1. Introduction

GREEN COAST Ltd. (“the Company”) is pleased to welcome you to the section dedicated to our personal data processing practices (the “Privacy Policy”).

For the purposes of this Privacy Policy, “Personal Data” means any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to that person’s physical, physiological, mental, economic, cultural or social identity, including photographic images (hereinafter referred to as “Personal Data” or “Data”).

In carrying out their professional duties, the employees of GREEN COAST Ltd. process Personal Data with the utmost care, responsibility and confidentiality, in accordance with Law No. 124, dated 19 December 2024, “On the Protection of Personal Data.”

2. Data Controller

For the purposes of Article 5 of Law No. 124, dated 19 December 2024, “On the Protection of Personal Data,” the Data Controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

GREEN COAST Ltd. acts as the Data Controller in relation to the Personal Data collected and processed through its website, the data processed in connection with its sales activities and the services it provides, recruitment and human resources processes, as well as the handling of complaints.

GREEN COAST Ltd. has entered into a contractual relationship with Balfin Real Estate Sh.p.k. for the purposes of marketing and facilitating the sale of real estate forming part of the Company’s projects. Accordingly, Balfin Real Estate Sh.p.k. acts as a Data Processor on behalf of the Controller for such processing activities.

For the purposes of managing relationships with job applicants and employees, GREEN COAST Ltd. has engaged Balfin Development Sh.p.k., a limited liability company incorporated under the laws of the Republic of Albania, registered with the National Business Centre under registration number (NIPT) M22119033A, with its registered office at Rruga “Tish Daija”, Kika 2 Complex, Building 3, Floor 1, as a Data Processor responsible for collecting and processing Personal Data submitted by individuals through the communication channels made available on this website.

The Data Controller is GREEN COAST Ltd., while the principal Data Processors are Balfin Real Estate Sh.p.k. and Balfin Development Sh.p.k. with respect to:

• Personal Data collected and processed through the Company’s website;

• Personal Data processed in connection with sales activities and the provision of services;

• Personal Data processed through telephone communications and social media channels for customer service and marketing purposes;

• Personal Data processed through the Zoho platform, provided by Zoho Corporation B.V., established in the Netherlands, pursuant to a service agreement, for recruitment and human resources purposes; and

• Personal Data processed through the Odoo CRM system, provided by Odoo S.A., having its registered office at Chaussée de Namur 40, 1367 Grand-Rosière, Belgium, pursuant to a service agreement, through which Balfin Real Estate Sh.p.k. manages its business operations and workflows.

In addition, HubSpot Ireland Limited, established in Ireland, acts as a Data Processor in its capacity as the provider of the HubSpot CRM platform, which is used for customer relationship management (CRM), contact management, website forms, marketing communications, marketing automation and other activities related to customer relationship management.

Data Controller and Data Processors

Data Controller

GREEN COAST Ltd.

Personal Data may also be processed by the following third parties acting as Data Processors within the meaning of the applicable data protection legislation:

• Balfin Real Estate Sh.p.k.

• Balfin Development Sh.p.k.

• Zoho Corporation B.V.

• Odoo S.A.

• HubSpot Ireland Limited (Ireland)

These Data Processors process Personal Data solely in accordance with the instructions of the Data Controller and under contractual arrangements that ensure the protection of Personal Data.

Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer (DPO) in accordance with the applicable personal data protection legislation. The DPO is responsible for monitoring the Company’s compliance with the legal requirements governing the processing of Personal Data.

4. Categories of Personal Data Processed

GREEN COAST Ltd. and Balfin Real Estate Sh.p.k. are committed to providing you with ongoing and transparent information regarding the nature of the Personal Data we process, the methods and purposes of such processing, the security measures applied, and your rights as a Data Subject.

As a general principle, Personal Data is collected directly from you and, where required by law, on the basis of your consent as the Data Subject.

In carrying out their business activities, GREEN COAST Ltd. and its branches process the following categories of Personal Data:

• Prospective Clients: In order to respond to enquiries relating to property offers, pricing and other information of interest, the Data Controller may process identification data, residential address, personal identification number, telephone number and email address.

• Job Applicants: Through the “Careers” section of the Company’s website, where vacant positions are published, applicants may submit their Curriculum Vitae (CV) and cover letter through the relevant job advertisement. During the recruitment process, the Company may process Personal Data including first name, last name, email address, telephone number, date of birth (where included in the CV), photograph, as well as information relating to professional qualifications, education and work experience.

Applications and Personal Data are processed electronically through the Zoho recruitment platform, provided by Zoho Corporation B.V., established in the Netherlands (EU), pursuant to a service agreement. The platform ensures the security and confidentiality of Personal Data in accordance with the highest standards required under European Union data protection legislation.

