Privacy Policy

1. About this Policy and the data controller

1.1. This Privacy Policy explains how LIMITED LIABILITY COMPANY «ENVY MAISON» (the “Company”, “ENVY MAISON”, “we” or “us”) processes personal data in connection with envymaison.com and www.envymaison.com (the “Website”), property enquiries and enquiries about working with us.

1.2. The data controller is LLC «ENVY MAISON», a company registered in Ukraine. Ukrainian identification code (EDRPOU): 46195598. Registered address: Office 162, 15-A Solomianska Street, Kyiv, 03110, Ukraine. Contact email, including for personal data requests: info@envymaison.com. Telephone: +380 75 515 24 78.

1.3. This Policy covers Website visitors, prospective buyers, sellers, tenants, landlords, client representatives, newsletter subscribers and people enquiring about work or partnerships. Additional notices may apply to particular services, client verification or employment administration.

1.4. Visiting the Website or reading this Policy does not constitute consent to every possible use of your data, marketing communications or disclosure to any third party. Where processing requires consent, we explain its purpose separately.

2. Personal data we process

2.1. Enquiries and communications: your name and, where provided, surname; email address; telephone number and country code; enquiry topic; message; and information you voluntarily provide in subsequent correspondence or conversations.

2.2. Viewing requests: contact details, the selected property, preferred viewing date and time, time zone, comments and arrangements for the appointment. The information involved depends on the form and subsequent communications.

2.3. Owner enquiries: contact details, city, district or area, address and other property characteristics you enter in a form or provide later. Budget, asking price, timing, photographs, floor plans and evidence of authority are processed where you provide them and they are needed for your enquiry.

2.4. Agent and partnership enquiries: first name, surname, email address, telephone number, message and professional experience you provide. Newsletter subscriptions: email address and information about the subscription, consent and withdrawal.

2.5. Technical information: IP address, browser and device information, request time, page addresses, referral sources and campaign parameters in links, including UTM parameters. A form submission may also include the page address, referral source, property identifier, form type, time zone and the value of the checkbox relating to this Policy. Cookies and browser storage are addressed in section 5.

2.6. Not every category is collected during every visit or enquiry. Fields marked as required are necessary for that form. You may withhold optional information or contact us by email or telephone; without necessary contact details, we may be unable to respond.

2.7. Do not submit passwords, payment details, identity document copies or sensitive information about health, political views or religious beliefs through ordinary Website forms. Documents needed to verify property rights, enter into a contract or comply with legal duties are requested separately, only where necessary and through an agreed channel.

3. Sources of personal data

3.1. We receive information directly from you through Website forms, email, telephone and communication channels you choose. Technical information is also received from your browser and services supporting the Website.

3.2. When handling a particular enquiry, information may be received from your authorised representative, a partner involved at your request or registers we may lawfully access. We use such information only with an appropriate legal basis and to the extent necessary. Where information is obtained from someone other than you, we provide the notice required by law unless a statutory exception applies.

3.3. When providing another person’s information, make sure you have authority to do so and that the person is informed about the enquiry. This does not relieve the Company of its own duties to ensure lawful processing.

4. Purposes and legal bases

4.1. Responding to enquiries, identifying properties, arranging viewings, discussing a sale or rental and preparing a working relationship are carried out to take steps at your request before entering into a contract or to perform an existing contract. Other voluntary enquiries unrelated to a contract are handled on the basis of our legitimate interest in responding; where the law requires consent, we request it separately.

4.2. Agent and partnership applications are reviewed to assess a potential working relationship and prepare an appropriate agreement at the applicant’s request. Keeping an application for future opportunities unrelated to the current enquiry requires a separate basis and appropriate information.

4.3. Website security, spam and fraud prevention, troubleshooting and protecting the Company’s rights rely on legitimate interests where these are not overridden by individuals’ rights and freedoms. We may also assess the source of a particular enquiry using parameters submitted with it on this basis. This does not automatically authorise advertising or cross-site tracking.

4.4. Accounting, responding to lawful requests from competent authorities and checks required for a particular service are based on legal obligations. Anti-money laundering client checks are carried out only where the relevant obligation applies to the Company; merely visiting the Website does not itself require such checks.

