Privacy Policy for Personal Data of Natural Persons

This document contains the Personal Data Security Policy for Natural Persons ("Policy") and is an integral part of the General Terms and Conditions. In the event that you do not agree with the General Terms and Conditions, it is not possible to use the Site https://www.maxon.bg/ and https://maxonhomes.com/ and to conclude contracts with MAXON EOOD. In the event of changes to the Policy, the changes will be published here.

Date of last update: 15 October 2026

This is a translation of the original text in Bulgarian. In the event of discrepancies between translations, the Bulgarian version shall prevail.

Your privacy is extremely important to us. This security policy discloses what personal data we collect from you through our relationship and how we use these data.

For the purpose of providing the Services on the websites https://www.maxon.bg/ and https://maxonhomes.com/ (the "Site") and concluding and performing contracts between us and you, MAXON EOOD ("WE"), UIC: 175115626, with registered office and management address: Sofia, 27 Veslets Street, processes data of natural persons ("Data Subjects" / "You"), in accordance with this Policy.

When processing personal data, MAXON EOOD complies with all statutory acts applicable to its activities concerning personal data protection and digital technologies, including, but not limited to, Regulation (EU) 2016/679 ("General Data Protection Regulation" / "Regulation" / "GDPR"), the Bulgarian Personal Data Protection Act (PDPA), and Regulation (EU) 2024/1689 (Artificial Intelligence Act / EU AI Act), because for us the security of personal data of our employees, clients, and users of the Site is of paramount importance. MAXON EOOD is a data controller with respect to the information collected during browsing and using the Site.

• Personal data under the Regulation means any information relating to you and through which you can be identified or are already identified.
• Processing of personal data ("Processing") means any operation or set of operations which can be performed on personal data by automated or other means.
• Controller means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

I. Categories of Data Subjects Whose Personal Data We Process

In connection with the provision of the Services on the websites www.maxon.bg and maxonhomes.com and the conclusion and performance of contracts between us and you, We process information regarding the following Data Subjects:

• Natural persons, users of the Site without registration.
• Natural persons, users of the Site with registration.
• Natural persons who have submitted inquiries (including via phone call), requests, alerts, or other correspondence to MAXON EOOD.
• Natural persons whose information is contained in inquiries (including via phone call), requests, alerts, or other correspondence addressed to MAXON EOOD.
• Natural persons with whom We conclude contracts – our employees, clients, partners, etc.

II. Personal Data We Process

1. Data That You Provide

It is impossible to provide Services on the websites www.maxon.bg and maxonhomes.com and to conclude and perform contracts (including civil, commercial, and employment contracts) between us and you if you do not provide us with certain information. You decide for yourself whether and how to use the Services of the Site and whether to conclude a contract with us. In the forms through which personal data are entered, we clearly indicate the mandatory or voluntary nature of providing the data. The data whose completion is mandatory are such without which it is impossible to provide the respective Service or part thereof and/or to conclude the respective contract:

• First and last name;
• Phone;
• Email address;
• Password for the Site;
• Your capacity – property owner, buyer, tenant, real estate agency, etc.;
• Information, text descriptions, photographs, and video materials of real estate properties provided in connection with the publishing of listings or brokerage activities.

2. Correspondence, Complaints, and Reports

For the purpose of responding to inquiries and requests made in communication to MAXON EOOD, received via electronic forms on the Site, via calls to the telephone exchange of MAXON EOOD, or via regular or electronic mail, We store and process this information, as well as the outcome of this processing.

The functionalities provided on the Site are not intended for the storage and processing of special categories of data within the meaning of Article 9 and Article 10 of the General Data Protection Regulation.

On the basis of your explicit consent, MAXON EOOD may also process other data relating to you in cases where you voluntarily provide such data by filling in the respective electronic form, adding preferences, settings, etc., for the purpose of an even more fruitful use of our Services.

