Maxon
BuySell
Enquire

Maxon

Privacy and Personal Data Protection Policy

This Privacy and Personal Data Protection Policy ("Policy") sets out the terms and conditions under which MAXON EOOD processes and protects the personal data of natural persons when using the websites https://www.maxon.bg/ and https://maxonhomes.com/ ("the Sites"), as well as in carrying out its activities of real estate brokerage, property management, and related consulting services, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Bulgarian Personal Data Protection Act (PDPA), Regulation (EU) 2024/1689 (Artificial Intelligence Act), and the Bulgarian Act on the Protection of Persons Who Report or Publicly Disclose Information on Breaches (WPA). In the event of changes to the Policy, the amendments will be published on the Sites, indicating the date of the last update.

Date of last update: November 3, 2026

This is a translation of the original text in the Bulgarian language. In the event of any discrepancy between translations, the Bulgarian version shall prevail.

I. Categories of data subjects whose personal data MAXON EOOD processes

In connection with providing the Services on the websites www.maxon.bg and maxonhomes.com and concluding and executing contracts between us and you, MAXON EOOD processes information regarding the following Data Subjects:

  • Natural persons who are users of the Site without registration.
  • Natural persons who are users of the Site with registration.
  • Natural persons who have submitted inquiries (including via telephone call), requests, whistleblowing reports, or other correspondence to MAXON EOOD.
  • Natural persons whose information is contained in inquiries (including via telephone call), requests, whistleblowing reports, or other correspondence addressed to MAXON EOOD, including reporting persons, persons concerned, and third parties within the meaning of the WPA.
  • Natural persons with whom MAXON EOOD concludes contracts – clients (sellers, buyers, landlords, tenants), partners, legal representatives, authorised representatives of legal entities, etc.
  • Job applicants at MAXON EOOD.

II. Personal Data We Process

1. Data Provided by You

It is impossible for us to provide services on the sites www.maxon.bg and maxonhomes.com and to conclude and perform contracts (including civil, commercial, and employment contracts) between us and You without You providing us with certain information. You decide for Yourself whether and how to use the services of the Site and whether to enter into a contract with us. In the forms through which personal data is entered, we clearly indicate the mandatory or voluntary nature of providing the data. The data whose completion is mandatory is such without which it is impossible to provide the respective service or part thereof and/or to conclude the respective contract:

  • First and last name;
  • Telephone;
  • Email address;
  • Password for the Site (in encrypted form);
  • Your capacity – property owner, buyer, tenant, real estate agency, etc.;
  • Data for the conclusion and performance of mediation and management contracts: full name, Bulgarian personal identification number (UCN) / personal number of a foreigner, permanent and present address, identity document details, bank account, marital status, rights over real estate, and title deeds;
  • Data for compliance with regulatory obligations under the Bulgarian Measures Against Money Laundering Act (AMLA): declarations on origin of funds, politically exposed person (PEP) status, and identification data for mandatory customer due diligence;
  • Data when applying for a job: curriculum vitae (CV), education, qualification, work experience, and feedback contact details;
  • Information, text descriptions, photographs, and video materials regarding real estate provided in connection with the publication of listings or mediation activities. The person providing them declares that they have the right to publish them, and that there are no persons or personal data in the photographs who have not consented to the publication.

2. Correspondence, Complaints, and Whistleblowing Reports

In order to respond to inquiries and requests made in communication to MAXON EOOD received via electronic forms on the Site, via calls to the telephone exchange of MAXON EOOD, or via regular or electronic mail, We store and process this information, as well as the outcome of this processing.

The functionalities provided on the Site are not intended for the storage and processing of special categories of data within the meaning of Article 9 and Article 10 of the General Data Protection Regulation (GDPR).

On the basis of Your explicit consent, MAXON EOOD may also process other data relating to You in cases where You voluntarily provide such data by filling in the respective electronic form, adding preferences, settings, etc., for the purpose of an even more beneficial use of our services.

3. Automatically Collected Technical Information and Logs

In addition, we collect information from Your computer, telephone, tablet, or other device that You use for our services provided on the Site. This information may include IP address, the browser You use, and Your language, date, and time settings. There are also situations where we receive information from other partners of ours or automatically collect other information.

