PRIVACY STATEMENT

1. About this Privacy Statement

This Privacy Statement explains how Bridge Peer Financial Limited, trading as Property Bridges, collects and processes personal data when you use our platform, website, and services.

This statement, together with our Terms and Conditions, our Cookies Policy, and the Terms and conditions of MangoPay, sets out the basis on which any personal data we collect from you through our website, or that you provide to us, will be processed by us. Please read this statement carefully to understand our practices regarding your personal data and how it will be treated. By accessing and using www.propertybridges.com, you acknowledge that you have read and understood this Privacy Statement.

As a regulated crowdfunding service provider operating within a financial services environment, we process personal data to facilitate investment activities while ensuring appropriate investor protection, regulatory compliance, and operational integrity.

We are committed to processing personal data in a transparent, fair, and secure manner. This Privacy Statement outlines the types of personal data we collect, the purposes for which it is used, the legal bases for processing, and the rights available to you under applicable data protection law.

Our processing activities are designed to balance your data protection rights with the legitimate requirements of operating a regulated investment platform. This includes maintaining appropriate safeguards to protect investors, prevent financial crime, and ensure the stability and integrity of the platform.

We process personal data in accordance with applicable legislation, including:

• Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)
• Data Protection Act 2018
• ePrivacy Directive 2002/58/EC
• Regulation (EU) 2020/1503 on European Crowdfunding Service Providers

In addition, our data processing supports our regulatory obligations as an authorised firm under the Central Bank of Ireland. This includes, where applicable:

• investor categorisation and appropriateness assessments
• anti money laundering and identity verification requirements
• complaint handling and audit trail maintenance
• safeguarding of client funds and transaction monitoring

These measures are implemented to ensure compliance with applicable regulatory requirements, including the Consumer Protection Code, and to support fair treatment of customers within a robust investor protection framework.

2. Controller and Contacts Details

Property Bridges is operated by Bridge Peer Financial Limited, a company incorporated in Ireland and authorised and regulated by the Central Bank of Ireland as a European Crowdfunding Service Provider (ECSPR) under the European Crowdfunding Service Providers Regulation. This regulatory framework requires us to maintain the highest standards of data protection, investor protection, and operational integrity.

Our registered office is located at 22 Fitzwilliam Street Upper, Dublin 2, D02 WR82, Ireland. For the purposes of data protection law, we act as the data controller in respect of your personal data, meaning we determine the purposes and means of processing your personal information.

If you have any questions about this Privacy Statement or how your personal data is handled, you can contact us at team@propertybridges.com.

All data protection related queries are managed internally by our Compliance team, who oversee data protection matters and ensure that requests are handled in accordance with applicable legal and regulatory requirements.

3. How We Collect Your Personal Data

 We collect personal data through multiple channels to ensure we can provide our services safely and in compliance with regulatory requirements. This multi-source approach is essential for maintaining the integrity and security of our platform while meeting our obligations to protect investors and prevent financial crime. You are responsible for ensuring that the personal data you provide is accurate and kept up to date.

Information you provide to us

We collect personal data directly from you when you register on our platform, complete forms, invest, apply for funding, or communicate with us by email, phone, or otherwise. This includes information provided during onboarding, identity verification, and ongoing use of our services.

Where relevant, you may provide information relating to third parties, such as guarantors or authorised representatives. In such cases, you are responsible for ensuring that you have the appropriate authority to share this information with us.

Without required data, we may be unable to onboard you, process transactions, or comply with legal obligations. Failure to provide required information may result in restriction or termination of access to platform services.

 Information we collect automatically

When you use our website or platform, we may automatically collect technical and usage data generated through your interaction with our systems. This supports platform security, fraud prevention, detection of suspicious activity, and overall system performance.

 Information we receive from third parties

In order to meet our regulatory obligations and operate the platform effectively, we may obtain personal data from third party service providers where necessary. These may include identity verification providers, fraud prevention and sanctions screening services, payment service providers such as MangoPay, and publicly available sources where required for compliance purposes.

 Where third parties process personal data on our behalf, they do so under contractual arrangements and are required to implement appropriate data protection and security measures.

 Correspondence and records

We retain records of communications with you, including emails and other correspondence, as well as records of your interactions with the platform. This supports customer service, regulatory compliance, audit requirements, and dispute resolution.

 4. The Types of Data We Process

 The personal data we process depends on how you interact with us and is limited to what is necessary to provide our services and comply with regulatory requirements. As a regulated financial service provider, we are required to collect and verify certain information to ensure investor protection, prevent financial crime, and maintain market integrity.