Such Personal Data is accessible electronically only to authorised recruitment specialists and the Human Resources Director of Balfin Development Sh.p.k., who are responsible for candidate screening, interviewing, reviewing application documents and communicating with successful candidates.

• Employees: The Company may process Personal Data including first name, last name, email address, telephone number, educational background, professional qualifications, work experience, professional achievements, photographs and images. Such Personal Data may be accessed or published only with the employee’s prior consent in connection with various corporate events, promotional activities and internal communications.

• Interested Persons / Website Visitors: Through the “Contact” section of the Company’s website, visitors may request information regarding the Company’s services, submit complaints or request professional assistance. For these purposes, the Company may collect first name, last name, email address, telephone number, nationality status (whether the individual is an Albanian citizen or not, through a “Yes/No” option used solely for statistical purposes), and the content of the message submitted.

• Business Partners and Collaborators: In connection with corporate publications, press releases or public relations activities, the Company may publish information relating to events closely connected with the business activities of GREEN COAST Ltd., including non-individual photographs.

• Employees and Visitors: Personal Data may also be processed through the Company’s Closed-Circuit Television (CCTV) system.

CCTV processing is carried out:

o for the purposes of ensuring physical security and protecting Company property;

o on the basis of the Company’s legitimate interests; and

o for a limited retention period in accordance with the Company’s data retention policy and technical storage capacities.

Data Subjects are informed of the presence of CCTV cameras through appropriate signage displayed within the monitored premises.

• Prospective Clients: Individuals who express an interest in the Company’s services by contacting the Company via telephone, email, the website or social media channels may voluntarily provide Personal Data such as their first name, last name, telephone number and/or email address.

The Personal Data collected is processed solely for the exclusive purposes of GREEN COAST Ltd. and in accordance with this Privacy Policy.

5. Purposes of Processing Personal Data

The purposes for which your Personal Data is processed depend on the nature of your relationship with GREEN COAST Ltd., Balfin Real Estate Sh.p.k., and the services provided by the Company.

Personal Data and information collected through the Company’s website may be processed for the following purposes:

– to respond to enquiries submitted by prospective clients regarding properties, including offers, pricing and other information of interest;

– to advertise and promote properties that may be of interest to prospective clients wishing to purchase or lease real estate;

– to establish and develop new contractual relationships with prospective clients;

– to contact clients following the sale or lease of properties and to provide information regarding other projects, services or investment opportunities that may be of interest;

– to manage the recruitment and selection process for job applicants, including the review of applications, interviews and the recruitment of suitably qualified professionals;

– to provide the Company’s services and promote its projects through marketing and analytical activities.

For these purposes, GREEN COAST Ltd. may process Personal Data in order to:

– analyse the preferences and interests of Data Subjects (limited profiling);

– send marketing communications, promotional materials and personalised offers through various communication channels, including email, telephone and social media.

Such processing is carried out on the basis of the applicable legal basis, namely the Data Subject’s consent or the Company’s legitimate interests, as appropriate.

Data Subjects have the right to object at any time, free of charge and without adverse consequences, to the processing of their Personal Data for direct marketing purposes by using the contact details provided in this Privacy Policy.

6. Processing of Personal Data

GREEN COAST Ltd. processes Personal Data lawfully and fairly, in accordance with the requirements of Law No. 124, dated 19 December 2024, “On the Protection of Personal Data.”

Personal Data is processed only where there is a valid legal basis for such processing.

The Company processes Personal Data only where one of the following legal bases applies:

• Consent – where the Data Subject has freely given specific, informed and unambiguous consent to the processing of their Personal Data, particularly in their capacity as a client, job applicant, employee, agent, interested person or contact of GREEN COAST Ltd.;

• Performance of a Contract – where processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract. This includes situations where the Data Subject is a client (seller, buyer, landlord or tenant), employee or another party involved in a transaction with the Company;

• Compliance with a Legal Obligation – where processing is necessary for compliance with legal and regulatory obligations applicable to the Company, including obligations arising under commercial, civil, employment, tax and banking legislation, as well as legislation concerning the prevention of money laundering and terrorist financing;

• Legitimate Interests – where processing is necessary for the legitimate interests pursued by the Data Controller, provided that such interests are not overridden by the fundamental rights and freedoms of the Data Subject. This includes, in particular, processing carried out for security purposes (such as CCTV surveillance), customer relationship management and business analysis.

Where the processing of Personal Data is based on the Data Subject’s consent, the Data Subject has the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of any processing carried out prior to its withdrawal.