Quick links for repeating previous searches enable You to repeat Your searches instead of entering them every time. The functionality can be used with or without registration. When using the Site, a cookie with a randomly generated number is stored in Your browser, enabling the Site to show You quick links to repeat previous searches.

Logs are used on the Site for the following purposes:

  • To ensure the reliable functioning of the services and identify technical problems;
  • To ensure the security of the services and detect malicious actions;
  • To develop and improve the services on the Site;
  • To measure traffic to the Site.

III. For What Purposes We Process Your Personal Data

Generally speaking, we process Your personal data for the purpose of providing the services of the Site and performing contracts concluded between us and You. We also use Your personal data to contact You and to inform You about our new proposals and special offers, as well as other services that we believe will be of interest to You, in compliance with the requirements of applicable legislation.

MAXON EOOD collects, uses, and processes the information described above for the purposes provided for in this Policy, which may relate to:

  • Conclusion and performance of contracts between You and MAXON EOOD.
  • Provision of the services of the Site and processing of inquiries;
  • Protection and enforcement of the legitimate interests of other users of the services of the Site, third parties, and MAXON EOOD;
  • Compliance with legal obligations of MAXON EOOD;
  • Informing You about our new proposals and special offers for which You wish us to send You information by email, post, mobile telephone, and/or through other digital means, including through social media platforms, while providing a clear and free-of-charge option to opt out at any time;
  • Your registration on the website or application, in which case we will also use Your personal information so that You can maintain and update Your account;
  • Optimising, editing, and adapting advertising and informational materials for properties (including automated translation of texts into foreign languages and visual processing of images and videos using artificial intelligence technologies in order to achieve a higher-quality presentation of offers and erasure of personal details from photographs);
  • Receiving, administering, verifying, and taking follow-up action on whistleblowing reports of breaches;
  • Administration of the website;
  • Analysing and improving the use of our website;
  • Measuring and analysing our advertising;
  • Keeping our website, application, and network secure and safe.

Our legitimate interest in processing Your personal data arises from the need to ensure the protection and safeguarding of the legitimate interests of MAXON EOOD and/or third parties, which is associated with:

  • Ensuring the normal use of the Site by You and by other users, identifying and preventing malicious actions;
  • Detecting and resolving technical or functionality issues, developing and improving the purpose of the Site;
  • Communicating with You, including by electronic means, on important matters related to the use of the services of the Site and the performance of contracts concluded with You;
  • Receiving and processing received inquiries, requests, and other correspondence;
  • Exercising and protecting the rights and legitimate interests of MAXON EOOD, including through judicial proceedings, and providing assistance in exercising and protecting the rights and legitimate interests of other users of the Site and/or affected third parties;
  • Improving the presentation quality of listings on the Site, translating them for foreign clients, and complying with the data minimisation principle (by erasing accidentally captured personal objects, faces, or vehicle registration plates in visual materials).

Our legal obligations include compliance with statutory obligations to retain or provide information upon receipt of a relevant order from competent state or judicial authorities, providing the possibility for the exercise of the supervisory powers of competent state authorities, compliance with obligations provided for in the General Data Protection Regulation (GDPR) related to notifying You of various circumstances related to Your rights, to the provided Services, or to the protection of Your data, and the like.

Your data may be processed on the basis of Your explicit consent, in which case the processing is specific and to the extent and scope provided for in the respective consent.

We process anonymised data for statistical purposes – meaning for analyses in which the results are only aggregate and therefore the data is anonymous. Identifying a specific individual from this information is impossible.

IV. How long do we retain your personal data?

MAXON EOOD applies the general principle of storing data in a minimum volume and for a period no longer than necessary for the performance of the contracts concluded with you, for the provision of the Services on the Site, and for ensuring their security and reliability and the requirements of the law.

In the event of an arising legal dispute or proceedings necessitating data retention and/or a request from a competent state authority, data may be retained for longer than the specified periods until the final conclusion of the dispute or proceedings before all instances.

