PRIVACY POLICY

Your privacy and the security of your data are important to us. Therefore, GP GRIN d.o.o. Belgrade-Zvezdara (hereinafter: the Company), fulfilling its duty as a data controller towards you, as an individual from whom personal data is collected, provides you at the time of data collection, and in accordance with the Personal Data Protection Act (“Official Gazette of RS”, No. 87/2018, hereinafter: the Act), with the following information.

This Privacy Policy (hereinafter: the Policy) applies to natural persons, and personal data means any information through which you can be directly or indirectly identified. All your personal information is treated as strictly confidential, and the Company and/or our trusted partners store it appropriately.

Please read this privacy policy carefully. If you do not agree with our practices, please do not provide us with your personal data. By continuing to browse our website, you confirm your agreement with the Policy described herein.

The responsibility for processing personal data as a data controller lies with:

Name: GP GRIN d.o.o. Belgrade-Zvezdara

Address: Vojislava Ilića 85, Belgrade (Zvezdara)

Company ID: 21453625, Tax ID: 111275385

If you have any questions or requests regarding the handling or protection of your personal data, you can contact us by email at: gpgrin2019@gmail.com or in writing at the above address of our registered office.

This Policy covers the ways we process your personal data when you interact with the Company, express interest in purchasing or renting real estate, or contact us regarding the conclusion of a sales or lease agreement for properties within the residential-commercial complex, specifically when you:

• visit our website or pages used for advertising the Company's projects;
• visit our social media profiles;
• communicate with us via phone, contact form on the website, email, or any other method;
• use our systems and applications;
• visit our sales offices;
• attend our presentations or business events;
• participate in our promotional or marketing activities (e.g., newsletter subscription, surveys, etc.);
• enter into a sales or lease agreement for real estate, or any other contract with us.

Providing personal data is required only for those data necessary to fulfill certain legal obligations. Providing personal data on any other legal basis is voluntary; however, please note that if you withhold some information, we may, in certain situations, be unable to provide you with some services.

1. Personal data of visitors to our website:
   When you visit our website or the websites used for advertising the Company's projects, the browser you use on your device will automatically, without any action on your part, send to our website server: the IP address of the device making the request, date and time of access, name and URL of the retrieved file, the website/application from which access occurs (referrer URL), the browser you are using, and, if necessary, the operating system of your device as well as your internet provider’s name. This information is temporarily stored on the server in a log file for the following purposes: ensuring uninterrupted connection, providing comfortable usage of our website/application or the project advertising websites, and assessing system security and stability. The data is kept temporarily during your visit and is automatically deleted afterward. The legal basis for processing the IP address is Article 12, paragraph 1, point 6) of the Personal Data Protection Act (legitimate interest), arising from the above-mentioned purposes of data processing.

2. Marketing and other activities:
   For the purpose of sending commercial messages and carrying out marketing activities, personal data is collected solely based on the consent of the individual (e.g., newsletter subscription, direct marketing, etc.). The data you provide via the contact form, telephone, or email is used in accordance with this stated purpose. If you consent to receive newsletters via email, SMS, Viber, WhatsApp, or other marketing materials containing information about available offers and promotions related to our services, we use your email address, phone number, and name to send information about available properties, promotions, news, and offers for purchase or lease. This data is stored and processed for the purpose of sending commercial messages, newsletters, and/or other marketing materials, including offers and promotions. The legal basis for processing this data is your consent under Article 12, paragraph 1, point 1) of the Personal Data Protection Act. You may withdraw your consent at any time, and such withdrawal does not affect the legality of processing performed before the withdrawal. Withdrawal can be done, for example, by unsubscribing from the newsletter on our website or project pages. Newsletter unsubscribe links are provided at the end of each newsletter. Unsubscribe from Viber, WhatsApp, or SMS notifications can be done directly via the respective applications or messages if you provided consent for such notifications. If consent is withdrawn, we will delete your data. Please note that for sending newsletters, Viber, WhatsApp, or SMS, we may engage external partners to perform these services, which may result in the transfer of your data (email and phone number) to these parties.

