Version 1.1
This notice explains how your personal data is processed when you visit the cariaestates.com website, fill in forms on the site, leave information through our Meta (Facebook / Instagram) advertising forms, or contact us directly. Below you can find the types of data processed, the purposes, the legal bases, the recipients, the retention criteria and your rights.
1. Identity and Contact Details of the Data Controller
| Data controller | CARIA INVESTMENT LİMİTED |
| Trading name / brand | Caria Estates |
| Website | cariaestates.com |
| TRNC company registration no. | MŞ27276 |
| Tax / taxpayer no. | 203014609 |
| Registered address | Girne Tatlısu Anayolu No:50, Bahçeli, Çatalköy, Girne, KKTC |
| Incorporation / activity | 06.11.2024 · Companies Law, Chapter 113 · Real estate consultancy |
| Contact person | İlker Hakan Okur · Company Director |
| Contact e-mail | [email protected] |
Our services are intended for adults. We do not intend to knowingly collect personal data from children. If such a record is identified, we carry out the necessary protection and deletion assessment.
2. Categories of Personal Data Processed
| Category | Information that may be processed |
|---|---|
| Identity and contact | Name and surname, telephone number, e-mail address; the content of your communication with us. |
| Enquiry / form data | The apartment type you are interested in, budget range, preferred area and other answers you give in the enquiry form. |
| Site behaviour | To the extent you consent: pages visited, clicks, navigation, and advertising / source information. |
| IP and device information | IP address, browser and operating system type, screen size, language and approximate location derived from the IP address. Security logs and optional tracking are assessed separately for their respective purposes. |
| Cookie / identifier | Browser and session identifiers; the technologies used and their durations are described in Section 12. |
| Preference / consent record | Your consent or refusal choice, the time of the choice, the purposes consented to and the version of the notice displayed. |
We do not request special-category personal data such as health, religion, political opinion or similar data in our forms. Please do not write such information in free-text fields. For unnecessary information sent by mistake, we restrict access and consider appropriate deletion.
3. Purposes of Processing
Assessing your enquiry: Reviewing your real estate enquiry, identifying suitable options and referring your enquiry to the sales consultant who can respond to it.
Responding to your enquiry: Replying to you and answering your questions by telephone, e-mail or the communication channel you specified in your enquiry.
Consent-based promotion: Sending campaign and promotional messages through the channels for which you have separately consented; measuring campaign performance with the advertising technologies you have consented to.
Measuring and improving the site: Analysing site usage, depending on your analytics preference.
Protecting security and rights: Ensuring the system functions, preventing abuse and fraud; managing legal claims to the extent necessary and fulfilling applicable obligations.
Applying your preferences: Remembering your consent and refusal decisions, responding to rights requests and keeping the necessary evidentiary records.
4. Legal Bases
This notice has been prepared, to the extent applicable, under the GDPR (EU 2016/679), the TRNC Personal Data Protection Law No. 89/2007 and the related secondary legislation. The applicable specific rules of the relevant countries on cookies, similar tracking technologies and electronic promotional communications are also taken into account.
| Processing / purpose | GDPR basis | TRNC basis and limit |
|---|---|---|
| Assessing the enquiry, necessary consultant referral and replying to your enquiry | Art. 6(1)(b): steps necessary, at your request, prior to entering into a service relationship with you. | Art. 6: processing necessary for the conclusion or performance of a contract. Only the data and operations necessary to fulfil your enquiry. |
| Subsequent campaign and promotional communication outside the enquiry | Art. 6(1)(a): separate and optional consent; together with the applicable electronic communications rules. | Art. 6 and Art. 17: consent required for marketing; a provable record meeting the local written-consent requirement. |
| Advertising cookies and Meta Pixel | Art. 6(1)(a) and applicable cookie rules: advertising consent given in advance. | Art. 6; Art. 17 is also taken into account within the scope of marketing. Not activated without consent. |
| GA4 and PostHog analytics | Art. 6(1)(a) and applicable cookie rules: consent for the relevant purpose. | Art. 6: consent. |
| Security, prevention of abuse and necessary records for legal claims | Art. 6(1)(f): legitimate interest in protecting systems and data and in the establishment, exercise or defence of rights. | Art. 6: legitimate interest balanced against the rights and freedoms of the person. Necessity and proportionality limits apply. |
| Necessary record proving that consent was obtained | Art. 6(1)(c) and Art. 7(1): obligation to demonstrate consent. | Art. 6: record necessary under an applicable legal obligation; no more data is kept than necessary. |
The communication we conduct to respond to your enquiry is separate from subsequent campaign and promotional communication. We send promotional messages unrelated to your enquiry only through channels for which you have separately consented. This consent is not a condition of receiving our services and can be withdrawn at any time.