V. Do we share your personal data with third parties?

MAXON EOOD does not provide your personal data to third parties in any way other than described in this Policy and in the cases provided for by law. In order to provide the best terms under the contracts with our partners, We provide your personal data to:

  • A competent state or judicial authority, if duly requested;
  • Our clients and other users of the Site (in the performance of mediation activities and the publication of listings);
  • Our employees and professional advisors (accountants, lawyers, auditors, notaries, licensed appraisers, banks, and financial consultants upon explicit assignment by the client);
  • Persons for whom we have your explicit consent to provide your personal data;
  • Third parties with a view to protecting the rights and legitimate interests of MAXON EOOD and/or other users of the Site;
  • Providers of search engines, cloud services, web analytics, and technological providers of software solutions (including external providers of artificial intelligence tools for automated translation and multimedia processing, acting as data processors under agreements concluded pursuant to Article 28 of the GDPR).

When working with the above-mentioned categories of persons to whom we provide your personal data, WE require them to strictly comply with our instructions in accordance with this Policy.

In the event of a merger, acquisition, or sale of assets affecting the processing of personal data, you will be notified in advance.

You should bear in mind that if requested by the police or by another regulatory or state authority investigating suspected illegal activities to provide your personal information or other information we receive about you, we have the right and legal obligation to do so.

Our website and application may contain links to and from the websites of third parties – for example, Facebook, Instagram, YouTube, LinkedIn, X (Twitter), etc. If you follow a link to any of these websites, please note that they have their own privacy policies and that We do not assume responsibility for these policies. Please check these policies before submitting information to these websites.

MAXON EOOD processes and stores personal data on the territory of the Republic of Bulgaria and the European Economic Area (EEA) and currently does not transfer personal data to third countries outside the EEA. In the event that a need for international data transfer arises in the future, the transfer will be carried out in strict compliance with the requirements of Chapter V of Regulation (EU) 2016/679 (GDPR) – on the basis of an adequacy decision of the European Commission, standard contractual clauses for data protection, or other appropriate safeguards provided for by legislation, of which data subjects will be duly notified.

VI. Your Rights Regarding Personal Data

Pursuant to the General Data Protection Regulation, you have the following rights, which you may exercise by sending an email message to office.sf@maxon.bg or by submitting a written application to the registered office address of the company with an attached request to that effect: We respond within one month of receipt of the request. In the case of complex requests, the period may be extended by a further two months, of which you will be notified (Article 12(3) GDPR).

  • Right to be informed: This Policy aims to inform you in detail about the processing of your personal data.
  • Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, access to them, and information regarding the manner of their processing and your rights in connection therewith.
  • Right to rectification: You have the right to rectify and complete your personal data in the event that they are incomplete or inaccurate.
  • Right to erasure ("right to be forgotten"): You have the right to request the erasure of data, except in cases where there is an overriding legal basis and/or statutory obligation for their processing.
  • Account closure: If you wish, you have the option to close your account at any time by submitting a request. Following account closure, all data forming part of it are erased in compliance with the rules set out in the section "How Long Do We Retain Your Personal Data?" of this Policy.
  • Right to restriction of processing: The General Data Protection Regulation provides for the possibility to restrict the processing of your personal data if the grounds provided for therein are met.
  • Right to notification of third parties: Where applicable, you have the right to request from the Controller of your personal data to notify third parties to whom it has disclosed your data regarding the rectification, erasure, or restriction of the processing of your personal data.
  • Right to data portability: You have the right to receive the personal data concerning you which you have provided in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent or a contractual obligation and is carried out by automated means.
  • Right not to be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. When providing the Services on the Site, automated decision-making technologies without human intervention are not used.
  • Right to withdraw consent: You have the right to withdraw at any time the consent you have given regarding the processing of personal data on the basis of your consent. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to object: You have the right to object to data processed on the basis of legitimate interest. In the event of receiving such an objection, We will consider your request and, if well-founded, comply with it. If we consider that there are compelling legitimate grounds for the processing or that it is necessary for the establishment, exercise, or defence of legal claims, we will inform you accordingly. When an objection is lodged against processing for direct marketing purposes, processing for that purpose is terminated immediately and unconditionally.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the supervisory authority if you consider that the processing of personal data relating to you infringes the applicable legislation on personal data protection. The supervisory authority in the Republic of Bulgaria is the Commission for Personal Data Protection (CPDP) with address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., email: kzld@cpdp.bg, website: www.cpdp.bg.

