PRIVACY POLICY

Your privacy and the security of your data are important to us. Therefore, the company Bulevarnovi (hereinafter: the Company), in fulfilling its obligations as a data controller towards you, as a person whose personal data is being collected, provides you, at the moment of collecting such data, and in accordance with the Law on Personal Data Protection (“Official Gazette of the Republic of Serbia”, No. 87/2018, hereinafter: the Law), with the information listed below.

This Privacy Policy (hereinafter: the Policy) applies to natural persons, and personal data includes all data through which we can directly or indirectly identify you. All your personal information is treated as strictly confidential, and the Company and/or our trusted partners store and protect it in an appropriate manner.

Please read this Privacy Policy carefully. If you do not agree with our practices, please do not provide us with your personal data. By continuing to browse our website, you confirm that you agree with the Policy stated herein.

The entity responsible for the processing of personal data in the capacity of the data controller is:

Name: Bulevarnovi

In case of any questions or requests regarding the processing or protection of your personal data, you may contact us via email at prodaja@bulevarnovi.com or in writing to the above-mentioned address of our registered office.

This Policy covers the ways your personal data is processed when you interact with the Company, or when you express interest in purchasing or leasing real estate, or when you contact us regarding the conclusion of a sale or lease agreement within the residential-commercial complex, specifically when you:

• visit our website or websites used for advertising the Company's projects;
• visit our social media profiles;
• communicate with us by phone, through a contact form on the website, via email, or in any other way;
• use our systems and applications;
• visit our sales offices;
• attend our presentations or business events;
• participate in our promotional or marketing activities (e.g., subscribing to a newsletter), surveys, and similar activities;
• enter into an agreement with us regarding the sale or lease of real estate or any other contract.

Providing only those personal data necessary to fulfill specific legal obligations is mandatory. Providing personal data on any other legal grounds is voluntary; however, please note that if you withhold certain data, in some situations we may not be able to provide certain services to you.

1. Personal data of visitors to our website:
   When visiting our website or websites used for advertising the Company's projects, the browser on your device will automatically send the following data to our website server without any action on your part: the IP address of the device used to access the internet, date and time of access, the name and URL of the retrieved file, the website/application from which access is made (referrer URL), the browser used, and, if necessary, the operating system of the device and the name of your internet service provider. These data are temporarily stored in a log file for the purposes of ensuring uninterrupted connection, comfortable use of our website/application, and assessing system security and stability. The data are stored temporarily during the visit and are then automatically deleted. The legal basis for processing the IP address is Article 12, paragraph 1, point 6) of the Personal Data Protection Law (legitimate interest), derived from the purposes mentioned above.

2. Marketing and other activities:
   For the purposes of sending commercial messages and carrying out marketing activities, personal data are collected solely based on the individual's consent (e.g., subscribing to a newsletter, direct marketing, etc.), so that the data you provide via contact form, phone, or email are used according to this purpose. If you consented to receive newsletters via email, SMS, Viber, WhatsApp, and/or other marketing materials containing information about current offers and promotions related to our services, we use your email address, phone number, and full name to send information about available properties, promotions, news, and offers for sale or lease of real estate. These data are stored and processed for sending commercial messages, newsletters, and/or other marketing materials, including special offers or promotions. The legal basis for processing these data is your consent in accordance with Article 12, paragraph 1, point 1) of the Personal Data Protection Law. You can withdraw your consent to receive newsletters/marketing materials at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before withdrawal. You can do this, for example, by unsubscribing from the newsletter on our website. The unsubscribe link is provided at the end of each newsletter, and for Viber, WhatsApp, or SMS, you can unsubscribe directly via the respective app or SMS message. If you withdraw your consent, we will delete your data. We inform you that external partners may be engaged to deliver newsletters/Viber/WhatsApp/SMS, which may involve transferring your email and phone number to these partners.

3. Personal data of buyers/tenants of real estate:
   The Company processes personal data required for preparing, concluding, and executing contracts, and for fulfilling rights and obligations arising from concluded sale or lease agreements within the residential-commercial complex. Personal data collected from you include: full name, address (street, house number, postal code, city, country), personal ID number (JMBG), ID card/passport number, copies of personal documents, and contact details (phone number, email address). All personal data are collected directly from you. In addition to sale and lease agreements, the Company may conclude pre-sale agreements such as reservation agreements or deposit agreements, in which case we collect the following: full name, address, and contact details. The purpose of processing your data is to prepare and execute these contracts. The legal basis for processing these data is Article 12, paragraph 1, points 2) and 3) of the Law, regarding the fulfillment of contractual or legal obligations.

4. Other personal data you provide:
   We process personal data you voluntarily provide during initial contact, subsequent communication (phone, email, questionnaires, etc.), visits to our website or project advertisement pages, or social media profiles, as well as data arising from our communication or business cooperation. This includes identification data (full name) and communication data (phone and email). Processing is based on legitimate interest to respond to your inquiries, provide information about our offerings, and address your questions. The legal basis is Article 12, paragraph 1, point 6) of the Law (legitimate interest). Participation in surveys/questionnaires is voluntary. For anonymous surveys, we do not store data that identify participants. Date and time of participation are recorded. If consent is given for a survey, the legal basis is your consent (Article 12, paragraph 1, point 1), which you may withdraw at any time. Withdrawal does not affect processing carried out before withdrawal. By providing your personal information, you acknowledge that security and privacy cannot be 100% guaranteed, despite the Company's optimal protection measures.