3. Automatically Collected Technical Information and Logs

In addition, We collect information from your computer, phone, tablet, or other device that you use for our services provided on the Site. This information may include IP address, the browser used by you, and your language, date, and time settings. There are also situations in which we receive information from other partners of ours or automatically collect other information.

Quick links for repeating previous searches allow you to repeat your searches instead of entering them each time. The functionality can be used with or without registration. When using the Site, a cookie with a randomly generated number is stored in your browser, enabling the Site to show you quick links for repeating previous searches.

Logs are used on the Site for the following purposes:

• To ensure the reliable operation of the Services and detect technical problems;
• To ensure the security of the Services and detect malicious actions;
• For the development and improvement of the Services on the Site;
• To measure traffic to the Site.

III. Purposes for Which We Process Your Personal Data

Broadly speaking, we process your personal data for the purpose of providing the Services of the Site and performing contracts entered into between us and you. We also use your personal data to contact you and to inform you about our new proposals and special offers, as well as other services that we believe will be of interest to you.

MAXON EOOD collects, uses, and processes the information described above for the purposes set out in this Policy, which may be related to:

• Entering into and performing contracts between you and MAXON EOOD;
• Providing the Services of the Site;
• Protecting and enforcing the legitimate interests of other users of the services of the Site, third parties, and MAXON EOOD;
• Complying with legal obligations of MAXON EOOD;
• Informing you about our new proposals and special offers regarding which you wish us to send you information by email, post, mobile phone, and/or through other digital means, including through social media platforms;
• Your registration on the website or the application, in which case We will also use your personal information to enable you to maintain and update your account;
• Optimising, editing, and adapting advertising and informational materials for properties (including automated translation of texts into foreign languages and visual processing of images and videos using artificial intelligence technologies in order to ensure higher quality presentation of listings and erasure of personal details from photographs);
• Administering the website;
• Analysing and improving the use of our website;
• Measuring and analysing our advertising;
• Keeping our website, application, and network safe and secure.

Our legitimate interest in processing your personal data arises from the necessity to ensure the protection and preservation of the legitimate interests of MAXON EOOD and/or third parties, which is associated with:

• Ensuring the normal use of the Site by you and by other users, detecting and preventing malicious actions;
• Detecting and resolving technical or functionality issues, developing and improving the purpose of the Site;
• Communicating with you, including electronically, on important matters related to the use of the services of the Site and the performance of contracts entered into with you;
• Receiving and processing received inquiries, requests, and other correspondence;
• Exercising and protecting the rights and legitimate interests of MAXON EOOD, including through legal proceedings, and providing assistance in the exercise and protection of the rights and legitimate interests of other users of the Site and/or affected third parties;
• Improving the quality of presentation of listings on the Site, translating them for foreign clients, and complying with the data minimisation principle (by erasing accidentally captured personal items, individuals, or vehicle registration plates in visual materials).

Our legal obligations include compliance with statutory obligations to retain or provide information upon receipt of a relevant order from competent state or judicial authorities, to enable the exercise of supervisory powers by competent state authorities, and to fulfil obligations set forth in the General Data Protection Regulation concerning notifying you of various circumstances relating to your rights, the Services provided, or the protection of your data, and the like.

Your data may be processed on the basis of your explicit consent, in which case the processing is specific and within the degree and scope provided for in the respective consent.

We process anonymised data for statistical purposes – this means for analyses where the results are aggregated only and therefore the data is anonymous. Identifying a specific individual from this information is impossible.

IV. How Long Do We Retain Your Personal Data?

MAXON EOOD applies the general principle of retaining data in a minimal volume and for a period no longer than necessary for the performance of contracts entered into with you, for the provision of the Services of the Site, and for ensuring their security and reliability as well as statutory requirements.

In the event of an arising legal dispute or proceedings necessitating data retention and/or a request from a competent state authority, data may be retained for longer than the specified periods until the final conclusion of the dispute or proceedings before all instances. The specified periods may be amended if a different requirement for information retention is established under applicable legislation.