 We process the following categories of personal data:

 Identity data

This includes your name, date of birth, nationality, and identification documents such as passports, driving licences, or national identity cards. This data is required to verify your identity and comply with KYC and anti-money laundering requirements.

 Contact data

This includes your email address, phone number, and residential address, which are used to communicate with you and maintain accurate records as required under regulatory obligations.

 Financial data

This includes bank account details, transaction records, investment activity, and information relating to source of funds. This data is necessary to facilitate transactions, assess appropriateness, and comply with financial crime prevention requirements.

 Technical and usage data

This includes device information, IP address, and information about how you interact with the platform. This data is used to maintain platform security, detect suspicious activity, and improve performance.

5. How We Use Your Personal Data

We use your personal data primarily to provide you with access to our regulated investment platform and to deliver our services in a safe, compliant, and effective manner. Every use of your personal data supports investor protection, market integrity, or the facilitation of legitimate investment activities within our regulatory framework.

Service provision and account management

We use your personal data to assess applications, onboard users, and create and manage accounts. This includes lenders, borrowers, guarantors, and authorised representatives. We use your data to maintain accurate records, update account information, and communicate with you regarding your platform activity.

We process your personal data to provide and operate our services, including facilitating investments, funding activities, and related transactions. This includes transferring funds between parties through our platform and maintaining records of all transactions in accordance with financial services regulation.

Role specific processing

Where relevant:

For borrowers, we use your data to assess the information you provide, including verifying identity and supporting creditworthiness assessments, facilitating loan agreements, and managing obligations arising under those agreements.

For lenders, we use your data to assess suitability and appropriateness, process investments, facilitate participation in loan agreements, and support related administrative actions where required.

Regulatory compliance and legal obligations

As a regulated financial services provider, we are required to verify your identity, assess investment risk and appropriateness, and monitor transactions for suspicious activities. We use your personal data to comply with anti-money laundering legislation, regulatory reporting obligations, investor protection requirements, and tax reporting duties. These activities are mandatory and form part of our legal obligations.

Platform security and fraud prevention

We use personal data to maintain platform security, detect and prevent fraud, and protect against unauthorised access. This includes analysing usage patterns, monitoring transactions, and implementing authentication measures to safeguard your account and personal information.

Service improvement and platform operation

We use personal data to administer our platform and support internal operations, including troubleshooting, testing, data analysis, research, and statistical purposes. This helps us improve functionality, enhance user experience, and ensure that content is presented effectively across devices.

Communications and service updates

We use your data to notify you about changes to our services, provide updates related to your account or investments, and respond to enquiries or issues you raise.

Marketing communications

Where you have provided consent, we may use your contact details to send you information about investment opportunities or updates related to our services. You can withdraw this consent at any time without affecting your ability to use our core services.

Use of combined data

We may combine personal data you provide with data collected automatically and data obtained from third party providers. This combined information is used to support service delivery, regulatory compliance, fraud prevention, and the overall operation and security of the platform.

6. Legal Basis for Processing

We only process your personal data where we have a lawful basis under Article 6 of GDPR. The selection of the appropriate legal basis depends on the specific purpose of processing and ensures that your rights are protected while enabling us to fulfil our regulatory obligations and provide our services effectively.

Most of our processing is necessary for the performance of our contract with you (Article 6(1) (b)), including account creation, transaction processing, and platform access. We also rely on legal obligations (Article 6(1)(c)) for compliance with financial services regulation, anti-money laundering requirements, and tax reporting duties. These legal bases ensure that we can provide our services while meeting all regulatory requirements that protect investors and maintain market integrity.

We process data based on our legitimate interests (Article 6(1)(f)) for platform security, fraud prevention, and service improvement activities. Where we rely on legitimate interests, you have the right to object to such processing at any time. In each case, we have carefully balanced our legitimate business needs against your privacy rights to ensure that processing is fair and proportionate. We document and periodically review our legitimate interest assessments to ensure ongoing compliance. Where we rely on consent (Article 6(1)(a)), particularly for marketing communications, you have the right to withdraw consent at any time without penalty.

The following table summarises our primary data processing activities and their corresponding lawful bases:

 Special Category Data: We do not intentionally process special category data (such as health, political opinions, or biometric data) in the normal course of providing our services. Where such data might be incidentally processed, appropriate Article 9 GDPR safeguards would be implemented.

