jurisdictions. We take steps to ensure that your data is protected whenever it is transferred across borders.

6.2 Safeguards for International Transfers

We rely on the following mechanisms to ensure adequate protection for personal data transferred internationally:

• Data Processing Agreements (DPAs): All transfers to third-party service providers are governed by written DPAs that incorporate appropriate data protection obligations on the recipient;

• Standard Contractual Clauses: Where applicable and recognized by the relevant jurisdiction, we use standard contractual clauses or equivalent contractual mechanisms approved by competent authorities;

• Adequacy of Destination Jurisdiction: Where possible, we transfer data only to countries or service providers recognized as providing an adequate level of data protection, or where we have implemented appropriate supplementary safeguards;

• Dominican Republic — International Transfers: Transfers of personal data outside the Dominican Republic comply with the requirements of Law No. 172-13, Chapter III, which conditions international transfers on the existence of an adequate level of protection in the destination country or the adoption of appropriate safeguards by the recipient;

• U.S.-Originating Data: For personal data originating from U.S. residents, we comply with applicable U.S. state law transfer requirements, including those under the CCPA/CPRA for California residents.

6.3 Caribbean and Regional Context

We are aware of ongoing developments in data protection law across the Caribbean Community (CARICOM) and the broader Caribbean region. Several CARICOM member states have enacted or are developing data protection legislation. Where our operations intersect with the requirements of such regional frameworks, we will apply protections consistent with the applicable legal standard. We will update this Policy as relevant regional legal requirements develop and mature.

7. Your Rights Under Dominican Republic Law (Ley 172-13)

Rights for Dominican Republic Residents and Data Subjects

If you are a resident of the Dominican Republic or if your personal data is processed in the Dominican Republic, you have the following rights under Law No. 172-13 on the Protection of Personal Data (Ley sobre Protección de Datos de Carácter Personal), enacted December 13, 2013. These rights are sometimes collectively referred to as the "ARCO" rights (Acceso, Rectificación, Cancelación, Oposición) and have been expanded in practice to include additional protections described below.

7.1 Right of Access (Derecho de Acceso)

You have the right to request and obtain confirmation of whether we hold personal data concerning you, and — if so — to obtain a copy of that data along with information about its origin, the purposes for which it is processed, and the categories of recipients with whom it has been shared. We will provide this information free of charge, in a clear and intelligible format, within 30 days of receiving a valid request (Article 16, Law No. 172-13).

7.2 Right of Rectification (Derecho de Rectificación)

You have the right to request the correction of personal data that is inaccurate, outdated, incomplete, or misleading. Upon receiving a rectification request accompanied by supporting documentation, we will correct the relevant data and, where applicable, notify any third parties to whom the data has been disclosed (Article 17, Law No. 172-13).

7.3 Right of Cancellation / Deletion (Derecho de Cancelación)

You have the right to request the deletion or suppression of your personal data when: (a) the data is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other lawful basis for processing; (c) the data has been unlawfully processed; or (d) deletion is required to comply with a legal obligation (Article 18, Law No. 172-13). Deletion requests are subject to our legal retention obligations set out in Section 5.3.

7.4 Right to Block Processing

You have the right to request that we temporarily suspend or "block" the processing of your personal data while a rectification request is pending, or where the lawfulness of processing is contested. During the period of blocking, your data will be retained but not actively processed for any purpose other than storage (Article 18, Law No. 172-13).

7.5 Right to Object (Derecho de Oposición)

You have the right to object to the processing of your personal data on grounds relating to your particular situation, where processing is based on our legitimate interests. You also have the unconditional right to object to the use of your personal data for direct marketing purposes at any time, without giving reasons. Upon receiving a valid objection to marketing, we will cease processing your data for that purpose immediately (Article 20, Law No. 172-13).

7.6 Right to Data Portability

You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to transmit that data to another controller where technically feasible. This right applies where processing is based on your consent or on a contract, and is carried out by automated means.

7.7 How to Exercise These Rights

To exercise any of the rights described in this Section 7, please submit a written request to us using the contact details provided in Section 10. Your request should include:

• Your full name and contact information;

• A copy or description of a valid identity document for verification purposes;

• A clear description of the right you wish to exercise and the specific data to which your request relates.

We will acknowledge your request within 5 business days and will respond substantively within 30 calendar days. In complex cases, we may extend this period by an additional 30 days, provided we notify you of the extension and its reasons before the initial deadline expires.

7.8 Consent and Withdrawal

Under Law No. 172-13, where we rely on consent as the legal basis for processing, that consent must be prior, express, and written (or electronic, where legally equivalent). You may withdraw your consent to any processing activity at any time, without affecting the lawfulness of processing carried out before your withdrawal. Withdrawal of consent does not impose retroactive effect on prior processing. To withdraw consent, contact us using the details in Section 10 or use the opt-out mechanisms provided in communications or on our Site.

