PRIVACY POLICY NOTICE REGARDING PERSONAL DATA PROCESSING

Your privacy and the security of your data are important to us, therefore, the company Magna Real Estate doo Belgrade-New Belgrade (hereinafter: the Company), fulfilling its role as the data controller, provides you with the following information at the time of collecting data related to you, in accordance with the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018, hereinafter: the Law). These Privacy Rules (hereinafter: Rules) apply to individuals, and personal data refers to any data through which we can directly or indirectly identify you. All your personal information is treated as strictly confidential, and the Company and/or our trusted partners store it in an appropriate manner. Please carefully read these privacy rules. If you do not agree with our practices, please do not provide us with your personal data. If you continue browsing our website, you confirm that you agree with the terms outlined in these Rules.

DATA CONTROLLER INFORMATION

The responsibility for processing personal data as a controller lies with:

Name: Magna Real Estate doo Belgrade-New Belgrade
Address: Milutina Milankovića 7b, New Belgrade
Company ID: 21028347, Tax ID: 108581263

If you have any questions or requests regarding the processing or protection of your personal data, you can contact us via email at: office@magnarealestate.rs or in writing at the above-mentioned address.

SCOPE OF PRIVACY POLICY

These Rules cover the ways in which your personal data is processed when you interact with the Company, i.e., when you express interest in purchasing real estate or contact us regarding the conclusion of a real estate purchase agreement within a residential-commercial complex, or when you:

• visit our website or websites used for advertising the Company’s projects;
• visit our profiles on social media platforms;
• communicate with us via phone, contact form on our website, email, or other means;
• use our systems and applications;
• visit our sales offices;
• attend our presentations or business events;
• participate in our promotional or marketing activities (e.g., signing up for newsletters), surveys, etc.;
• enter into a contract with us for the purchase of real estate or other contracts.

Providing personal data is mandatory only for those data we collect to fulfill specific legal obligations. Providing personal data for other legal bases is voluntary, but please note that if you withhold certain data, we may not be able to provide you with certain services in specific situations.

PERSONAL DATA WE COLLECT

1. Personal Data of Website Visitors – When visiting our website or websites used for advertising the Company’s projects, the browser you use on your device will automatically and without your activity send the following data to the server of our website: the IP address of the device from which the request is sent and which has internet access, the date and time of access, the name and URL of the file downloaded, the internet page/application from which the access occurs (referrer URL), the browser you use, and if necessary, the operating system of the computer supporting the internet, as well as the name of your internet provider. The server temporarily stores the aforementioned data in a so-called log file for the following purposes:

• Ensuring the establishment of an uninterrupted connection;
• Ensuring comfortable use of our website/application, or websites used for advertising the Company’s projects;
• Assessing the security and stability of the system.

The data is stored temporarily, only during the visit to the website, and then automatically deleted. The legal basis for processing the IP address is Article 12, Paragraph 1, Item 6 of the Law on Personal Data Protection (legitimate interest), which arises from the above-mentioned purpose of data processing.