V. Do We Share Your Personal Data with Third Parties?

MAXON EOOD does not provide your personal data to third parties in any manner other than as described in this Policy and as provided for by law. In order to provide the best terms under contracts with our partners, We provide your personal data to:

• A competent state or judicial authority, if duly requested;
• Our clients and other users of the Site (when conducting brokerage activities and publishing listings);
• Our employees and professional advisors (accountants, lawyers, auditors);
• Persons for whom we have your explicit consent to provide your personal data;
• Third parties in view of protecting the rights and legitimate interests of MAXON EOOD and/or other users of the Site;
• Our third-party advertisers;
• Search engine providers, cloud services, web analytics, and technology providers of software solutions (including certified providers of artificial intelligence tools for automated translation and multimedia processing acting as data processors under agreements entered into pursuant to Article 28 of the GDPR).

In our work with the above-mentioned categories of persons to whom we provide your personal data, WE require them to strictly comply with our instructions in accordance with this Policy.

In the event of a merger, acquisition, or sale of assets affecting the processing of personal data, you will be notified in advance.

You should note that if we are requested by the police or by another regulatory or state authority investigating suspected unlawful activities to provide your personal information or other information we receive about you, we have the right and legal obligation to do so.

Our website and the application may contain links to and from the websites of third parties – such as Facebook, Instagram, YouTube, LinkedIn, X (Twitter), etc. If you follow a link to any of these websites, please note that they have their own privacy policies and that We do not accept any responsibility or liability for these policies. Please check these policies before you submit information to these websites.

The information that we collect from you may be transferred to and stored outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. In this case, the transfer of data is carried out solely where an adequacy decision by the European Commission is in place (e.g. the EU-US Data Privacy Framework) or upon the implementation of Standard Contractual Clauses (SCC) and other appropriate safeguards pursuant to Chapter V of the Regulation.

VI. Your Rights Regarding Personal Data

Under the General Data Protection Regulation, you have the following rights, which you may exercise by sending an email to office.sf@maxon.bg with an attached request to that effect:

• Right to be informed: This Policy aims to inform you in detail about the processing of your personal data.
• Right of access: You have the right to obtain confirmation as to whether your personal data are being processed, access to them, and information regarding the manner of their processing and your rights in relation thereto.
• Right to rectification: You have the right to rectify and complete your personal data in the event that they are incomplete or inaccurate.
• Right to erasure (the "right to be forgotten"): You have the right to request the erasure of data, except where there is an overriding legal ground and/or a statutory obligation for their processing.
• Account closure: If you wish, you have the option to close your account at any time by submitting a request. Following account closure, all data that are part of it are erased in compliance with the rules set out in the section "How long do we store your personal data?" of this Policy.
• Right to restriction of processing: The General Data Protection Regulation provides for the possibility to restrict the processing of your personal data if the grounds provided for therein exist.
• Right to notification of third parties: Where applicable, you have the right to request the Controller of your personal data to notify third parties to whom it has disclosed your data regarding any rectification, erasure, or restriction of processing of your personal data.
• Right to data portability: You have the right to receive the personal data concerning you, which you have provided, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent or a contractual obligation and is carried out by automated means. (Important: Responsibility for storing data exported from the Site, as well as for all consequences of providing them to other controllers, lies entirely with you.)
• Right not to be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. When providing the Services on the Site, technologies for automated decision-making without human intervention are not used.
• Right to withdraw consent: You have the right to withdraw your consent at any time where personal data are processed on the basis of your consent. Such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
• Right to object: You have the right to object to data processed on the basis of legitimate interest. In the event of receiving such an objection, We will examine your request and, if well-founded, comply with it. If we consider that there are compelling legitimate grounds for the processing or that it is necessary for the establishment, exercise, or defence of legal claims, we will inform you accordingly.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the supervisory authority if you consider that the processing of personal data relating to you infringes applicable personal data protection legislation. The supervisory authority in the Republic of Bulgaria is the Bulgarian Commission for Personal Data Protection (CPDP), address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., website: www.cpdp.bg.