7. Automated Decision Making

In order to operate efficiently, ensure consistency and fairness, and comply with regulatory requirements, we use automated processes for certain types of decisions. These automated systems are essential for processing the large volumes of data and transactions that characterise modern financial services while maintaining high standards of accuracy and reducing the potential for human error or bias.

Our automated fraud detection systems continuously monitor platform activity to identify suspicious patterns that might indicate unauthorised access or fraudulent transactions. These systems are necessary to protect your investments and personal data from criminal activity and to comply with our obligations to maintain secure financial services. Without automated monitoring, we could not effectively protect users from the sophisticated cyber threats that target financial platforms.

For compliance monitoring, we use automated processes to screen transactions against sanctions lists, monitor for money laundering indicators, and assess compliance with regulatory reporting requirements. These automated systems ensure consistent application of regulatory standards, reduce processing times, and enable us to identify potential compliance issues quickly and accurately.

Risk assessment processes use automated evaluation to determine investment appropriateness and conduct risk profiling based on your financial circumstances and investment experience.

This automation ensures that all investors are treated fairly and consistently according to objective criteria, reducing the potential for discriminatory or inconsistent decision-making that could occur with purely manual processes. These processes are fundamental to our investor protection obligations under ECSPR.

No decision that produces legal or similarly significant effects is based solely on automated processing without appropriate safeguards. These automated processes are designed to be fair, accurate, and beneficial to users by providing faster decision-making, consistent treatment, and effective protection against risks. These systems help ensure fairness, consistency, and more efficient processing while reducing human error and potential bias. However, you retain important rights regarding automated decision-making.

You have the right to request human intervention, to express your views, and to challenge any decision that significantly affects you. You also have the right to object to profiling where it is based on legitimate interests.

8. Strong Customer Authentication and Platform Authorisation

As part of our payment and security framework, we are required to implement Strong Customer Authentication (SCA) under the Payment Services Directive (PSD2) and to obtain your authorisation (proxy consent under payment services framework) for the platform to access certain account information. These requirements are designed to protect your financial information and prevent unauthorised access to your accounts and investments.

When you provide authorisation for our platform, this enables us to display your current wallet balance, process investment transactions securely, and provide key platform functionalities that require access to your financial information. Where required, provision of SCA and platform authorisation is a condition for accessing certain services, including wallet visibility and transaction execution. This authorisation may be required before accessing wallet or transaction features. Failure to provide authorisation may restrict functionality as the authorisation process is designed to give you control over information access while enabling secure operation of your investment account.

This processing and the associated authentication requirements are necessary for the performance of our services and to comply with regulatory requirements under PSD2 and the European Crowdfunding Service Providers Regulation. This processing is based on contractual necessity and legal obligation under PSD2 and applicable financial regulation. These measures ultimately protect your investments and personal data while ensuring that you have secure, convenient access to your account.

9. Sharing Your Personal Data

We only share your personal data where it is necessary and appropriate to provide our services, comply with legal obligations, or protect legitimate interests. We take steps to ensure that any sharing of personal data is carried out securely and in a manner that protects its confidentiality.

We work with third party service providers who support the operation of our platform. These may include payment service providers such as MangoPay, identity verification providers, IT infrastructure providers, and compliance service providers. Where these providers process personal data on our behalf, they do so under contractual arrangements, are bound by confidentiality obligations, and are required to implement appropriate data protection and security measures.

We act as data controller for personal data collected through our platform. Our service providers act as data processors and process personal data only on our documented instructions.

We may also share personal data with regulatory authorities and public bodies, including the Central Bank of Ireland, Revenue Commissioners, and An Garda Síochána, where required to do so by law. These disclosures are made in accordance with our legal obligations under applicable legislation.

In some cases, we may share project related information with sponsors or other investors in anonymised or aggregated form for the purpose of facilitating investments and providing updates. Where data is anonymised, it no longer constitutes personal data and is not subject to data protection law.

We do not sell, rent, or otherwise monetise your personal data.

10. International Transfers

In some cases, your personal data may be transferred outside the European Economic Area (EEA) to enable us to work with the best service providers and technology partners available globally. Where this occurs, we ensure that your personal data receives the same high level of protection that it would within the EEA through the implementation of appropriate safeguards recognised under GDPR.

These safeguards include transfers to countries that have received European Commission adequacy decisions, implementation of Standard Contractual Clauses approved by the European Commission, and use of Binding Corporate Rules or other appropriate mechanisms. We regularly review these arrangements to ensure they continue to provide adequate protection for your personal data.

11. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. Our retention practices are designed to balance your privacy rights with the legitimate needs of regulatory compliance and business operations.

Data collected for anti-money laundering purposes is retained for a minimum period of five years from the end of the business relationship, as required by the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010. Transaction and financial records are retained for seven years from the date of the transaction or longer where required by tax and financial services law to ensure compliance with regulatory record-keeping requirements.

Account data is retained for the duration of your relationship with us and for the periods specified above, while marketing data is retained only until you withdraw consent or object to processing. Where litigation, regulatory investigation, or audit requirements arise, we may retain relevant data beyond standard retention periods as required by law. We regularly review our retention practices to ensure that we do not keep personal data longer than necessary.

12. Security of Your Data

We implement comprehensive technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security framework is designed to meet the highest standards expected of regulated financial service providers and to protect against the sophisticated cyber threats that target financial platforms.

Our security measures include encryption of data both in transit and at rest using industry-standard protocols, secure systems architecture with regular security assessments and penetration testing, strict access controls with multi-factor authentication, and comprehensive employee training on data protection and security procedures. We also maintain robust incident response procedures and data breach notification protocols to ensure rapid response to any security incidents.

While we implement all reasonable security measures to protect your data, no system can be completely secure against all possible threats. You play an important role in maintaining security by keeping your login credentials confidential, using strong passwords, and reporting any suspected unauthorised access immediately to team@propertybridges.com.

12A. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we are committed to notifying affected users without undue delay as required under GDPR Article 34. We maintain comprehensive incident response procedures and will report any qualifying data breaches to the Data Protection Commission within 72 hours as required under Article 33 GDPR.

Where notification to individuals is required, we will provide clear information about the nature of the breach, likely consequences, and measures taken to address the breach and mitigate potential adverse effects.

13. Your Rights

You have comprehensive rights under GDPR and Irish data protection law regarding how your personal data is processed. These rights are designed to give you control over your personal information while recognising the legitimate needs of regulated financial services.

You can request access to your personal data and information about how it is processed, request correction of inaccurate or incomplete information, and in certain circumstances request deletion of your personal data. You also have the right to restrict processing in specific situations, receive your data in a structured machine-readable format for transfer to another provider, and object to processing based on legitimate interests or for direct marketing purposes.

Where we process your data based on consent, you have the right to withdraw that consent at any time without penalty. If you believe that your data has been processed unlawfully, you have the right to lodge a complaint with the Data Protection Commission or your local supervisory authority.

Important limitations apply to some of these rights where we have compelling legitimate grounds for processing or are required to retain data by law, particularly given our regulatory obligations as an ECSPR. For example, we cannot delete financial transaction records during the mandatory retention period, and we cannot restrict processing that is necessary for regulatory compliance.

To exercise your rights, please contact us at team@propertybridges.com. We will respond within one month of receipt of your request and will explain any limitations that may apply to your specific situation.

14. Cookies

We use cookies and similar technologies to ensure the proper functioning of our website, maintain security, and improve user experience. Essential cookies are required for platform functionality and security and are deployed automatically. Performance cookies help us understand how users interact with our platform to identify improvements, while marketing cookies are used for advertising and marketing purposes through our consent banner mechanism where explicit consent is obtained.

You can withdraw or modify your cookie preferences at any time through our cookie management tool and consent banner. Further details about our cookie practices, including how to manage your preferences, are available in our Cookie Policy at www.propertybridges.com/cookies/.

15. Changes to this Statement

We may update this Privacy Statement from time to time to reflect changes in our services, legal requirements, or regulatory guidance. Where changes are significant and affect your rights or how we process your personal data, we will notify you through the platform or by email.

The current version will always be available on our website at www.propertybridges.com. Continued use of our services after changes take effect constitutes acceptance of the updated statement, though significant changes will not affect your existing rights retroactively.

16. Contact Information

If you have any questions about this Privacy Statement, wish to exercise your rights, or need assistance with any aspect of how your personal data is handled, please contact us at team@propertybridges.com. You can also reach us by post at Bridge Peer Financial Limited, 22 Fitzwilliam Street Upper, Dublin 2, D02 WR82, Ireland.

If you believe that your data has been processed unlawfully or wish to make a complaint about our data processing practices, you have the right to lodge a complaint with the Data Protection Commission at www.dataprotection.ie, info@dataprotection.ie, or +353 57 868 4757. The Data Protection Commission is located at 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

[Version May, 2026]