For processing based on legitimate interest, besides the specific purpose and the necessity of the processing, its impact on your rights and freedoms is assessed. You may object to such processing on grounds relating to your particular situation. An obligation arising solely under TRNC law is not automatically accepted as a GDPR Art. 6(1)(c) basis.
5. Transfers Abroad
Caria is established in the TRNC. Your enquiry and contact details are stored in our customer record system (CRM) hosted in Frankfurt, Germany. Authorised Caria staff and the technical service provider working on behalf of the company may access the data within the scope of their duties. The server being in Germany does not mean that all processing takes place only within the EU/EEA.
Storage, remote access and disclosure to third parties flows are assessed separately. For transfers within the scope of GDPR Chapter V, a valid transfer safeguard applies; for transfers outside the TRNC, the conditions and the required permit under Art. 11 of Law 89/2007 also apply. Giving cookie consent or filling in a form is not, in itself, an international transfer mechanism.
| Service / data flow | Data and known location | Transfer safeguard |
|---|---|---|
| CRM / Hostinger | Enquiry, contact and form data. Hosting: Frankfurt, Germany. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
| Connect On Digital (technical service) | CRM access for maintenance and operation. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
| Meta (Instant Form / Pixel) | Form responses; with advertising consent, cookie identifiers, event, IP and device data. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
| Google (GA4 / Maps) | With analytics consent, usage data; when the map is activated, connection and device data. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
| PostHog (analytics) | With the relevant consent, usage, device and identifier data. Current project infrastructure: USA. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
| Instant notification (messaging) service provider | New enquiry notification: the customer's name, telephone and e-mail address. This transfer is made outside the EEA. | You may request information about the transfer safeguard applied to this flow through the channel in Section 1. |
An adequacy decision or the DPF is valid only for the country, recipient and data flow it covers. It does not replace the TRNC transfer permit. Where appropriate, you may request information about transfer safeguards through the channel in Section 1.
5.1 Meta Instant Form and Meta's Processing
When you fill in the Instant Form in our Facebook or Instagram advertisements, your information is first created in Meta's systems. We access this information through Meta and transfer it to our CRM system. We assess your rights requests in respect of the records under our control and the processors acting on our behalf. For processing carried out by Meta for its own independent purposes, Meta's own notices and rights-request channels also apply.
On a request for deletion, rectification or restriction, we carry out the necessary operations in the systems under our responsibility and with the relevant processors, and notify recipients to the extent applicable. We do not guarantee that all of Meta's independent records can be deleted by us; this does not remove our own obligations.
5.2 Map, Fonts and New Enquiry Notifications
Map: The Google Maps map loads when you have seen the relevant notice and chosen to activate the map. At that point your browser connects to Google; your IP address and necessary technical connection information may be processed. The map preview images you see on listing pages are served from our own server (generated in advance from OpenStreetMap data), and no connection to any third party is made to display them.
Fonts: Fonts are served from our own server; your browser does not connect to Google Fonts to load fonts.
New enquiry notifications: When a new enquiry arrives, a notification of the enquiry is delivered to company officials through an instant notification (messaging) service so that the person handling it can respond quickly. This notification contains the customer's name, telephone and e-mail address. The recipients of the notification are limited to company officials; the full details of the enquiry can be viewed only through the CRM, where authorised users log in. You can learn the identity of the service provider used by contacting us through the channel in Section 1.
6. Categories of Recipients and Security
| Recipient / accessing party | Role and scope of access |
|---|---|
| Company management and assigned consultant | Enquiry records within management authority; sales consultants only the enquiries assigned to them. |
| Technical service provider agency | Connect On Digital carries out technical operation and maintenance on the company's documented instructions. Access is limited to what is necessary for the task. |
| Hosting, e-mail and backup providers | Data storage, communication and infrastructure services under contract and instruction. Actual recipients and countries are completed in Section 5. |
| Instant notification service provider | Delivery of the new enquiry notification; limited to the content of the notification. |
| Meta, Google and PostHog | Advertising, form, analytics or map services depending on the product used and the purpose consented to; roles are assessed per product. |
| Competent public authorities / bodies | Disclosure limited to the scope required by an applicable legal obligation or a valid request. |
We do not sell your personal data. We apply technical and administrative measures appropriate to the risk of the processing against unauthorised access, loss and misuse. Access authorisations, confidentiality, backup, retention and data separation between projects are addressed within these measures. In the event of security breaches, we fulfil the applicable review, recording and notification obligations.