4.5. Newsletters, promotional communications and processing through optional technologies that require consent are based on a separate, voluntary choice. Acknowledging this Policy, requesting a viewing or requesting a call does not substitute for subscribing to marketing.

4.6. Before using data for a new purpose incompatible with the original purpose, we establish an appropriate legal basis, inform you and obtain fresh consent where necessary.

5. Cookies, browser storage and external components

5.1. Cookies are small files stored by your browser. The Website may also use local or session storage for technical page state and to remember a user’s choices. These identifiers are not automatically anonymous: they may be personal data where they can be linked to an individual.

5.2. Technically necessary mechanisms are used to the extent needed to operate the Website, submit forms securely and remember your choices. Optional analytics, personalisation and advertising tracking, if introduced, require prior consent where the law requires it. Declining optional technologies must not prevent you from making an ordinary enquiry.

5.3. The Website provides buttons to accept or decline cookies. Your browser settings also allow you to inspect, restrict and delete cookies and stored data. Deleting a saved choice may cause the Website to ask again. You may also withdraw consent to processing by the Company through info@envymaison.com; an email does not replace settings in your browser or in separate services.

5.4. The Website uses Webflow, Google Maps and external sources of software components, including jsDelivr, unpkg and Slater. Loading an external resource causes your browser to contact its provider, which may receive your IP address and other technical information. This can happen independently of submitting a form. A technical request to a provider is not equivalent to consenting to advertising uses of data.

5.5. Providers explain their own processing in their privacy notices. Webflow’s information is available at https://webflow.com/legal/privacy and Google’s at https://policies.google.com/privacy. Using these services does not remove the Company’s responsibilities for its own processing and appropriate Website configuration.

6. Communications and unsubscribing

6.1. We may contact you about an enquiry you submitted, a viewing arrangement, your search criteria or performance of a contract. These communications are distinct from a regular promotional mailing list.

6.2. Subscribing to ENVY MAISON news and offers is optional. You may unsubscribe through the link in the relevant email or by contacting info@envymaison.com. Opting out of marketing does not stop necessary correspondence about an active enquiry or contract.

6.3. Withdrawing consent stops future processing based on that consent and does not affect the lawfulness of earlier processing. Where some information must be retained on a separate, independent legal basis, we explain that basis and restrict use of the relevant information.

7. Recipients of personal data

7.1. Access is limited to authorised staff and professionals engaged for the relevant tasks. Hosting, technical support, email, form-processing and CRM/ERP providers receive only information necessary for their respective functions. Processing on the Company’s behalf must be subject to contractual confidentiality and data protection requirements.

7.2. Depending on the form, enquiries are handled through Webflow and/or transferred through our integration to our internal enquiry-management system. Using a technical provider does not itself authorise that provider to use client information for unrelated advertising.

7.3. Information is shared with property owners, developers, other agencies or professional advisers only to the minimum extent necessary for a specific agreed enquiry, with your consent or on another basis expressly permitted by law. Before disclosure to an independent partner, we explain its role and obtain separate permission where required. An enquiry does not authorise us to distribute your contact details throughout a partner network.

7.4. A private property’s precise address, its owner’s identity, personal contact details, photographs and private-viewing arrangements are not published merely because an enquiry has been submitted. The materials to be used and the scope of disclosure are agreed separately.

7.5. Information may be provided to authorities, courts and other authorised recipients in response to a lawful request or an express legal obligation. This Policy does not permit selling an enquiry database or transferring it for third parties’ own marketing.

8. Transfers outside Ukraine

8.1. International technical services may involve processing outside Ukraine, including in the United States and other countries where the relevant providers operate. For example, Webflow describes possible processing in the United States and other countries, while Google describes using servers in multiple countries. This does not mean that all Company information is stored in a single foreign country.

8.2. Transfers made by the Company must meet Ukrainian legal requirements, through an adequate level of protection in the recipient country, appropriate safeguards or another statutory basis. Where a particular transfer relies on your consent, that consent is requested separately; simply using the Website does not provide it.

8.3. You may request information about recipients of your data, relevant countries and applicable safeguards through info@envymaison.com. Transfers that are also subject to foreign data protection law must meet its mandatory requirements.