In the event that you exercise these rights manifestly unfoundedly or excessively, in particular because of their repetitive character, MAXON EOOD reserves the right to charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

VII. Accuracy of Information

MAXON EOOD is not responsible for the accuracy of the data provided by you, does not carry out checks to this effect, and does not guarantee the actual identity of the natural persons who provided the data. In all cases of doubts on your part, identified fraud, and/or abuse, please notify us immediately. When providing any information on the Site, you undertake not to violate the rights of other persons in connection with the protection of their personal data or their other rights.

VIII. How We Protect Your Personal Data

In order to ensure the best possible protection of the data of the company and its employees, clients, and users of the Site, We apply all necessary organizational and technical measures provided for in the General Data Protection Regulation and the Bulgarian Personal Data Protection Act, as well as best practices from international standards.

The company has adopted the necessary rules and procedures related to the lawful processing of your personal data, including a Personal Data Breach Action Plan, and has established structures for the prevention of abuse and security breaches that support the processes of lawful processing, preservation, and security of your data.

For maximum security during the processing, transmission, and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.

IX. Use of Artificial Intelligence (AI) Systems in Material Processing and Translation

In accordance with the transparency requirements under Regulation (EU) 2024/1689 (Artificial Intelligence Act / EU AI Act), Regulation (EU) 2016/679 (GDPR), and Bulgarian legislation, MAXON EOOD informs you that artificial intelligence (AI) software technologies are used in the preparation, editing, and presentation of part of the materials and content on the Site and the company's advertising channels.

1. Scope and Purposes of AI Use

• Editing and enhancement of images and video materials: AI tools are used for graphic processing of photos and videos of real estate properties (lighting, color, and resolution correction), virtual staging, illustrative architectural visualization, as well as for the protection of privacy through automated blurring or removal of third parties, personal belongings, photographs, or vehicle registration plates accidentally captured in the frame.
• Translation and language adaptation of text: AI language models are used for automated translation of property descriptions, offers, and informational materials into foreign languages, as well as for stylistic and grammatical editing of texts to ensure better readability and accessibility for Bulgarian and foreign clients.
• Audio-visual advertising materials: Some of the promotional videos and musical accompaniment for presenting locations and properties may include elements generated or processed with the help of AI, which are appropriately labelled in accordance with Article 50 of Regulation (EU) 2024/1689, where applicable.

2. Safeguards for Personal Data Protection When Using AI

• Data minimisation: Prior to processing texts or images via external AI tools, the employees of MAXON EOOD do not enter directly identifiable personal data of clients (such as Personal Identification Numbers (EGN), full names, exact personal addresses from identity documents, telephone numbers, or financial details), unless strictly necessary for the performance of a specific service requested by you.
• No biometric processing: The AI image processing systems we use do not perform biometric identification, facial recognition, or categorization of natural persons.
• Protection against use for training public models: When using cloud-based AI platforms, We select business or enterprise settings that restrict the use of submitted data for training public artificial intelligence models.
• Human oversight (Human-in-the-loop): All materials (translations, texts, and edited images) that have undergone AI processing are subject to review and approval by an employee of MAXON EOOD prior to publication. The AI systems are not used for automated decision-making or profiling within the meaning of Article 22 of the GDPR that would produce legal effects concerning you.

X. Cookie Policy

As an integral part of this Personal Data Security Policy for Individuals, MAXON EOOD has also adopted a Cookie Policy.

XI. Contacts

Questions and requests regarding the exercise of your personal data protection rights may be addressed to MAXON EOOD:

• Mailing address: Sofia, 27 Veslets Street
• Email: office.sf@maxon.bg
• Tel.: 02 868 8776
• Contact person: Krasimira Semova