2. Marketing and Other Activities – For the purposes of sending commercial messages and executing marketing activities, personal data is collected exclusively based on the consent of the individual (for example, in the case of signing up for a newsletter, direct marketing, etc.), so the data you provided through the contact form, by phone, or by email will be used in accordance with the stated purpose. If you have consented to receiving a newsletter via email, SMS, Viber, and/or for receiving other marketing materials containing information about current offers and promotions related to the services we provide, we will use your email address, phone number, and name to send information about available properties, promotions, news, and offers related to the purchase of real estate. We store and process this data for the purpose of sending commercial messages, newsletters, and/or other marketing materials, which include actions (offers, promotions, etc.). The legal basis for processing data for sending commercial messages, newsletters, and/or other marketing materials is your consent in accordance with Article 12, Paragraph 1, Item 1 of the Law on Personal Data Protection. You can withdraw your consent to receive newsletters/marketing materials at any time. Withdrawing consent does not affect the legality of the processing carried out based on consent before withdrawal. You can do this, for example, by unsubscribing from the newsletter list on our website, or the page used for advertising the Company’s projects. The unsubscribe link for the newsletter can be found at the end of each newsletter, and for Viber or SMS, you can unsubscribe directly via the Viber application or SMS message if you gave consent for such notifications. If you withdraw consent, we will delete your data. Please note that in the case of sending newsletters/Viber/SMS, we may engage external partners to carry out these services, so your data (email address and phone number) may be transferred to them.
3. Personal Data of Property Buyers – The Company processes personal data of individuals necessary for the preparation, conclusion, and execution of contracts and the fulfillment of rights and obligations under concluded real estate purchase agreements within a residential-commercial complex. The personal data we collect from you includes: name and surname, address (street, house number, postal code, city, country), personal identification number (JMBG), ID/passport number, copies of personal documents, and contact information (phone number, email address). We obtain all your personal data directly from you. In addition to the real estate purchase agreement, the Company may also conclude contracts with you in the pre-purchase phase, such as reservation agreements, deposit agreements for real estate purchases, etc., in which case we collect the following data from you: name and surname, address (street, house number, postal code, city, country), and contact information (phone number, email address). We process your data for the purpose of preparing the real estate purchase agreement and preparing, concluding, and executing other contracts mentioned in this section. The legal basis for processing this data is Article 12, Paragraph 1, Items 2 and 3 of the Law on Personal Data Protection, considering the execution of contractual obligations or legal obligations.
4. Other Personal Data You Provided – We process those personal data that you voluntarily provided when establishing initial contact, during later communication (e.g., through a phone call, email, surveys, etc.), when visiting the Company’s website or websites used for advertising the Company’s projects, or profiles on social media, as well as personal data resulting from our communication or business cooperation, including your identification data (name and surname), as well as your communication data (contact phone and email address). We process your data in accordance with the established purpose, so we can respond to your inquiry based on your interest, introduce you to our offer, and provide other requested information. The legal basis for processing the data is Article 12, Paragraph 1, Item 6 of the Law on Personal Data Protection (legitimate interest). Our (and your) legitimate interest in this data processing arises from the need to respond to your questions, resolve existing issues if necessary, and ensure your satisfaction as a user of our services or as a user of our website. If you participate in any of our surveys, such participation is voluntary. For anonymous surveys, we do not store data that allows us to identify the participant. We only keep the date and time of your participation. Any personal data you provide through the survey is considered voluntarily given and is stored in accordance with the provisions of the Law. If you have consented to participate in the survey, the legal basis for processing the data is based on your consent in accordance with Article 12, Paragraph 1, Item 1 of the Law on Personal Data Protection. In this case, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the legality of the processing carried out based on consent before withdrawal. By providing personal information, the visitor to the Company’s website, or the website used for advertising the Company’s projects, understands and agrees that the security, integrity, and privacy of their data cannot be 100% guaranteed, despite the Company’s constant efforts to take optimal measures to protect the data.
5. Personal Data of Social Media Users – On the Company’s social media pages, the Company processes data for the purpose of informing individuals about the business-residential complex, real estate we offer for sale, services we provide, promotions, important information, and news within the company, all to interact with visitors on social media and respond to questions, praise, and criticism, as well as to communicate with individuals interested in our services. Data processing is carried out in the interest of communication, interaction, and improving relationships with followers. The legal basis for processing your data is Article 12, Paragraph 1, Item 6 of the Law (legitimate interest). The processing of data by the social media platform operators (e.g., member administration and sharing information) is under limited control. Where we can influence and set parameters for processing your data, we take all available measures to ensure that the platform operator complies with data protection standards. However, in many cases, we have no influence on the data processing by the platform operator, nor do we know exactly what data the operator processes. The platform operator manages the entire IT infrastructure of the service, adheres to its own data protection rules, and has a separate user relationship with you (if you are a registered user of the social media service). Additionally, the operator is solely responsible for any issues related to your user profile data, to which we as a company have no access. More detailed information on data processing by the platform operators and your right to object can be found in their data protection policies. The data you enter on our social media pages, such as comments, videos, pictures, likes, public announcements, etc., is published by the platform operator, and we do not process it for any purpose other than the one intended. We reserve the right to delete unlawful or inappropriate content if necessary. We process your data for communication purposes. We may share your content on our page if that is a feature of the social media platform.

ACCESS TO YOUR DATA
We consider your personal data to be a business secret and protect it as such in accordance with applicable laws and best practices. Within our company, access to the data you have provided is granted only to organizational units or employees who need it to fulfill the purpose for which the personal data was collected. We will process your personal data ourselves, while third parties are only allowed access and processing of your personal data in the following situations:
• Our trusted partners, i.e., legal entities with whom we conduct business and who assist us in regular operations. These may include entities that develop and maintain IT solutions and platforms, servers, as well as entities that provide services on behalf of the Company, such as for marketing purposes. In this case, these legal entities process your personal data exclusively for our purposes. These service providers are contractually obliged to use the data entrusted to them solely in accordance with our instructions and strictly for the purpose we have defined, with the obligation to adequately protect your data and keep it confidential.
• Entities with whom we conduct business when we deem it necessary to protect our certain legitimate interests, such as tax advisors, accountants, insurance companies, lawyers, and other advisors. In this case, these entities process your personal data exclusively for our purposes.
• Competent bodies supervising the legality of business activities and operations, as well as other legal entities when necessary to fulfill a legal duty of ours, such as an auditor. In this case, these legal entities process your personal data for the purpose assigned to them by law.
• Other parties in connection with business transactions, such as the sale of the company or part of the company, reorganization, mergers, joint ventures, or any other type of disposal of our company or assets. Also, there may be a need to forward some of your inquiries to contractual partners (e.g., suppliers, architects, or contractors for inquiries about specific products/materials, etc.) for the purpose of processing your inquiry. However, in these cases, the inquiry is anonymized so that third parties cannot associate it with you. If, in a particular case, the transfer of your personal data is necessary, we will notify you in advance and request your consent. Third parties are limited in their ability to use your personal data for any other purposes except those mentioned, and are obliged to protect and process your personal data in accordance with legal, regulatory, and contractual obligations. All legal entities with whom we cooperate are carefully selected, and when required by law, they are contractually bound to maintain the confidentiality of personal data, in accordance with Article 45 of the Personal Data Protection Act.

