Privacy Policy

This Privacy Policy explains how Universal Reach Limited ("Universal Reach", "we", "us", or "our") collects, uses, stores, shares, and otherwise processes personal data in connection with UR Refer, our website, and related services (together, the "Platform").

Universal Reach Limited is a company incorporated and registered in Malta under company number C80611, with registered office at 119, Maple Court, Balluta Mansions, Sliema, SLM 1376, Malta.

For the processing activities described in this Privacy Policy for which Universal Reach determines the purposes and means of processing, Universal Reach acts as the data controller.

This Privacy Policy is intended to provide information under applicable data protection law, including Regulation (EU) 2016/679 (the "GDPR") and the Malta Data Protection Act (Chapter 586), where applicable.

1. Scope of this Privacy Policy

This Privacy Policy applies to personal data we process when you visit or use the Platform, register or maintain an account, purchase or manage a subscription, communicate with us, request support, receive permitted communications from us, or otherwise interact with Universal Reach.

The Platform is intended for business and professional users. Company users and Referrers may be located globally.

This Privacy Policy does not govern personal data independently exchanged between a Referrer, a Company, and a prospective client outside the Platform. Those parties are independently responsible for their own processing activities under applicable law.

2. The Platform's Lead Qualification Model

The Platform is designed to facilitate B2B lead qualification without requiring the personal contact details of prospective client contacts to be uploaded to the Platform.

When a Referrer proposes a potential lead for qualification, the Platform may permit the Referrer to provide limited business-level information such as the prospective client organisation's name, relevant department or business function, the professional role or job function of the intended contact, industry, geography, and a non-personal description of the opportunity.

Referrers are not permitted to upload the intended contact's name, direct or personal email address, telephone number, social media profile or profile URL, residential address, identification documents or numbers, or other direct personal contact identifiers as part of the lead qualification process.

If a Company qualifies a lead, the Referrer may make the actual introduction outside the Platform, for example by email. Universal Reach does not require the prospective contact's name or contact details to be uploaded to the Platform and is not responsible for personal data independently exchanged outside the Platform.

A job role or other business information may nevertheless constitute personal data where an individual is identifiable from that information. Where this occurs, we process such information in accordance with applicable data protection law.

3. Personal Data We May Collect

Depending on how you use the Platform, we may process:

• Account and identity data, such as your name, business name, job title, professional role, username, and account identifier.
• Business contact data, such as your business email address, business telephone number, company address, and professional contact details.
• Company or Referrer profile data that you choose to provide.
• Subscription and billing data, including subscription plan, billing address, VAT or tax information, payment status, transaction references, and limited payment-related information. Full payment-card details may be processed directly by our appointed payment service provider rather than stored by us.
• Platform activity data, such as opportunities viewed or published, lead submissions, prospective organisation names, target job roles, qualification decisions, rejection reasons, agreement selections, introduction confirmations, receipt confirmations, and Platform communications.
• Technical and security data, such as IP address, device information, browser type, operating system, login records, timestamps, security events, and similar technical information.
• Support and correspondence data, including communications you send to us and records of customer-support interactions.
• Marketing preferences, including whether you have requested or agreed to receive particular communications.
• Cookie and analytics data, where cookies or similar technologies are used, subject to applicable consent requirements.
• Compliance and fraud-prevention information where reasonably necessary to protect the Platform, verify users, prevent abuse, or comply with legal obligations.

4. How We Collect Personal Data

We may collect personal data directly from you when you register, subscribe, complete your profile, use Platform functionality, communicate with us, or provide information through the Platform.

We may also receive information from the organisation you represent, another authorised user within your organisation, payment service providers, authentication providers, technical service providers, fraud-prevention providers, or other service providers used to operate the Platform.

Technical information may be collected automatically when you access or use the Platform, subject to applicable law and cookie-consent requirements.

5. Purposes and Lawful Bases for Processing

We process personal data only where we have an appropriate lawful basis under applicable law.

Contractual necessity: We may process personal data where necessary to create and administer your account, provide Platform functionality, manage your subscription, authenticate access, provide customer support, and perform our contractual obligations.

Legitimate interests: We may process personal data where necessary for legitimate business interests, provided those interests are not overridden by your rights and interests. These interests may include operating and improving the Platform, maintaining security, preventing fraud and abuse, keeping appropriate business and Platform records, understanding service usage, protecting our legal rights, and communicating with business users about relevant service matters.

Legal obligations: We may process personal data where necessary to comply with legal, regulatory, tax, accounting, law-enforcement, court, or other binding obligations.

Consent: Where required, we may rely on your consent for specific processing activities, such as certain non-essential cookies or optional marketing communications. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Establishment, exercise, or defence of legal claims: Where permitted by law, we may process information as necessary to establish, exercise, or defend legal rights or claims.

6. Subscriptions and Payments

We process information necessary to administer monthly or annual subscriptions, confirm payment status, maintain transaction records, issue or support invoices, apply applicable VAT or tax treatment, and manage cancellations and renewals.

Payments may be processed by third-party payment service providers. Such providers may process personal data under their own privacy terms and legal responsibilities. We recommend reviewing the privacy information provided by the applicable payment provider.

We will update this Privacy Policy or provide additional information where necessary once the Platform's payment providers and payment architecture are finalised.

7. Lead, Qualification, and Introduction Records

The Platform may maintain administrative records relating to proposed business leads, including prospective organisation names, target job roles, submission dates and times, qualification or rejection decisions, agreement selections, introduction confirmations, and Company confirmations of receipt.