7.9 Enforcement and Supervisory Authority

For matters relating specifically to credit-related personal data, oversight is exercised by the Superintendencia de Bancos de la República Dominicana (Superintendency of Banks of the Dominican Republic) pursuant to its mandate under Law No. 183-02. For general personal data protection complaints, you may seek redress through the applicable civil courts of the Dominican Republic. We encourage you to contact us first so that we may resolve your concern directly before escalating to a supervisory authority.

8. Your Rights Under United States Law

Rights for United States Residents

If you are a resident of the United States, a number of federal and state privacy laws provide you with specific rights regarding your personal information. This section summarizes your rights under applicable U.S. law.

8.1 Federal Privacy Framework

At the federal level, the following statutes govern certain aspects of our data practices:

• Federal Trade Commission Act (15 U.S.C. § 45): The FTC has authority to take action against unfair or deceptive privacy practices. We commit to fair and transparent data practices consistent with FTC guidance;

• Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506): We do not knowingly collect personal information from children under the age of 13. See Section 8.5 for our full Children's Privacy statement;

• CAN-SPAM Act (15 U.S.C. §§ 7701–7713): All commercial email communications we send comply with CAN-SPAM requirements, including the inclusion of a physical mailing address and a clear, functional opt-out mechanism;

• Fair Credit Reporting Act (FCRA, 15 U.S.C. §§ 1681 et seq.): To the extent we obtain or use consumer report information in connection with our investment services, we comply with applicable FCRA obligations.

8.2 California Residents (CCPA / CPRA)

California residents have specific rights under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100–1798.199.100). These rights are as follows:

• Right to Know: You have the right to request disclosure of (a) the categories of personal information we have collected about you in the preceding 12 months, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we have shared your information; and (b) the specific pieces of personal information we hold about you;

• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (including compliance with legal obligations and completion of pending transactions);

• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you;

• Right to Opt-Out of Sale or Sharing: We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising. Accordingly, no formal opt-out of sale is required; however, we will honor any such request submitted to us;

• Right to Limit Use of Sensitive Personal Information: You may direct us to limit our use of sensitive personal information (as defined under the CPRA, including government ID numbers and financial account information) to uses necessary to provide the services you requested;

• Right to Non-Discrimination: Exercising any of your CCPA/CPRA rights will not result in discriminatory treatment. We will not deny goods or services, charge different prices, or provide a different level of quality on the basis of your exercise of privacy rights;

• How to Submit a Verifiable Consumer Request: Submit your request by email to [email protected] with the subject line "Privacy Request – California" or through the web form available on our Site. We may need to verify your identity before processing the request;

• Response Timeline: We will respond to verifiable consumer requests within 45 calendar days. If we require additional time, we will notify you within the initial 45-day period and may extend our response by an additional 45 days (90 days total), with written notice of the reason for the extension;

• Authorized Agent: You may designate an authorized agent to submit a request on your behalf. We will require written proof of authorization and may contact you directly to verify the request.

8.3 Other U.S. State Privacy Rights

Residents of states that have enacted comprehensive consumer privacy laws have similar rights to know, access, correct, delete, and opt out of certain processing activities. These states currently include, without limitation:

• Virginia — Consumer Data Protection Act (Va. Code Ann. §§ 59.1-575 to 59.1-585);

• Colorado — Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313);

• Texas — Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §§ 541.001–541.204);

• Florida — Florida Digital Bill of Rights (Fla. Stat. §§ 501.701–501.721);

• Other states as additional comprehensive state privacy laws come into effect.

If you are a resident of any of these states and wish to exercise your applicable privacy rights, please submit your request using the contact information in Section 10. We will process your request in accordance with the law applicable to your state of residence.

8.4 Do Not Track

Some browsers include a "Do Not Track" feature that signals to websites that a user does not wish to be tracked. As described in Section 3.5, we honor DNT browser-level signals to the extent technically feasible. We will refrain from deploying non-essential tracking technologies during sessions in which a valid DNT signal is received.

8.5 Children's Privacy (COPPA Compliance)

Our Site and services are intended for adults and are not directed to children under the age of 13. We do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and implementing regulations (16 C.F.R. Part 312). If we discover that we have inadvertently collected personal information from a child under 13, we will delete that information promptly. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected] and we will take steps to delete the information from our systems.

9. Links to Third-Party Websites

Our Site may contain hyperlinks to third-party websites, including property listing platforms operated by partner developers, social media platforms, government portals, and other external resources. These links are provided for your convenience and informational purposes only.