9. Retention

9.1. Information is kept no longer than necessary for its purpose. Relevant criteria include the status of your enquiry, the duration of an agreed search or working relationship, contract performance, statutory document-retention requirements and the need to protect specific legal claims.

9.2. Enquiry information is retained while we consider it and perform the work agreed with you. Once the work is completed or the enquiry is no longer current, it must be deleted or anonymised unless a separate lawful purpose justifies continued retention. A complete contact database is not retained indefinitely merely because future business might be possible.

9.3. Mailing-list information is retained until you unsubscribe or the relevant programme ends. A minimal suppression record and evidence of consent may be retained separately only for as long as needed to respect your choice and demonstrate lawful conduct.

9.4. Candidate and partnership information is retained while the particular application is considered. Further retention after that process requires a separately justified basis. Contractual, accounting and client documents are retained for the periods required by law for the relevant category.

9.5. Retention of technical logs and backups depends on their function, service settings and incident-investigation needs. Once no longer needed, such information is deleted or anonymised. Information removed from operational systems must not return to active use following backup restoration without an appropriate basis.

10. Data security

10.1. The Company undertakes to apply organisational and technical safeguards proportionate to the information and risks involved, including need-to-know access, account protection, secure transmission, contractor-access controls and incident response. Staff and contractors must not use personal data for their own purposes.

10.2. No technology eliminates every risk. This does not relieve the Company of its statutory data protection duties or liability. Please report suspected unauthorised access or use to info@envymaison.com.

11. Your rights and requests

11.1. Where provided by law, you may obtain information about the sources, location, purposes and conditions of processing and its recipients; access your data; submit a reasoned objection; require correction or destruction of inaccurate or unlawfully processed data; withdraw consent; and seek protection before a competent authority or court.

11.2. You also have statutory rights concerning information about the mechanism of automated processing and protection against automated decisions with legal consequences. Submitting a form does not itself automatically approve a property transaction or conclude an agreement with the Company.

11.3. Contact info@envymaison.com or write to the Company’s registered address. Explain your request and provide information that helps us locate your enquiry. A formal access request must contain the particulars required by Article 16 of the Ukrainian Law on Personal Data Protection. We may verify your identity and a representative’s authority without requesting excessive information.

11.4. Under Ukrainian law, an access request is assessed for fulfilment within no more than ten working days of receipt and is fulfilled within thirty calendar days unless the law provides otherwise. Access to your own personal data is free of charge. Other requests are handled within their applicable statutory deadlines.

11.5. You may complain to the Ukrainian Parliament Commissioner for Human Rights or seek a remedy in court. Information about contacting the Commissioner is available at https://ombudsman.gov.ua/uk/zayavniku. Contacting the Company first does not restrict any legal remedy available to you.

12. Users in other jurisdictions

12.1. Where particular processing falls within the scope of the EU General Data Protection Regulation (GDPR) or other applicable foreign data protection law, the additional rights and safeguards under that law apply. Depending on its conditions, these may include restriction of processing, data portability, objection to direct marketing and a complaint to a competent supervisory authority.

12.2. This Policy does not reduce those rights or state that foreign law applies automatically to every visitor. Relevant requests are handled under the procedures and deadlines of the applicable law.

13. Minors and separate services

13.1. The Website is intended for adults. Enquiries concerning a minor’s property must involve their legal representative as required. If we are informed that a child’s data has been obtained without an appropriate basis, we will investigate and delete it or establish another lawful arrangement for processing.

13.2. Links to social networks, messaging platforms, ENVY MAISON Lab, ENVY MAISON App and other resources may lead to separate services. This Policy does not automatically cover every operation in those services; review their own notices. Information the Company receives in correspondence through such a channel is handled for the relevant enquiry under this Policy or an additional notice.

14. Changes to this Policy

14.1. This version, dated 10 September 2026, applies from its publication on the Website. Later versions will be posted on the Policy page with their date. Material changes affecting the ongoing processing of your data will be communicated in a manner appropriate to the change and applicable legal requirements.

14.2. Updating the text does not replace any required fresh consent or retrospectively legitimise processing. For questions about this Policy, contact LLC «ENVY MAISON» at info@envymaison.com or Office 162, 15-A Solomianska Street, Kyiv, 03110, Ukraine.