7. Methods of Collection
We collect your data from the contact and enquiry forms on our website, through the Meta Instant Form, and from information you send us by telephone, e-mail or message. Cookies, pixels and similar technologies are used only within the preferences and limits described in Section 12. Necessary technical security logs may also be kept separately.
Filling in a form is optional. The fields necessary for us to respond to your enquiry are marked on the form; if you do not provide usable contact details, we cannot respond to you. Not giving optional marketing or analytics consent does not prevent you from submitting your enquiry.
We make this notice available at the time of data collection. If we actually obtain your data from another source, we also inform you of the source and the relevant categories of data. We provide the information required under GDPR Art. 14 within one month at the latest; if the first communication with you or the first disclosure takes place earlier, at that stage. Earlier information obligations in the TRNC are also observed separately.
8. Retention Periods
| Data / record | Period or criterion for determining the period |
|---|---|
| Enquiry that does not convert into a customer | At most 24 months from the date of the last meaningful enquiry / communication; shorter if the purpose ends earlier. The company sending a unilateral campaign does not automatically restart the period. |
| Contract and customer file | For the duration of the service relationship; thereafter only the statutory retention obligation applicable to the relevant document, or the period necessary for the establishment or defence of rights. The period is determined by the document type, the obligation and the applicable limitation criteria. |
| Consent-based promotion list | As long as the consent and the promotional purpose remain valid; the necessity is reviewed regularly. Promotion stops after withdrawal / objection. The minimum refusal record preventing renewed unsolicited contact may be kept to the extent necessary. |
| GA4 event / user data | At most 14 months. This period is separate from the lifetime of the cookie in the browser. |
| PostHog analytics data | At most 12 months. |
| Consent / preference evidence and rights-request records | As long as consent-based processing continues, and afterwards for a justifiable period necessary to prove the relevant obligation or a dispute. The scope of the refusal record and of the consent evidence is assessed separately. |
| Security and technical logs | The period necessary for the security purpose; records related to an incident are limited to the period needed for investigating and resolving the incident and protecting necessary rights. |
When the purpose and the necessary retention period end, the data is deleted, destroyed or irreversibly anonymised. The use of and access to records kept because of a legal retention requirement or a dispute is restricted on that ground. Meta's own retention practices also apply to records Meta keeps for its own purposes.
9. Rights of Data Subjects
To the extent the GDPR is applicable and the conditions of the relevant right are met, you may exercise the following rights:
- Access and information (Art. 15): Learning whether your data is processed; obtaining a copy and information about the processing.
- Rectification (Art. 16): Requesting the correction of incomplete or inaccurate personal data.
- Erasure and restriction (Art. 17-18): Requesting erasure or restriction of processing under the conditions set by law. The right to erasure may be limited where there is another valid reason for retention or a statutory exception.
- Notification to recipients (Art. 19): Notification of applicable rectification, erasure and restriction to recipients; information about the relevant recipients on your request.
- Portability (Art. 20): For automated processing based on consent or contract, receiving the data you provided in a structured, machine-readable format and, where technically feasible, having it transmitted to another controller.
- Objection (Art. 21): Objecting, on grounds relating to your particular situation, to processing based on legitimate interest. You may at any time object to direct marketing and to profiling related to it; we stop processing for these purposes.
- Automated decisions (Art. 22): Subject to the exceptions in law, not being subject to decisions based solely on automated processing that produce legal or similarly significant effects.
- Withdrawal of consent (Art. 7): Withdrawing your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
TRNC Rights and Complaint Authorities
Under Law No. 89/2007, you may also request information and access; when the conditions are met, request rectification, erasure or blocking, and object to processing. The local complaint authority is the TRNC Personal Data Protection Board (Art. 34): kvkk.gov.ct.tr
Under GDPR Art. 77, you may also lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The country of the EU representative is not the only place to apply.
10. Applications, Response Time and Withdrawal
To exercise your rights you may apply to [email protected] or to the postal address in Section 1. If there is reasonable doubt about your identity, we ask only for necessary and proportionate verification information; we do not routinely request unnecessary identity documents.
GDPR: We respond without undue delay and at the latest within one month. Where necessary, taking into account the complexity or number of requests, the period may be extended by up to two further months; the reasons are notified within the first month. Applications are in principle free of charge; the exceptions in law may apply to manifestly unfounded or excessive requests.