3. Personal data of property buyers/tenants:
   The Company processes personal data necessary for preparing, concluding, and fulfilling contractual obligations, i.e., for exercising rights and obligations under concluded property sales and lease agreements within the residential-commercial complex. Personal data collected from you includes: full name, address (street, house number, postal code, city, country), national ID number, ID card/passport number, copies of identification documents, and contact details (phone number, email address). All personal data is obtained directly from you. In addition to the sales and lease agreements, the Company may enter into contracts in the pre-sale phase, such as reservation agreements or deposit agreements for property purchase. In such cases, we collect: full name, address, and contact details. Data is processed for preparing sales agreements, lease agreements, and other related contracts. The legal basis for processing this data is Article 12, paragraph 1, points 2) and 3) of the Act, considering the execution of contractual or legal obligations.

4. Other personal data provided by you:
   We process personal data you voluntarily provide during initial contact, subsequent communications (e.g., phone calls, emails, questionnaires), visits to the Company’s website, project advertising websites, or social media profiles. This includes your identification data (full name) and communication data (phone, email). Data is processed to respond to your inquiries, present our offerings, and provide requested information. The legal basis for processing is Article 12, paragraph 1, point 6) of the Act (legitimate interest). Our legitimate interest is to answer your questions, resolve issues, and ensure your satisfaction as a user of our services or website. Participation in surveys/questionnaires is voluntary. Anonymous surveys do not store identifiable data. Only the date and time of participation is recorded. Any personal data given in surveys is considered voluntarily provided and processed according to the law. If consent is given for surveys, the legal basis is Article 12, paragraph 1, point 1) of the Act. You can withdraw consent at any time, without affecting the legality of prior processing. By providing personal information, visitors understand that the security, integrity, and privacy of their data cannot be guaranteed 100%, even though the Company continuously takes all optimal measures to protect it.

5. Personal data of social media users:
   On the Company’s social media pages, we process data to inform individuals about the residential-commercial complex, properties for sale, services provided, promotions, important information, company news, and for interaction with visitors, answering questions, feedback, and communication with interested parties. Data processing is carried out to maintain communication and interaction. The legal basis for processing is Article 12, paragraph 1, point 6) of the Act (legitimate interest). We have limited influence over platform operators (e.g., member administration, data sharing). Where possible, we configure parameters to ensure data protection. However, in many cases, we cannot control operator data processing. Platform operators manage the IT infrastructure, follow their privacy rules, and have a direct user relationship. They are solely responsible for profile data. Details on operator data processing and complaint procedures are in their privacy policies. Content you post (comments, videos, images, likes, public posts, etc.) is published by the platform operator; we do not process it for other purposes. We reserve the right to delete unlawful or inappropriate content. We also process your data to communicate with you and may share your content on our page if it is part of the platform's function.

We treat your personal data as a business secret and protect it accordingly, in line with applicable laws and best practices. Within our company, access to the data you provide is granted only to organizational units or employees who need it to fulfill the purpose for which the personal data was collected. We will process your personal data ourselves, while third parties may access or process your personal data only in the situations described below:

• Our trusted partners or legal entities with whom we cooperate and who assist us in regular business operations. These may include entities that develop and maintain IT solutions, platforms, servers, or provide services on behalf of the Company, e.g., for marketing purposes. In such cases, these entities process your personal data solely for our needs. These service providers are contractually obligated to use the data only according to our instructions, strictly for the purposes we have defined, and to adequately protect and keep your data confidential.

• Business partners when deemed necessary to protect certain legitimate interests, e.g., tax advisors, accountants, insurance companies, lawyers, and other consultants. In such cases, these entities process your personal data solely for our purposes.

• Competent authorities overseeing the legality of business operations and other legal entities when required to fulfill our legal obligations, e.g., auditors. In such cases, these entities process your personal data for purposes assigned to them by law.