7. Use of Cookies

Our website uses cookies and similar technologies to ensure the proper functioning of the website and to enhance the user experience.

The cookies used on our website include:

– Essential cookies, which are necessary for the operation of the website;

– Analytical cookies, which are used for statistical analysis and website performance monitoring;

– Marketing cookies, which enable the delivery of personalised content and promotional offers.

Visitors may manage or modify their cookie preferences through the cookie banner displayed when they first access the website.

8. Data Retention

Your personal data will not be retained in a form that permits your identification for longer than is necessary for the purposes for which it is processed, in accordance with the Company’s contractual, legal and regulatory obligations.

More specifically, personal data is retained for the following periods:

– Customer data, processed within the framework of contractual relationships and brokerage activities, is retained for a period of 10 years following the termination of the business relationship, in accordance with Law No. 9917, dated 19 May 2008, “On the Prevention of Money Laundering and Terrorist Financing”, as amended. Where requested by the competent authorities, this retention period may be extended in accordance with the applicable legislation.

– Job applicant data is retained until the completion of the recruitment process. Where the data subject has provided consent, such data may be retained for a longer period (e.g. up to 12 months) for the purpose of considering the applicant for future employment opportunities.

– Employee data is retained throughout the duration of the employment relationship and for up to 2 years following its termination, for the purposes of establishing, exercising or defending legal claims, unless a longer retention period is required under applicable law.

– Data relating to enquiries submitted by website visitors or other interested individuals, collected for the handling of requests or complaints, is retained for as long as necessary to process such requests and, in any event, for no longer than 30 days following the completion of the relevant process.

– Business partner and collaborator data is retained throughout the duration of the business relationship and for up to 5 years following its termination, for the purposes of complying with legal obligations and establishing, exercising or defending legal claims.

– Agent data is retained throughout the duration of the contractual relationship and for up to 2 years following its termination for the purposes of managing contractual relationships and protecting the Company’s legitimate legal interests.

– Training participant data is retained for the duration of the participant’s functional relationship with the Company and is deleted upon its termination, unless a longer retention period is required by applicable law.

– Personal data collected through the CCTV system is retained for a maximum period of 60 days, unless a longer retention period is required for investigative purposes by the competent authorities.

– Personal data collected through the Company’s website, telephone communications or social media channels for direct marketing purposes is retained for no longer than 60 months, or until the data subject withdraws his or her consent, whichever occurs first.

9. Security Measures

The security of personal data is fundamental to protecting information, maintaining its integrity and ensuring compliance with applicable legal and ethical standards. The Company conducts its activities in accordance with the applicable legislation on personal data protection and has implemented the policies, procedures and technical and organisational measures necessary to ensure an appropriate level of security.

We have implemented appropriate technical and organisational security measures to reduce the risk of personal data breaches and the misuse of your personal data, including unauthorised access, disclosure, alteration or destruction.

We are committed to safeguarding the privacy of your personal data by ensuring that personal data is processed lawfully, fairly and transparently, and, where required, that your informed consent is obtained prior to the collection and processing of your personal data. Data subjects are entitled to exercise the rights provided under the applicable data protection legislation, including the right of access, rectification and erasure.

To protect personal data and preserve the integrity of our processing activities, we implement, among others, the following security measures:

– Secure data storage – We use encrypted storage solutions and databases with restricted access to protect personal data.

– Access control – We apply strict access control measures to ensure that only authorised personnel have access to personal data and only to the extent necessary to perform their duties, including viewing, modifying or deleting specific information.

– Secure communication channels – We use secure communication channels, including encrypted email services where appropriate, to protect information exchanged against interception or unauthorised access.

– Physical security – The facilities and equipment where personal data is stored are located in secure environments with restricted physical access (e.g. locked rooms and controlled access premises).

– Technical security measures – We implement firewalls, strong password policies, antivirus software, encryption, pseudonymisation and other appropriate technical safeguards to protect personal data.

– Data retention and secure disposal policy – We maintain policies governing the retention periods applicable to personal data and its secure deletion or destruction once retention is no longer necessary, thereby reducing the risk of unauthorised access to obsolete or unnecessary data.

– Data protection and security training – Prior to commencing their duties, relevant personnel receive training on personal data protection requirements and are regularly updated on the Company’s security standards, internal policies, best practices and data handling procedures to ensure ongoing compliance with applicable legal requirements.

10. Recipients of Your Personal Data

Your personal data may be disclosed only to the following categories of recipients:

• Authorised personnel and employees of GREEN COAST sh.p.k., Balfin Real Estate Sh.p.k. and Balfin Development sh.p.k., who process personal data solely within the scope of their duties and only for the purposes described in this Privacy Policy.