Caribbean Paradise Investments does not operate, control, or endorse the content, privacy practices, or security measures of any third-party website. We are not responsible for the privacy policies or data handling practices of external sites. When you click on a link and leave our Site, this Privacy Policy ceases to apply and you will be subject to the privacy policy of the destination website.

We encourage you to review the privacy policy and terms of service of any third-party website before providing personal information on that site or engaging with its services. The presence of a link on our Site does not constitute endorsement of, or responsibility for, the practices of the linked website.

10. Contact Information

If you have questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us using the details below.

10.1 Data Controller / Privacy Officer

Caribbean Paradise Investments

Email: info@caribbeanparadiseinvestments.com

Subject Line: Attn: Privacy Officer / Data Protection Officer

10.2 How to Submit a Privacy Request

To exercise any of the rights described in this Policy, or to raise a privacy-related concern, please contact us by email at info@caribbeanparadise.com using the following subject line format to ensure prompt routing:

• Subject Line: Privacy Request – [Type of Request]

• Examples: "Privacy Request – Access," "Privacy Request – Deletion," "Privacy Request – Correction," "Privacy Request – Opt-Out"

Your request should include your full name, a description of your request, and sufficient information to allow us to verify your identity. Response timelines are:

• Dominican Republic requests (Law No. 172-13): We will respond within 30 calendar days;

• U.S. requests (CCPA/CPRA and other state laws): We will respond within 45 calendar days (extendable by an additional 45 days with notice).

We may request additional information to verify your identity before processing any request. We will not process requests without reasonable identity verification to protect against unauthorized access to personal data.

10.3 Supervisory Authorities

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the applicable supervisory authority:

• Dominican Republic (Credit-Related Data):
  Superintendencia de Bancos de la República Dominicana
  Av. México No. 52, Gazcue, Santo Domingo, D.N., República Dominicana
  Website: sb.gob.do

• Dominican Republic (General Privacy): General civil court jurisdiction and the competent regulatory authority as designated under Law No. 172-13 and related implementing regulations.

• United States — California Residents:
  California Privacy Protection Agency (CPPA)
  Website: cppa.ca.gov
  You may also contact the California Attorney General's Office.

• United States — Other States: The applicable state Attorney General's office for your state of residence.

11. Changes to This Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or the evolution of our services. When we make changes, we will update the "Last Updated" date at the top of this document.

For material changes — those that significantly affect your rights or the ways in which we use your personal information — we will provide advance notice as follows:

• Registered Users: We will send a notification to the email address associated with your account at least 14 days before the revised Policy takes effect;

• All Website Visitors: We will display a prominent notice on our homepage and/or Site-wide banner for a period of no less than 14 days prior to and following the effective date of the change.

Your continued use of our Site or services after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should discontinue using the Site and contact us to request deletion of your personal data where appropriate.

Prior versions of this Privacy Policy are available upon written request to our Privacy Officer at the contact address in Section 10. We will provide prior versions within a reasonable time at no charge.

12. Governing Law and Jurisdiction

This Privacy Policy and all matters relating to our processing of personal data are governed by and construed in accordance with the laws of the Dominican Republic as the primary jurisdiction in which Caribbean Paradise Investments is constituted and principally operates, including without limitation Law No. 172-13 on the Protection of Personal Data, Law No. 183-02 on Monetary and Financial Matters, and Law No. 155-17 on Anti-Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction.

To the extent that applicable U.S. federal or state law applies to persons accessing our Site or services from within the United States — including but not limited to residents of California governed by the CCPA/CPRA — those laws apply concurrently with and in addition to Dominican Republic law with respect to the specific rights conferred on those residents. Where there is a conflict between the two jurisdictions' requirements, we will apply the provision affording the greater protection to the individual.

Any dispute arising from or relating to this Privacy Policy, our data processing practices, or any rights described herein that cannot be resolved through direct engagement with our Privacy Officer (Section 10) shall be resolved in accordance with the governing terms and dispute resolution provisions set out in the applicable service agreement or Terms of Service between the parties. In the absence of such provisions, disputes shall be submitted to the competent courts of the Dominican Republic, without prejudice to any mandatory rights under applicable U.S. law that cannot be waived by contract.

----------------------------------------------------

Legal Notice

This Privacy Policy is provided for informational purposes and constitutes a binding statement of our data practices. It does not constitute legal advice. Caribbean Paradise Investments recommends that clients and investors seek independent legal counsel regarding their personal data rights if they have specific legal concerns related to their jurisdiction of residence.

​

Caribbean Paradise Investments  |  caribbeanparadiseinvestments.com  |  info@caribbeanparadiseinvestments.com

​

Privacy Policy — Version effective June 28, 2026  |  Compliant with Dominican Republic Law No. 172-13 & applicable U.S. federal and state privacy law