Privacy Policy – Personal Data Processing Notice

Your privacy and the security of your data are important to us. Therefore, the company MG10 DOO BEOGRAD (hereinafter: the Company), fulfilling its obligations as a data controller toward you as the individual whose data is being collected, provides you with the following information at the time of data collection, in accordance with the Law on Personal Data Protection ("Official Gazette of the Republic of Serbia", No. 87/2018, hereinafter: the Law). These Privacy Rules (hereinafter: the Rules) apply to natural persons. Personal data refers to any information by which we can directly or indirectly identify you. All your personal information is treated as strictly confidential and is stored appropriately by the Company and/or our trusted partners. Please read these privacy rules carefully. If you disagree with our practices, please do not provide us with your personal data. By continuing to browse our website, you confirm your agreement with the Rules stated herein.

DATA CONTROLLER INFORMATION

Responsibility for processing personal data as the data controller is held by:

Name: MG10 DOO BEOGRAD Address: Kneginje Zorke 21, Belgrade Registration Number: 22117351, Tax ID: 115128902

For any questions or requests regarding the handling or protection of your personal data, you may contact us at: mg10development@gmail.com or by mail at the above address.

SUBJECT MATTER OF THE PRIVACY POLICY

These Rules cover the ways in which your personal data is processed when you interact with the Company — specifically when you express interest in purchasing or renting real estate, or when you contact us regarding the conclusion of a purchase or lease agreement within a residential-commercial complex — including when you:

• Visit our website or pages used to advertise the Company's projects
• Visit our social media profiles
• Communicate with us by phone, contact form, email, or any other means
• Use our systems and applications
• Visit our sales offices
• Attend our presentations or business events
• Participate in our promotional or marketing activities (e.g., newsletter sign-up), surveys, etc.
• Enter into a contract with us regarding the purchase or lease of real estate, or any other agreement

Only personal data collected to fulfill specific legal obligations is mandatory to provide. Providing personal data under all other legal bases is voluntary; however, please note that if you withhold certain data, we may in some situations be unable to provide you with certain services.

PERSONAL DATA WE COLLECT

1. Data of website visitors When you visit our website or pages used to advertise the Company's projects, the browser on your device will automatically and without any action on your part send the following to our website server: the IP address of the device making the request, date and time of access, name and URL of the downloaded file, the referring website/application (referrer URL), the browser you are using, and if necessary, the operating system supporting internet access, as well as your internet service provider's name.

This data is temporarily stored in a so-called log file for the following purposes: ensuring a stable connection, ensuring comfortable use of our website/application and project advertising pages, and assessing system security and stability. The data is stored temporarily for the duration of the visit and then automatically deleted.

The legal basis for processing the IP address is Article 12, paragraph 1, item 6) of the Law on Personal Data Protection (legitimate interest), arising from the above-stated processing purpose.

2. Marketing and other activities For the purpose of sending commercial messages and conducting marketing activities, personal data is collected exclusively on the basis of the individual's consent (e.g., newsletter sign-up, direct marketing, etc.). Data you provide via the contact form, by phone, or by email is used in accordance with the stated purpose.

If you have given consent to receive newsletters via email, SMS, Viber, WhatsApp, and/or other marketing materials containing information about current offers and promotions, we use your email address or phone number along with your name and surname to send information about available properties, promotions, news, and purchase or lease offers.

The legal basis for processing data when sending commercial messages, newsletters, and/or other marketing materials is your consent pursuant to Article 12, paragraph 1, item 1) of the Law. You may withdraw your consent at any time — this does not affect the lawfulness of processing carried out prior to withdrawal. You may do so by unsubscribing from the newsletter list on our website. An unsubscribe link is included at the bottom of every newsletter; for Viber, WhatsApp, or SMS, you may unsubscribe directly via those apps or by SMS. Upon withdrawal of consent, your data will be deleted.

Please note that when sending newsletters/Viber/WhatsApp/SMS, we may engage external partners to provide these services, which may involve transferring your email address and phone number to those parties.

