Privacy Policy

On this page, you will find all the information regarding what personal data we collect, how we use it, and with whom we may share it. We will also explain your rights in connection with the GDPR and how you can exercise them.

Next Prestige Real Estate LLC, with its registered office at Office 2204, The Court Tower, Marasi Drive, United Arab Emirates, License No: 1496868, Registered At Real Estate Regulatory Agency No: 50541, acting as the data controller, hereby informs you as a client or website user about the collection of personal data and privacy policies described below.

In the text below, you will specifically learn:

• What personal data of yours we will process.

• For what purposes and in what manner we will process your personal data.

• To whom your personal data may be transferred.

• For how long we will process your personal data.

• What rights you have in relation to the protection of your personal data.

• The principles of personal data processing.

If you need any part of the text explained, require advice, or wish to discuss the further processing of your personal data, you can contact us at any time via email at info@nextdubai.cz.

Processing the Personal Data of Children

Our website is not intended for children under 16 years of age. We do not process the personal data of children under 16 years of age.

Scope of Personal Data Processing

Next Prestige Real Estate LLC processes the following information about its clients:

• Identification and contact details – specifically name, surname, title, date of birth, permanent residence or contact address, e-mail, and telephone number.

• Contact details – permanent residence or contact address, e-mail, and telephone number.

• Data required for the preparation of contractual documentation – for the purpose of creating contractual documentation, the interested party fills out a (KYC) KNOW YOUR CUSTOMER FORM – STRICTLY CONFIDENTIAL, which contains name, surname, copy and information from an ID card, copy and details from a passport, telephone contact, e-mail address, a declaration of whether the interested party is a PEP (Politically Exposed Person), birth number/national identification number (for self-employed individuals: business name, place of business, and ID No.), citizenship, marital status, bank account number, and verification that you are not a person subject to international sanctions by the CR/EU.

Next Prestige Real Estate LLC does not process special categories of personal data (so-called sensitive data) about its clients, and no automated decision-making or profiling takes place.

Purpose of Processing

We use the data you provide to us:

• Primarily for the purpose of processing a business opportunity for the purchase of a selected property from the NEXT DUBAI portfolio.

• We may also use your name, surname, and e-mail address to send you commercial communications, i.e., to inform you about events, news, or services we provide that we believe might be of interest to you. You can refuse the processing of your personal data for the purpose of sending commercial communications at any time, and this will not affect our other mutual relationships. You simply need to send an e-mail with the relevant request to the address from which you received the commercial communication.

Lawfulness of Processing according to Art. 6 GDPR

According to Article 6 of the Regulation, the aforementioned personal data is processed based on:

• point 1(b) processing is necessary for the performance of a contract to which the data subject (client) is party or in order to take steps at the request of the data subject prior to entering into a contract;

• point 1(c) processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., Act No. 253/2008 Coll.);

• point 1(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (e.g., sending marketing communications).

Who Has Access to Your Personal Data

We may transfer your personal data to our subcontractors for the above-mentioned purposes so they can process it for us. Personal data may be transferred to:

• cooperating real estate brokers

• an external law firm

• cooperating mortgage advisors

• an external accountant

• processors who provide the Controller with server, web, cloud, or IT services, or who are its business partners

• a tax advisor and supervisory authorities

Furthermore, the Controller uses the following applications and systems of these entities, and their privacy policies are available at the respective links:

Google (including YouTube) Company: Google Ireland Limited Registration number: 368047 Registered office: Gordon House, Barrow Street, Dublin 4, Ireland Privacy Policy: policies.google.com/privacy?hl=en YouTube Policy: support.google.com/youtube/answer/10364219?hl=en

Facebook (including Instagram) Company: Facebook Ireland Limited Registration number: 462932 Registered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02 X525, Ireland Privacy Policy (Facebook): www.facebook.com/privacy/policy/ Privacy Policy (Instagram): privacycenter.instagram.com/policy/

LinkedIn Registered office: Sunnyvale, 940 85 USA Privacy Policy: cz.linkedin.com/legal/privacy-policy

Ecomail.cz Registered office: Na Zderaze 15, 120 00 Prague 2 Company ID No.: 02762943 Privacy Policy: www.ecomail.cz/zasady-zpracovani-osobnich-udaju

Seznam.cz Company: Seznam.cz, a.s. Registered office: Radlická 3294/10, 150 00 Prague 5 Company ID No.: 26168685 Privacy Policy: o.seznam.cz/ochrana-udaju/

Transfer of Data Outside the EU and EEA

As our client, we inform you that in connection with the subject of selling real estate outside the EU, your personal data will also be transferred to participating controllers outside the EU region.

Duration of Personal Data Processing

We will process your personal data for the duration of providing our services to you or fulfilling a mutual contract, or for the time necessary to fulfill archiving obligations under applicable legal regulations, such as the Accounting Act, the Archives and Records Management Act, or the Value Added Tax Act, but for no longer than 10 years after the termination of the provision of services or contractual performance.

Your Rights Arising from Personal Data Processing

In relation to the processing of your personal data carried out by us, you have the following rights:

• right to be informed

• right of access to personal data

• right to rectification

• right to erasure (“right to be forgotten”)

• right to restriction of processing

• right to object to processing

• right to lodge a complaint regarding the processing of personal data

Your rights are explained below so that you can have a clearer idea of their content. You can exercise all your rights by contacting us at the e-mail address info@nextdubai.cz. You can lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection in the Czech Republic (www.uoou.cz).

• The Right to be Informed means you have the right to be provided with clear, transparent, and easily understandable information about your rights and how we use your personal data. This right is fulfilled by this Privacy Policy.

• The Right of Access means you have the right to access your personal data (if we are processing it) and other personal information (similar to that provided above). This is so you are aware and can verify whether we are using your personal data in accordance with data protection laws.

• The Right to Rectification means you have the right to have your processed personal data corrected if it is inaccurate or incomplete.

• The Right to Erasure, also known as the “right to be forgotten,” means you can request the deletion or removal of your personal data where there is no compelling reason for its continued processing. However, this is not an absolute right – we may still have a right or obligation to retain your personal data, for example, in cases where we have a legal obligation to do so, or if we have another valid reason for its retention.

• The Right to Restriction of Processing means that in certain situations, you have the right to “block” or suppress the further use of your personal data by us. When processing is restricted, we can still store your data, but we may not use it further. We keep lists of people who have asked for the further use of their data to be blocked to make sure the restriction is respected in the future.

• The Right to Object means you have the right to object to certain types of personal data processing, including processing for the purposes of direct marketing.

Principles of Personal Data Processing

• We always process all personal data lawfully, fairly, transparently, and responsibly.

• Processing is purpose-limited, meaning we process personal data only for specified, explicit, and legitimate purposes, and personal data is not further processed in a manner that is incompatible with those purposes.

• In the context of data minimization, we process adequate, relevant, and limited personal data to the extent necessary in relation to the purpose for which the personal data is processed.

• We process accurate and updated personal data – if personal data is inaccurate, we will ensure its correction or eventual deletion, for which we may require your necessary cooperation.

• We keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.

• We ensure that all our IT systems and other repositories where personal data is stored are protected against unauthorized access to information (e.g., via a firewall, anti-virus protection, strict password requirements, system logins, etc.).

• We ensure that all documents containing personal data are protected against access by unauthorized persons. These documents are kept in lockable cabinets, in lockable offices, or secured by other similar security means (electronic security systems, safes, etc.).