1. General provisions
Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (GDPR) – has been in force since May 25, 2018. Its purpose is to ensure a higher level of protection of personal data of individuals in all Member States of the European Union and to harmonise the rules for their processing.
As a personal data controller in the provision of intermediary services in the sale, purchase, rental, and letting of real estate, Next Level Properties Ltd. ("Next Level," the "company" or "controller") complies with the requirements of the GDPR and processes personal data only to the extent necessary to provide the services, applying all necessary measures for their lawful and secure protection.

2. Information about the personal data administrator
Name: Next Level Properties Ltd.
UIC: 204316542
Registered office and address of management: Sofia, 1330, 37B Usta Gencho St., Entrance B, Floor 1 Manager: Mariana Stoyanova
Phone / WhatsApp / Viber: +359 87 789 5751
Email: office@nextlevel-broker.com
The company performs professional intermediary activities in real estate transactions on the territory of Bulgaria.
The company provides professional brokerage services for real estate transactions in Bulgaria.

3. Purpose of this policy
The purpose of this policy is to provide you with clear and transparent information about:
what personal data we collect and why;
on what legal basis we process it;
how we ensure its security;
what rights you have in relation to its processing.
The policy covers the entire activity of the company, including the use of all its websites, regardless of how the data is collected – through the conclusion of a contract, online registration or other method.

4. Key terms
Personal data: information by which a natural person can be directly or indirectly identified.
Personal data processing: any action related to personal data – collection, storage, use, transfer, modification, destruction, etc.
Personal data controller: the person or organization that determines the purposes and means of data processing.
Personal data processor: a person or organization that processes personal data on behalf of the controller.
Supervisory authority: in Bulgaria, this is the Commission for Personal Data Protection (CPDP) – www.cpdp.bg.

5. Principles of personal data processing
Next Level adheres to the following principles:
Lawfulness, fairness, and transparency in processing;
Purpose limitation – we process data only for specific and legitimate purposes;
Data minimization – we collect only the information that is necessary;
Accuracy and timeliness – we keep the data accurate and correct it when necessary;
Storage limitation – we store data only for the necessary periods;
Security and confidentiality – we implement technical and organizational measures for protection;
Accountability – we can demonstrate compliance with the above principles.

6. Purposes and grounds for processing personal data
6.1. Performance of a contract or pre-contractual relations
We process personal data when necessary for:
identify the customer;
prepare offers, contracts, and related documents;
conduct negotiations and conclude transactions;
issue invoices and collect payments;
provide full brokerage services for real estate transactions.
6.2. Compliance with legal obligations
Data is processed to comply with regulatory requirements, including:
identifying customers under the Anti-Money Laundering Act;
requirements of accounting, labor, and tax and social security legislation;
provision of information to competent authorities by law.
6.3. Processing based on consent
In certain cases, we process data only with explicit consent – for example, for marketing communications, advertising, or the use of specific online functionalities. Consent may be withdrawn at any time without affecting the lawfulness of previous processing.
6.4. Legitimate interest
We may process data to protect legitimate interests, such as protection in court or administrative proceedings.

7. Types of data we process
Depending on the purposes, we may process:
names, personal identification number/foreign national identification number, data from identity documents;
permanent and correspondence address;
telephone number, email address, social media profiles;
bank details;
data related to service preferences;
technical information – IP address, device type, etc.
We do not collect sensitive data such as information about ethnic origin, religious beliefs, health status, biometric or genetic data.

8. Security measures

We apply a combination of organizational, physical, and technological measures to protect data—restricted access to information, encryption, password protection, and access tracking protocols. Data is stored on secure servers and in a CRM system with access control.

9. Storage periods
Data related to contracts – 5 years after the end of the contract or transaction;
Data for accounting purposes – in accordance with the legal deadlines (up to 50 years for payroll records);
Job applications – 1 year;
Pending proceedings – until their completion;
Data may be anonymized where applicable.

10. Sharing of personal data
Data is only provided when necessary and to persons such as:
counterparties to transactions;
service providers (accounting, IT, maintenance, etc.);
partners and subcontractors;
government authorities, when required by law.
In all cases, adequate protection and confidentiality of data is guaranteed.

11. Your rights
Right to information – about what data is processed and why;
Right to correction – of inaccurate or incomplete data;
Right to object – to processing or direct marketing;
Right to restrict processing – in cases provided for by law;
Right to portability – to receive your data in a structured format;
Right to complain – to the Personal Data Protection Commission or a competent authority in the EU.

12. Changes to the policy
This policy is updated periodically in view of legislative changes or the implementation of new protection measures. We recommend that you regularly review the current version on our website.

31/01/2023