3. Data of real estate buyers/tenants The Company processes the personal data of individuals necessary for preparing, concluding, and executing contracts, as well as exercising rights and obligations under concluded real estate purchase and lease agreements within the residential-commercial complex.

The personal data we collect includes: name and surname, address (street, house number, postal code, city, country), national identification number (JMBG), ID/passport number, copies of identity documents, and contact details (phone number, email address). All personal data is obtained directly from you.

In addition to purchase and lease agreements, the Company may also enter into pre-sale agreements such as reservation agreements, deposit agreements, etc., in which case we collect: name and surname, address, and contact details.

The legal basis for processing is Article 12, paragraph 1, items 2) and 3) of the Law, regarding the performance of contractual and legal obligations.

4. Other personal data you provide We process personal data that you voluntarily provide during initial contact or subsequent communication (e.g., phone call, email, questionnaires, etc.), during visits to our website or social media profiles, as well as data arising from our communication or business cooperation — including your identification data (name and surname) and contact data (phone number and email address).

We process your data in accordance with the stated purpose — specifically to respond to your inquiry based on your expressed interest, present our offer in more detail, and provide other requested information. The legal basis is Article 12, paragraph 1, item 6) of the Law (legitimate interest).

If you participate in any of our surveys/questionnaires, participation is voluntary. For anonymous surveys, we do not store data that would allow identification of the participant — only the date and time of participation. Any personal data provided through a survey is considered voluntarily given and is stored in accordance with the Law. Where consent has been given, you may withdraw it at any time, without affecting the lawfulness of prior processing.

By submitting personal information, visitors acknowledge and agree that the security, integrity, and privacy of their data cannot be 100% guaranteed, despite the Company's continuous efforts to implement optimal protective measures.

5. Data of social media users On the Company's social media pages, we process data for the purpose of informing individuals about the residential-commercial complex, available properties, services, promotions, important information, and company news — and for interacting with visitors, responding to questions, praise, and criticism, and communicating with interested parties. Processing is carried out in the interest of communication and improving relations with followers. The legal basis is Article 12, paragraph 1, item 6) of the Law (legitimate interest).

We have limited influence over data processing by social media platform operators. Where we can influence and set parameters for your data processing, we take all available measures. However, in many areas we cannot influence the platform operator's data processing and do not know exactly what data is processed. The platform operator manages the entire IT infrastructure, adheres to its own data protection rules, and has a separate user relationship with you if you are a registered user. The operator is solely responsible for all matters relating to your user profile data, to which we as a company have no access.

Content you post on our social media pages — such as comments, videos, images, likes, public notices, etc. — is published by the platform operator, and we do not process it for any purpose other than those stated herein. We reserve the right to delete unlawful or inappropriate content where necessary. We may also share your content on our page where this is a function of the social media platform.

ACCESS TO YOUR DATA

We treat your personal data as a business secret and protect it accordingly. Within our company, only those organizational units and employees who need the data to fulfill the purpose for which it was collected have access to it.

Your personal data will be processed by us directly; third parties have access to and may process your personal data only in the following situations:

• Trusted partners and legal entities that assist us in regular business operations — such as those developing and maintaining IT solutions, platforms, and servers, or providing services on our behalf (e.g., for marketing). In such cases, they process your data exclusively for our needs and are contractually bound to use it only in accordance with our instructions, strictly for the stated purpose, with adequate protection and confidentiality obligations.
• Business collaborators, when we deem it necessary to protect our legitimate interests — e.g., tax advisors, accountants, insurance companies, lawyers, and other advisors. They process your data exclusively for our needs.
• Competent authorities conducting oversight of business legality, and other legal entities when required to fulfill a legal obligation — e.g., auditors. They process your data for purposes assigned to them by law.
• Other parties in connection with business transactions such as sale of the company or part of it, reorganization, merger, joint venture, or any other form of disposition of our company or assets.