In the event that you exercise these rights in a manifestly unfounded or excessive manner, in particular because of their repetitive character, MAXON EOOD reserves the right to charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or to refuse to act on the request.

VII. Accuracy of Information

MAXON EOOD shall not be held liable for the accuracy of the data provided by you, does not carry out verifications in this regard, and does not guarantee the actual identity of the natural persons who provided the data. In all cases of doubt on your part, or of established fraud and/or misuse, please notify us immediately. When providing any information on the Site, you undertake not to infringe the rights of third parties in connection with the protection of their personal data or their other rights.

VIII. How We Protect Your Personal Data

In order to ensure the best possible protection of the data of the company and its employees, clients, and users of the Site, We implement all necessary organizational and technical measures provided for in the General Data Protection Regulation and the Bulgarian Personal Data Protection Act (PDPA), as well as the best practices from international standards.

The company has adopted the necessary rules and procedures related to the lawful processing of Your personal data, including a Data Breach Response Plan, and has established structures for the prevention of abuse and security breaches, which support the processes of lawful processing, preservation, and ensuring the security of Your data.

For maximum security during the processing, transmission, and storage of Your data, We may use additional protection mechanisms such as encryption, pseudonymisation, etc.

IX. Use of Artificial Intelligence (AI) Systems in Material Processing and Translation

In accordance with the transparency requirements under Regulation (EU) 2024/1689 (Artificial Intelligence Act / EU AI Act), Regulation (EU) 2016/679 (GDPR), and Bulgarian legislation, MAXON EOOD informs You that artificial intelligence (AI) software technologies are used in the preparation, editing, and presentation of part of the materials and content on the Site and the company's advertising channels.

1. Scope and Purposes of AI Use

  • Editing and enhancement of images and video materials: AI tools are used for graphic processing of photos and videos of real estate (correction of lighting, colors, resolution), virtual staging, illustrative architectural visualization, as well as for the protection of privacy through automated blurring or removal of third parties accidentally captured in the frame, personal belongings, photographs, or vehicle registration plates. A photograph in which virtual staging or visualization has been used is designated as such in the listing so that it is not taken as the actual condition of the property.
  • Translation and linguistic adaptation of text: AI language models are used for automated translation of property descriptions, offers, and informational materials into foreign languages, as well as for stylistic and grammatical editing of texts with the aim of better readability and accessibility for Bulgarian and foreign clients.
  • Audiovisual advertising materials: Part of the promotional videos and musical accompaniment for presenting locations and properties may include elements generated or processed using AI, which are appropriately labelled in accordance with Article 50 of Regulation (EU) 2024/1689 whenever an AI element could create the impression of an actual situation or place.

2. Safeguards for Personal Data Protection When Using AI

  • Data minimisation: Prior to processing texts or images using external AI tools, the employees of MAXON EOOD do not enter directly identifying personal data of clients (such as Bulgarian personal identification number (UCN), full name, exact personal addresses from an identity document, telephone numbers, or financial data), unless strictly necessary for the performance of a specific service at Your request.
  • Absence of biometric processing: The AI image processing systems used by us do not perform biometric identification, facial recognition, or categorization of natural persons.
  • Protection against use for training public models: When using cloud AI platforms, We select business or enterprise settings that restrict the use of submitted data for training public artificial intelligence models.

X. Processing of Personal Data When Submitting Whistleblowing Reports (WPA)

In accordance with the Bulgarian Act on the Protection of Persons Who Report or Publicly Disclose Information on Breaches (WPA) and Directive (EU) 2019/1937, MAXON EOOD processes personal data upon the receipt, registration, examination, and follow-up of whistleblowing reports concerning breaches that have become known in a work-related context.

1. Categories of Processed Data and Data Minimisation

When whistleblowing reports are submitted and processed, the company processes the following categories of data:

  • Data on the reporting person: full name, correspondence address, telephone number, email address, signature (handwritten or electronic), and the capacity in which they submit the whistleblowing report (worker, employee, counterparty, job applicant, etc.);
  • Data on the person concerned (the person against whom the whistleblowing report is submitted or with whom the breach is associated): names, place of work, position held, and other circumstances specified in the whistleblowing report;
  • Data on third parties: witnesses, facilitators, connected persons, and other persons referred to in the statement of facts or in the enclosed written evidence;
  • Information on the alleged breach: specific data on acts or omissions, place and period of occurrence, description of the factual circumstances, and attached documents.