TRNC: A written reply is given within 30 days for access requests under Art. 14 and within 15 working days for objections under Art. 15. If an objection is rejected, the reply is also forwarded to the Board. A GDPR extension does not remove local deadlines.
You may withdraw your cookie consent through the "Cookie settings" link on the site; you may withdraw your promotional consent through the opt-out in the message or by writing to the contact e-mail. Withdrawal must be as easy as giving consent.
11. Automated Decision-Making and Profiling
We do not make decisions about you based solely on automated means that produce legal effects or similarly significantly affect you. There is human involvement in enquiry assessment and consultant referral.
If you give advertising consent, your interactions with the site may be transmitted to Meta through the Meta Pixel. This data may be used for advertising measurement, targeting and optimisation and may involve profiling. We determine the targeting criteria; Meta's algorithms play a role in ad delivery. When you withdraw your advertising consent on our site, we stop new transmissions within the scope of that consent. You can also manage preferences regarding Meta's independent processing separately from your Meta account.
Analytics is not used to make significant individual decisions about you. The upload of CRM customer lists to advertising platforms is not carried out automatically on the basis of site cookie consent; such an operation requires a separate appropriate basis and notice.
12. Cookie Policy
Cookies are small files stored in your browser. Pixels, local storage and similar technologies may also access device information or transmit data. Only technologies necessary for the service you request are considered strictly necessary; analytics and advertising are not activated without the relevant prior consent.
12.1 Inventory of Cookies and Technologies
| Cookie / technology | Purpose / category | Duration and domain |
|---|---|---|
_ga, _ga_FQG9GF7JML — Google Analytics 4 | Distinguishing visitors and sessions; site usage statistics. Analytics consent. | 400 days · cariaestates.com (first party) |
_fbp — Meta Pixel | Identifying the browser for advertising measurement. Advertising consent. | 90 days · cariaestates.com (first party) |
_fbc — Meta Pixel | Created only when you arrive by clicking an advertisement link; attributes that click to measurement. Advertising consent. | 90 days · cariaestates.com (first party) |
ph_<project>_posthog — PostHog (cookie and browser local storage) | Visitor / session identifier and usage analysis. Analytics consent. | Cookie 365 days · cariaestates.com (first party). The same name is also held in local storage and remains until you delete it. |
caria_consent — Caria / consent management (browser local storage, not a cookie) | Remembering your consent or refusal, the time of the choice and the version of the notice. Strictly necessary preference record. | Remains until you delete it; if the version of this notice changes, your preference is requested again. |
caria_lang — Caria (browser local storage) | Remembering the language you selected. Strictly necessary. | Remains until you delete it. |
| Pixel / event request — Meta and analytics tools | May transmit data even where no cookie is written. Subject to the relevant advertising / analytics consent. | A request is not in itself a cookie lifetime. Retention by the recipient is assessed under Section 8 and the provider's terms. |
| Google Maps — embedded map | Map functionality. Loaded only when you see the notice and choose to activate the map. | No cookie is placed unless you activate it. Once activated, Google may place its own cookies, which are determined by Google. |
12.2 How to Manage Your Cookie Preferences
First visit: The options "Accept all", "Reject non-essential" and "Manage preferences" are offered. Acceptance and refusal are of similar visibility and ease; optional preferences are not switched on in advance.
Choice by purpose: You can manage analytics, advertising and map preferences with the relevant notice. Browsing, scrolling the page or closing the banner is not consent.
Withdrawal: You can use the "Cookie settings" link accessible from every page. A change of preference applies to subsequent tracking and transmissions; for past records you may additionally exercise your right to erasure.
Browser controls: You can delete or block cookies in your browser. This may also delete the preference record on the site; you may need to state your preferences again on your next visit. Blocking some strictly necessary cookies may affect basic functions.
Refusing optional cookies does not prevent you from using the enquiry form or accessing the basic service. An advertising / analytics preference does not by itself permit promotional messages to be sent later or CRM customer lists to be used for advertising.
13. Updates, Language Versions and Effective Date
We may update this notice when our tools, our processing or the applicable rules change. We announce significant changes on our site. If a change goes beyond the scope of your existing consent or requires new consent, we obtain your consent again before starting the relevant processing.
The language versions of the notice are prepared to provide the same information. Differences in translation do not limit your rights arising from applicable legislation or our responsibility for the accuracy of the information. Differences identified are corrected.
| Version | 1.1 |
| Current text | The privacy and cookie policy links on cariaestates.com |
| Contact | [email protected] |