There may also be a need to forward part of your inquiries to contractual partners (e.g., suppliers, architects, or contractors) for the purpose of processing your inquiry — in such cases, the inquiry is first anonymized so that the third party cannot link it to you in any way. If forwarding your personal data becomes necessary in an individual case, we will notify you in advance and request your consent.

Third parties are restricted from using your personal data for any purposes other than those stated and are obligated to protect and process your data in accordance with legal, regulatory, and contractual obligations. All legal entities we work with are selected with great care and, where required by law, are contractually bound to maintain the confidentiality of personal data, in accordance with Article 45 of the Law on Personal Data Protection.

TRANSFER OF YOUR PERSONAL DATA TO OTHER COUNTRIES

In certain cases, we may share or transfer your personal data to other countries in accordance with the Law. When doing so, we transfer your data to servers located in the EU or in a country that provides an adequate level of protection in accordance with the legislation of the Republic of Serbia. Access will be granted only to a limited number of authorized individuals, exclusively for maintaining server functionality.

HOW WE PROTECT YOUR PERSONAL DATA

Some of the protection measures we implement include:

• Application of modern data protection methods and access controls for data sources containing personal data
• Restriction of access to sensitive data and limitation of user accounts that can access certain data, through a system of roles and authorizations ensuring that only those employees who need access to perform their duties can view and process the relevant data
• Continuous monitoring of all resources (physical spaces where your data is stored) used for personal data processing

The purpose of these measures is to prevent the risk of destruction, loss, alteration, unauthorized disclosure, or access to your personal data. We also require appropriate protective measures from third parties who have access to and process your personal data.

All personal data is stored on our server in the Republic of Serbia. Please note that the above protective measures do not apply to information or data you choose to share publicly via social media or messaging applications.

PERSONAL DATA RETENTION PERIOD

Personal data is retained for as long as necessary to fulfill the purpose for which it was collected. If you have entered into a contract with us, data is retained for the duration of the rights and obligations under the contract, and thereafter for as long as required by applicable regulations. We may also retain your personal data after the termination of the contractual relationship if needed to establish, exercise, or defend legal claims, or to comply with applicable laws. To the extent possible, we will limit the processing of your personal data to those limited purposes after the termination of the contractual relationship. Once the purpose has been fulfilled or the legally prescribed retention period has expired, personal data will be permanently deleted.

YOUR RIGHTS

If you choose to exercise one or more of the rights listed below, we have the right to verify your identity for the purpose of protecting personal data. Exercising your rights is free of charge. Exceptionally, if your request is manifestly unfounded or excessive (e.g., you are requesting data you already possess), particularly if the same request is repeatedly made, we have the right to charge the necessary costs of processing your request or to refuse to act on it.

Please send all questions and requests related to your rights in writing to the address provided in the "Data Controller Information" section. We will respond to your request promptly and no later than one month, unless the exceptional complexity of a specific case requires an extension.

Right of access — You have the right to request information about whether we process your personal data, access to that data, and information about the processing in accordance with Article 26 of the Law.

Right to rectification, completion, erasure, and restriction — You have the right to request correction of inaccurate personal data, as well as the right to have your personal data completed, erased, or restricted in use.

Right to data portability — You have the right to receive and request the transfer of your personal data.

Right to withdraw consent and to be forgotten — You have the right to withdraw your consent to the processing of personal data and to request the permanent deletion of your personal data that we processed on the basis of your consent.

Right to object — You have the right to object to the processing of your personal data as well as to our general handling of your personal data. Please send your request by email to the address in the "Data Controller Information" section, with the subject line "Objection to Processing," explaining the reason for the objection and your request.

Right to lodge a complaint with the Commissioner — At any time, you have the right to file a complaint with the competent authority for personal data protection — the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/).

AMENDMENTS TO THE PRIVACY POLICY

The Company reserves the right to amend these privacy rules at any time. Any amendment becomes effective upon its publication on the Company's website or in another appropriate manner. We therefore recommend that you regularly check the Privacy Policy section to stay up to date.

Belgrade, February 17, 2026