These records support Platform functionality, user account administration, security, auditability, and the legitimate operation of the B2B referral marketplace.

The Platform is not intended to store the name or direct contact details of the individual prospective client contact as part of this process.

Universal Reach does not use Platform records to guarantee legal lead ownership, commission entitlement, or contractual performance between Companies and Referrers.

8. Who We May Share Personal Data With

We may disclose personal data where reasonably necessary to:

• hosting, cloud infrastructure, database, security, authentication, communications, customer-support, analytics, and other technology service providers;
• payment processors and billing service providers;
• professional advisers, including lawyers, accountants, auditors, insurers, and consultants;
• regulators, courts, law-enforcement authorities, tax authorities, public bodies, or other parties where disclosure is legally required or reasonably necessary to protect legal rights;
• potential purchasers, investors, lenders, or transaction advisers in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business, subject to appropriate confidentiality and legal safeguards; and
• other Platform users where information is intentionally made available as part of Platform functionality.

We do not sell the personal contact details of prospective client contacts through the Platform.

Where service providers process personal data on our behalf, we require appropriate contractual and data-protection safeguards as required by applicable law.

9. International Data Transfers

Because the Platform may use service providers and serve users globally, personal data may be processed in countries outside Malta or the European Economic Area (EEA).

Where GDPR applies and personal data is transferred outside the EEA to a country that does not benefit from an applicable adequacy decision, we will use an appropriate transfer mechanism where required. This may include European Commission Standard Contractual Clauses or another lawful safeguard.

Where appropriate, we may implement supplementary technical, contractual, or organisational safeguards.

Further information about applicable transfer safeguards may be requested using the contact details in this Privacy Policy.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet legitimate operational, security, contractual, tax, accounting, regulatory, dispute-resolution, and legal requirements.

Account and subscription information may generally be retained for the duration of the account relationship and for an appropriate period afterwards.

Financial and transaction records may be retained for periods required by applicable tax, accounting, and legal requirements.

Security, fraud-prevention, and audit records may be retained for an appropriate period based on the nature of the information and relevant risks.

Platform lead and qualification records may be retained while reasonably necessary to provide Platform functionality, maintain appropriate business records, address user disputes, and protect legitimate legal interests.

Where personal data is no longer required, we will delete or anonymise it, subject to applicable legal and technical requirements.

Specific retention periods should be reviewed and finalised before launch based on the Platform's final systems, legal requirements, and operational needs.

11. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

No online service can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and for notifying us promptly if they suspect unauthorised access to their account.

12. Cookies and Similar Technologies

The Platform may use cookies and similar technologies that are strictly necessary for authentication, security, session management, and core Platform functionality.

We may also use analytics, preference, or other non-essential technologies where permitted by law and, where required, after obtaining appropriate consent.

Further information about cookies, their purposes, durations, providers, and how to manage preferences should be provided in a separate Cookie Policy or cookie-management interface.

Non-essential cookies should not be activated before obtaining consent where consent is required by applicable law.

13. Direct Marketing

We may send service-related and transactional communications necessary to operate your account and subscription.

Where we send direct marketing communications, we will do so in accordance with applicable law and the lawful basis applicable to the communication.

Where consent is required, marketing consent will be requested separately and will not be a condition of accessing the Platform unless the communication is necessary to provide the requested service.

You may opt out of marketing communications using the unsubscribe method provided in the communication or by contacting us. Opting out of marketing does not prevent us from sending necessary service, account, security, billing, or legal communications.

14. Your Data Protection Rights

Subject to applicable law and any relevant conditions or exemptions, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing, including processing based on legitimate interests and direct marketing;
• request portability of certain personal data;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data protection supervisory authority.

These rights are not absolute and may be subject to conditions, limitations, or exemptions under applicable law.

We may need to verify your identity before acting on a request. We will respond within the periods required by applicable law.

15. Complaints and Malta Supervisory Authority

If you have concerns about how we process your personal data, we encourage you to contact us first so that we can address your concerns.

Where applicable, you also have the right to lodge a complaint with a competent supervisory authority. As Universal Reach Limited is established in Malta, the relevant Maltese supervisory authority is the Information and Data Protection Commissioner (IDPC).

Current contact and complaint information for the IDPC is available on the IDPC's official website.

16. Children

The Platform is a B2B service intended for business and professional users and is not directed to children.

We do not knowingly offer Platform accounts to children. If we become aware that we have collected personal data from a child in circumstances where such processing is not lawful, we will take appropriate steps in accordance with applicable law.

17. Third-Party Websites and Services

The Platform may contain links to third-party websites or services. Universal Reach is not responsible for the privacy practices of independent third parties.

Where you access a third-party service, that party's privacy policy may apply to its processing of your personal data.

18. Automated Decision-Making

Unless we inform you otherwise, Universal Reach does not intend to make decisions producing legal or similarly significant effects about you based solely on automated processing.

If this changes, we will provide the information and safeguards required by applicable law.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, our processing activities, service providers, legal requirements, or business operations.

The updated version will be published with a revised "Last Updated" date. Where required by law, we will provide additional notice of material changes.

20. Contact Us

For questions about this Privacy Policy, our processing of personal data, or to exercise applicable data protection rights, please contact:

• Universal Reach Limited
• 119, Maple Court, Balluta Mansions
• Sliema, SLM 1376
• Malta
• Company No: C80611
• Privacy/Data Protection Email: support@urrefer.com
• General Contact Email: support@urrefer.com
• Website: www.urrefer.com

If Universal Reach appoints a Data Protection Officer (DPO), the DPO's contact details will be provided here where applicable.