• Other parties in connection with business transactions, such as the sale of the company or parts thereof, reorganization, mergers, joint ventures, or any other form of disposition of our company or assets. Additionally, we may need to forward certain inquiries to contractual partners (e.g., suppliers, architects, or contractors regarding specific products/materials) to process your request. In such cases, the inquiry is anonymized so that third parties cannot link it to you. If forwarding your personal data becomes necessary in a specific case, we will notify you in advance and request your consent. Third parties are restricted from using your personal data for any other purpose and are obligated to process and protect your personal data in compliance with legal, regulatory, and contractual obligations. All legal entities we cooperate with are carefully selected and, where required by law, are contractually bound to maintain data confidentiality in accordance with Article 45 of the Personal Data Protection Act.

In certain cases, we may share your personal data or transfer it to other countries in accordance with the Law. When doing so, we transfer your data to servers located in the EU or in a country that ensures an adequate level of protection according to the legislation of the Republic of Serbia. Access will be granted only to a limited number of authorized persons, solely for server maintenance purposes.

Some of the protective measures we implement include:

• Applying modern methods of protection and access control to data sources containing personal data;
• Restricting access to sensitive data as well as limiting user accounts that may access certain data by implementing a role-based authorization system, ensuring that only designated employees who need access for their tasks can view and process the relevant data;
• Continuous monitoring of all resources (physical spaces where your data is stored) used for personal data processing.

The purpose of these measures is to prevent the risk of destruction, loss, alteration, unauthorized disclosure, or access to your personal data. We require third parties with access to and processing of your personal data to apply appropriate protective measures as well. All personal data is stored on our server in the Republic of Serbia. Please note that the above protective measures do not apply to information or data you choose to share publicly via social networks or messaging applications.

Personal data is retained only as long as necessary to achieve the purpose for which it was collected. If you have concluded a contract with us, data is retained for the duration of the rights and obligations under the contract, and thereafter as required by applicable laws. Your personal data may also be retained after the termination of the contractual relationship if it is needed for establishing, exercising, or defending legal claims or for compliance with applicable laws. Where possible, processing of your personal data will be restricted for these limited purposes after the contractual relationship ends. Once the purpose has been fulfilled, or the legally prescribed retention period has expired, personal data will be permanently deleted.

If you choose to exercise one or more of your rights listed below, we have the right to verify your identity to protect your personal data. Your rights are exercised free of charge. Exceptionally, if your request is manifestly unfounded or excessive (e.g., requesting personal data you already possess), especially if the request is repetitive, we have the right to charge the necessary costs for handling your request or to refuse to act on it. Please send all questions and requests regarding your rights in writing to the address provided in the "Data Controller" section. We will respond promptly, no later than within one month, unless the exceptional complexity of a specific case requires an extension. To protect you as the data subject, proper identification is required when submitting a request, ensuring that personal data is provided only to its rightful owner.

• Access to your personal data: You have the right to request information on whether we process your personal data, access to such data, and details of processing in accordance with Article 26 of the Law.
• Correction, completion, deletion, and restriction of personal data: You have the right to request correction of inaccurate personal data, as well as to complete, delete, or restrict the use of your personal data.
• Data portability: You have the right to obtain and request transfer of your personal data.
• Right to withdraw consent and the right to be forgotten: You have the right to withdraw your consent for personal data processing and request permanent deletion of personal data we have processed based on your consent.
• Objection to processing: You have the right to object to the processing of your personal data and, more generally, to our handling of your personal data. Please submit your objection via e-mail to the address provided in the "Data Controller" section, including “Objection to Processing” in the subject line and explaining the reason for your objection in the message.
• Right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection: You have the right to file a complaint at any time with the competent authority for personal data protection – the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/).

The Company reserves the right to modify this Privacy Policy at any time. Any changes become effective upon publication on the Company’s website or in another appropriate manner. Therefore, we recommend that you regularly review the Privacy Policy section to stay informed of the latest updates. Belgrade, 27.02.2026