• Service providers (Data Processors) engaged by the Company to support the management of our relationship with you, including providers of communication services, electronic document management systems and customer relationship management (CRM) platforms, such as Odoo, Zoho, and HubSpot.

Odoo is certified under ISO/IEC 27001:2013, the internationally recognised standard for Information Security Management Systems (ISMS). This certification demonstrates that Odoo has implemented appropriate technical and organisational measures to safeguard information by ensuring its confidentiality, integrity and availability.

These service providers process personal data on behalf of the Company and are considered Data Processors within the meaning of the applicable personal data protection legislation.

• Competent public authorities, including but not limited to the Tax Administration, Social Insurance Institute, Labour Inspectorate, judicial authorities and other public bodies, where disclosure is required by applicable law or pursuant to a duly justified request from the competent authority.

• Banks and financial institutions with which we cooperate for the provision of our services.

Balfin Real Estate Sh.p.k. ensures that all personal data is processed in accordance with Law No. 124, dated 19 December 2024 “On Personal Data Protection”, the secondary legislation adopted pursuant thereto, and applies security and confidentiality standards equivalent to those applied within the European Union (EU) and the European Economic Area (EEA).

Employees of GREEN COAST sh.p.k., Balfin Real Estate Sh.p.k. and Balfin Development sh.p.k. are bound by confidentiality obligations and have signed confidentiality undertakings requiring them to maintain the confidentiality of all personal data to which they have access during the performance of their duties. Appropriate disciplinary and contractual measures apply in the event of any breach of these obligations.

Under no circumstances will your personal data be sold or otherwise disclosed for commercial purposes to third parties.

11. International Transfers of Personal Data

In the course of providing our services and operating electronic systems (including CRM systems, recruitment platforms and other business applications), your personal data may be transferred to and processed outside the territory of the Republic of Albania.

Such transfers take place only where:

– the recipient country has been recognized as ensuring an adequate level of protection for personal data; or

– appropriate safeguards have been implemented in accordance with applicable data protection legislation, including Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms entered into between the Data Controller and the relevant Data Processors.

In all cases, the Company implements the necessary technical, organizational and contractual measures to ensure that your personal data remains adequately protected in accordance with the applicable personal data protection legislation.

12. Your Rights

Pursuant to Articles 13 et seq. of Law No. 124, dated 19 December 2024 “On Personal Data Protection”, and the secondary legislation adopted thereunder, you enjoy a number of rights in relation to your personal data and may request additional information regarding its processing at any time.

With respect to the personal data processed by GREEN COAST sh.p.k. and/or Balfin Real Estate Sh.p.k., you are entitled to exercise the following rights:

• Right of Access – You have the right to obtain confirmation as to whether your personal data is being processed and, where that is the case, to access such personal data together with information regarding the purposes of processing, the retention period, the legal basis for processing, the categories of personal data concerned and the categories of recipients to whom the data has been disclosed.

• Right to Rectification, Restriction or Erasure – Where your personal data is inaccurate, incomplete, unlawfully processed or otherwise processed in breach of applicable legislation, you have the right to request its rectification, restriction of processing or erasure, as applicable.

• Right not to be Subject to Automated Decision-Making – You have the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you, except where otherwise permitted by applicable law.

• Right to Object – Under certain circumstances, you have the right to object to the processing of your personal data for specific purposes, in accordance with the applicable provisions of Law No. 124/2024.

• Right to Lodge a Complaint – If you believe that your rights under the applicable personal data protection legislation have been violated, you may submit a complaint in writing to the Company using the contact details published on our website.

• Right to Compensation – If you suffer material or non-material damage as a result of unlawful processing of your personal data, you are entitled to seek compensation in accordance with the applicable provisions of the Civil Code.

To protect your personal data against unauthorized access, any request submitted for the exercise of your rights must be signed and accompanied by a valid copy of your identification document.

Requests should be submitted in writing to: Email: sales@greencoast.com

The Company will respond within 30 days of receipt of your request by providing the requested information or explaining the reasons why the request cannot be fulfilled, in whole or in part.

If you are not satisfied with the Company’s response, you have the right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data, located at Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania. Further information is available on the Commissioner’s official website at www.idp.al.

Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.

To withdraw your consent, please contact us at: Email: sales@greencoast.com

13. Changes to this Privacy Policy

We regularly review and update this Privacy Policy to ensure that it remains accurate, complete and up to date. We reserve the right to amend or modify its contents whenever this is considered necessary, including to reflect changes in applicable legislation, our processing activities or our internal business practices.

Any updates or amendments to this Privacy Policy will be communicated in a timely manner through our website, in accordance with the principle of transparency.