TRANSFER OF YOUR PERSONAL DATA TO OTHER COUNTRIES
In certain cases, we may share your personal data or transfer it to other countries in accordance with the law. When we do this, we transfer your data to servers located in the EU or in a country that provides an adequate level of protection in accordance with the legislation of the Republic of Serbia. Access will be granted only to a limited number of persons, i.e., authorized individuals exclusively for the maintenance of server functionality.

HOW WE PROTECT YOUR PERSONAL DATA
Some of the protection measures we implement are as follows:
• The application of modern methods of protection and access control to the data sources that contain personal data;
• Limiting access to sensitive data, as well as restricting user accounts that may have access to certain data, introducing a system of roles and authorizations to ensure that only certain employees who require access to data to perform their work tasks can view and process the relevant data;
• Continuous monitoring of all resources (physical spaces where your data is stored) used for processing personal data.
The purpose of implementing these measures is to prevent the risk of destruction, loss, alteration, unauthorized disclosure, or access to your personal data. We also require third parties with access to and processing of your personal data to use appropriate protection measures. All personal data is stored on our servers in the Republic of Serbia. Please note that the above-mentioned protection measures do not apply to information or data you choose to share publicly via social media or messaging apps.

RETENTION PERIOD OF YOUR PERSONAL DATA
Personal data is retained for as long as necessary to ensure the purpose for which the personal data was collected. If you have entered into a contract with us, we will retain your data for as long as the rights and obligations under the contract last, and thereafter for as long as required by applicable regulations. We will retain your personal data even after the termination of the contractual relationship if we need it to establish, exercise, or defend legal claims or to comply with applicable laws. As far as possible, we will limit the processing of your personal data to these limited purposes after the termination of the contractual relationship. Once the purpose is fulfilled or the legally prescribed retention period for personal data expires, your personal data will be permanently deleted.

YOUR RIGHTS
If you decide to exercise one or more of your rights listed below, we have the right to verify your identity, all in order to protect personal data. You can exercise your rights free of charge. However, if your request is clearly unfounded or excessive (e.g., requesting personal data that you already possess), and especially if the same request is repeated frequently, we have the right to charge the necessary costs for processing your request or to refuse to act on your request. Please send all questions and requests related to your rights in writing to the address provided in the “Controller Information” section. We will respond to your request immediately, and at the latest within one month, unless the exceptional complexity of the specific case requires an extension of this period. To protect you as the data subject, you need to appropriately identify yourself as the submitter of the request, to guarantee to the Company that the personal data is being provided by its owner.

1. Access to Your Personal Data – You have the right to request information on whether we process your personal data, access to that data, and information on the processing in accordance with Article 26 of the Law.
2. Correction of Inaccurate Data, Completion, Deletion, and Restriction of Use of Personal Data – You have the right to request the correction of inaccurate personal data, as well as the right to complete, delete, and restrict the use of your personal data.
3. Portability of Personal Data – You have the right to download and request the transfer of your personal data.
4. Right to Withdraw Consent and to Be Forgotten – You have the right to withdraw your consent for the processing of personal data, as well as to request the permanent deletion of personal data we have processed based on your consent.
5. Objection to Processing or Handling of Your Personal Data – You have the right to object to the processing of your personal data, as well as to the way we handle your personal data in general. Please send your request via email to the address provided in the “Controller Information” section, stating “Objection to Processing” in the subject line and explaining the reason for your objection and your request in the body of the message.
6. Right to File a Complaint with the Commissioner for Information of Public Importance and Personal Data Protection – You have the right to file a complaint at any time with the competent authority for the protection of personal data – the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/).

CHANGES TO THE PRIVACY POLICY
The Company reserves the right to change this privacy policy at any time. Any changes become effective after being published on the Company’s website or through another appropriate means. Therefore, we recommend that you regularly check the section relating to the Privacy Policy to stay updated with the latest information.
Date: 19.03.2025.