5. Personal data of social media users:
   On the Company's social media pages, personal data are processed to inform users about the residential-commercial complex, properties for sale, services, promotions, important information, and company news. Processing is aimed at interacting with social media visitors and responding to questions, feedback, or communications with interested users. The legal basis is Article 12, paragraph 1, point 6) of the Law (legitimate interest). The Company has limited influence over platform operators’ processing of data. Where possible, we configure settings to ensure compliance with data protection. Operators are responsible for all user profile data. Data posted on social media (comments, videos, images, likes, public posts) are managed by the platform operator; the Company only deletes illegal or inappropriate content if necessary and may use these data for communication with users within platform functions.

We consider your personal data to be a business secret and protect it accordingly, in line with applicable laws and best practices. Within our company, only organizational units or employees who need access to fulfill the purpose for which the personal data were collected can access your data. Third parties are allowed access to your personal data only in the situations described below:

• Our trusted partners or legal entities we cooperate with, which assist us in regular business operations. This may include entities that develop and maintain IT solutions and platforms, servers, and those providing services on behalf of the Company, e.g., for marketing purposes. In such cases, these legal entities process your personal data exclusively for our purposes. These service providers are contractually obliged to use the data only in accordance with our instructions, strictly for the designated purpose, and to adequately protect your data and keep them confidential.

• Entities we cooperate with when necessary to protect certain legitimate interests, e.g., tax advisors, accountants, insurance companies, lawyers, and other consultants. In such cases, these entities process your personal data solely for our purposes.

• Competent authorities supervising lawful operations and conduct, as well as other legal entities where required to fulfill a legal obligation, e.g., auditors. These entities process your personal data for the purposes assigned by law.

• Other parties involved in business transactions, such as the sale of the company or parts of it, reorganization, mergers, joint ventures, or any other type of transfer of our company or assets. We may also need to forward certain inquiries to contractual partners (e.g., suppliers, architects, or contractors regarding specific products/materials), for the purpose of handling your inquiry. In these cases, inquiries are anonymized so third parties cannot link them to you. If necessary, we will notify you and request consent before forwarding your personal data. Third parties are restricted from using your data for any other purposes and are obliged to process and protect your personal data in accordance with legal, regulatory, and contractual obligations. All legal entities we cooperate with are carefully selected and contractually obliged to maintain data confidentiality in accordance with Article 45 of the Personal Data Protection Law.

In certain cases, we may share your personal data or transfer it to other countries in accordance with the Law. When doing so, your data are transferred to servers located in the EU or in countries that provide an adequate level of protection under Serbian law. Access is restricted to a limited number of authorized personnel exclusively for server maintenance purposes.

Some of the protection measures we implement include:

• Use of modern methods for protecting and controlling access to data sources containing personal data;
• Restricting access to sensitive data and limiting user accounts that can access specific data by implementing roles and authorizations to ensure that only designated employees who need access to perform their duties can view and process relevant data;
• Continuous monitoring of all resources (physical spaces where your data are stored) used for processing personal data.

The purpose of these measures is to prevent risks of destruction, loss, alteration, unauthorized disclosure, or access to your personal data. We require third parties with access to your personal data to use appropriate protection measures as well. All personal data are stored on our server in the Republic of Serbia. Please note that the measures described above do not apply to information you choose to share publicly via social media or messaging applications.

Personal data are retained only for as long as necessary to fulfill the purpose for which they were collected. If you have entered into a contract with us, we keep your data for the duration of the rights and obligations under the contract, and thereafter for as long as required by applicable regulations. We also retain your personal data after the termination of the contractual relationship if they are needed to establish, exercise, or defend legal claims or to comply with applicable laws. To the extent possible, we will limit the processing of your personal data for these restricted purposes after the contract ends. Once the purpose is fulfilled, or after the legally prescribed retention period expires, personal data will be permanently deleted.

If you choose to exercise one or more of the rights listed below, we may verify your identity to protect personal data. Your rights are free of charge. Exceptionally, if your request is manifestly unfounded or excessive (e.g., requesting personal data you already possess), especially if it is repetitive, we may charge the necessary costs of processing your request or refuse to act. Please send all questions and requests regarding your rights in writing to the address provided in the "Data Controller" section. We will respond immediately, and no later than one month, unless the exceptional complexity of a particular case requires an extension. To protect you as the data subject, you must appropriately identify yourself, providing the Company assurance that the personal data are being requested by their rightful owner.

• Access to your personal data: You have the right to request information on whether we process your personal data, access to such data, and information about processing in accordance with Article 26 of the Law.
• Correction, supplementation, deletion, and restriction of personal data: You have the right to request correction of inaccurate personal data, as well as the right to supplement, delete, or restrict the use of your personal data.
• Data portability: You have the right to receive and request the transfer of your personal data.
• Right to withdraw consent and the right to be forgotten: You have the right to withdraw your consent to the processing of personal data and request the permanent deletion of personal data processed based on your consent.
• Objection to processing: You have the right to object to the processing of your personal data and to our handling of your personal data. Send your objection by email to the address in the "Data Controller" section, stating "Objection to processing" in the subject line and explaining your objection and request in the message.
• Right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection: You may lodge a complaint at any time with the competent authority for personal data protection – the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/).

The Company reserves the right to amend this Privacy Policy at any time. Any change becomes effective upon its publication on the Company's website or in another appropriate manner. Therefore, we recommend that you regularly check the Privacy Policy section to stay informed of the latest updates. Belgrade, March 30, 2026.