In accordance with Article 32(2) of the WPA, MAXON EOOD does not collect personal data that are clearly not relevant for the examination of a specific whistleblowing report, and any such data collected accidentally are erased without undue delay.

2. Purposes and Legal Bases for Processing

Personal data within the whistleblowing procedure are processed solely for the purposes of: registering and verifying the plausibility of the submitted whistleblowing report; conducting an internal investigation and collecting evidence; hearing the person concerned and gathering statements; preparing a report containing findings and recommendations; taking follow-up measures to cease the breaches; statistical reporting to the central authority (CPDP); and protection against retaliatory actions.

The legal bases for this processing are:

  • Compliance with legal obligations of the company as a controller under the WPA (Article 6(1)(c) of the GDPR in conjunction with Article 32(1) of the WPA);
  • Legitimate interest of the controller and third parties in the timely prevention, detection, and penalisation of unlawful acts in the company's activities (Article 6(1)(f) of the GDPR);
  • Explicit written consent of the reporting person — solely in cases where the law requires such consent for the disclosure of their identity outside the provided mandatory statutory hypotheses (Article 31(4) of the WPA).

3. Confidentiality and Access Restriction

The identity of the reporting person, the person concerned, and any third party mentioned in the whistleblowing report is strictly confidential and protected. Access to the content of the whistleblowing report and the personal data in the file is restricted exclusively to specifically designated company employees responsible for the receipt and examination of reports, who have undertaken a confidentiality obligation.

Disclosure of the identity of the reporting person or of information from which it can be directly or indirectly ascertained is permitted only with: the explicit written consent of the person; or where this constitutes a necessary and proportionate obligation under Bulgarian legislation or EU law in the context of investigations by public authorities or judicial proceedings (including for the purpose of safeguarding the rights of defence of the person concerned). In these cases, the reporting person shall be notified in advance by means of a reasoned written communication, unless such notification would jeopardise the investigation or the judicial proceedings (Article 31(5) and (6) of the WPA).

4. Reporting Channels

Whistleblowing reports on breaches may be submitted via the following channels:

  • Internal channel of MAXON EOOD: in writing (to the correspondence address of the company at Sofia 1202, 27 Veslets Street, or to the official email office.sf@maxon.bg marked "Report under the WPA") or orally (via an in-person meeting with the responsible employee at a pre-arranged time);
  • External reporting channel: The central authority for external reporting and for the protection of persons under the WPA is the Commission for Personal Data Protection (CPDP), address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., email: kzld@cpdp.bg, website: www.cpdp.bg.

5. Retention Period and Maintenance of a Register

MAXON EOOD maintains a non-public register of submitted whistleblowing reports in compliance with the confidentiality requirements (Article 18 of the WPA). Whistleblowing reports and the materials attached thereto are stored on a durable medium for the period of conducting the examination and carrying out follow-up actions, pursuant to Article 18(2), item 9 of the WPA and the approved internal rules of the company, after which they are erased or archived in accordance with the statutory procedure.

XI. Cookie Policy

The Sites use cookies to maintain their functionality and, subject to Your consent, to analyse user behaviour and for marketing purposes. Detailed information regarding the types of cookies, purposes, their retention period, and how to manage Your preferences is contained in our Cookie Policy published on the Sites.

XII. Controller Details and Contacts

Questions and requests related to the exercise of your personal data protection rights may be addressed to MAXON EOOD:

  • Controller: MAXON EOOD, UIC: 175115626
  • Correspondence address: Sofia 1202, Oborishte district, 27 Veslets Street
  • Email: office.sf@maxon.bg
  • Tel.: 02 868 8776
  • Data Protection Officer (DPO): Krasimira Semova, contact details: email: office.sf@maxon.bg, tel.: 02 868 8776, correspondence address: Sofia 1202, Oborishte district, 27 Veslets Street. Data subjects may contact the DPO directly regarding all issues related to the processing of their personal data and to the exercise of their rights under Article 38, paragraph 4 of the GDPR.