Privacy Policy

Last updated: 10 October 2026

This policy explains the sources and purposes of personal data processing on the Nazar Emlak website and your rights. It also serves as an information notice for visitors and people submitting enquiries under Turkish Personal Data Protection Law No. 6698 (“KVKK”). If a sale, rental or other service relationship is established, additional information relevant to that transaction is provided separately.

1. Data controller and contact

The data controller is NAZAR REAL ESTATE GAYRİMENKUL İNŞAAT TURİZM TİC. VE SAN. LTD. ŞTİ.

• Address for applications: Şekerhane Mah. Şirin Sk. No:22/A, Alanya, Antalya, Türkiye
• MERSİS registration number: 0630123688000001
• Tax office / tax number: Alanya / 6301236880
• Email: [email protected]
• Telephone: +90 532 637 68 87

2. Categories of data

• Enquiry and contact information: Name, telephone, email, message, selected listing or service, preferences and contact channel you submit, together with correspondence about the enquiry.
• Technical and security information: IP address, request and record times, browser/device information, browser language headers, the page associated with the form and abuse-prevention results.
• Preferences and visit information: Where an appropriate recorded consent exists, visited website pages, visit times, active duration, search choices and their frequency, referral source, UTM campaign data, browser languages, time zone and screen dimensions.
• Inferred information: Country inferred from the telephone prefix, approximate country inferred from the IP address, and session-interest or unwanted-submission scores used to assist enquiry assessment.

A telephone prefix or IP estimate does not establish citizenship, residence or precise location. Browser-reported visits are not independently verified evidence. General forms are not designed to collect sensitive personal data or identity documents; please do not send these or payment passwords.

3. Collection, purposes and legal grounds

Data is obtained electronically from information entered in forms, technical website requests, permitted browser records and communication with us by email, telephone or another channel you choose.

• Answering enquiries and preparing a requested service: Necessary data is processed for entering into or performing a contract under KVKK Article 5(2)(c); reasonable communication and service organisation outside that scope may rely on legitimate interests under Article 5(2)(f), with regard to your fundamental rights.
• Security and preventing abuse: Proportionate protection of the website and communication channels relies on legitimate interests under Article 5(2)(f) that do not harm your fundamental rights and freedoms.
• Legal duties and protecting rights: Where a specific duty or dispute exists, necessary data may be processed under Article 5(2)(ç) for a legal obligation and Article 5(2)(e) for establishing, exercising or protecting a right.
• Optional visitor analysis, advertising measurement and personalisation: Separate explicit consent under Article 5(1) where required for the processing concerned. Permission for commercial electronic messages must also be obtained separately where required.

Not every ground applies to every item of data; the relevant and necessary ground applies to each activity. Leaving optional fields such as email blank does not prevent an enquiry that can be answered using the required fields. Without necessary contact details, we may be unable to respond effectively.

Where GDPR applies to a specific activity, the corresponding purposes are also assessed, subject to the relevant conditions, under Article 6(1)(b) for contracts, 6(1)(f) for balanced legitimate interests, 6(1)(c) for legal obligations and 6(1)(a) for consent. Applicable rules for non-essential storage on or access to devices also remain relevant.

4. Cookies, browser storage and choices

Cookies or similar browser records may support language, currency, sessions and security functions. Permission required for non-essential measurement or advertising is assessed separately from technical preferences.

Reading this policy, entering the website, browsing or dismissing a notice is not explicit consent. The absence of a cookie notice does not mean you agreed. A previously recorded consent may be used only while its relevant scope and validity conditions remain satisfied. Submitting an enquiry does not depend on agreeing to optional tracking.

You may manage or delete cookies and website data through your browser settings; some functions may be affected. You can also contact us to withdraw consent for consent-based processing. Deleting browser records does not automatically erase an enquiry previously sent to the company; you may make a separate request about that data. Withdrawal does not retrospectively affect lawful processing before withdrawal.

5. Providers and external services

Google Analytics 4 and Meta Pixel are configured in the current website settings; the cookie notification panel is disabled. These settings, this policy and browsing do not replace any separate consent required for the processing. Appropriate permission controls remain necessary for measurement and advertising activities requiring consent.

• Google Analytics 4: Uses page-view and successful-enquiry events to measure website use and campaign results.
• Meta Pixel: Uses page-view and enquiry events to measure advertising results. Google and Meta may also process their identifiers, IP addresses and device information.
• Google reCAPTCHA: May assess device, connection and interaction data to protect forms and detect automated or abusive submissions. This security processing does not signify permission for advertising tracking.
• Google email/SMTP services: The service used to deliver enquiry notifications may process the email content and delivery information.
• country.is: When a form is submitted, the IP address may be sent to this external service to estimate the country; that estimate may be added to the enquiry record.
• Fonts, maps, videos and communication services: Externally loaded resources such as Google Fonts can receive connection information. Using map/video content, WhatsApp or social media links may also involve processing by the relevant provider.

Names, telephone numbers, email addresses and free-text messages in forms are not intended to be sent as analytics event fields; they belong to the communication/CRM process handling the enquiry. This distinction does not mean external providers process no personal data. Their practices can be reviewed in the Google Privacy Policy and Meta Privacy Policy.

6. Recipients and international transfers

Authorised advisers and company staff who need your enquiry for their duties may access it; it may be included in a CRM record and an authorised notification email. Technical operations, hosting, security, email and measurement providers may process data needed for their services. Necessary information may be shared with a relevant owner or transaction party where needed to fulfil your request and an appropriate legal ground exists. Disclosures to competent public authorities occur under a specific legal duty or authorised request.

Data may be processed abroad because Google, Meta and other external services can operate systems outside Türkiye. Such transfers require the applicable conditions under KVKK Article 9 and appropriate safeguards where required. A provider’s privacy policy or your use of the website alone does not fulfil these requirements.

7. Enquiry reports and scoring

Visit history, search preferences and campaign sources collected with appropriate consent may be attached to an enquiry report to help an adviser understand your needs. A session-interest score out of 100 may be calculated using completeness of contact details, observed interactions and available security assessments. The coverage of available data and the score’s contributing factors are also shown in the report.

These scores are not credit scores, identity verification or conclusive spam detection. A session score alone does not make a binding decision about prices, contracts or your rights. Security tools may block suspicious submissions; if you believe a mistake occurred, contact the company for review and an alternative communication channel.

8. Retention and deletion

The current retention period for visit/session report metadata attached to an enquiry is 90 days; expired report data is subject to the central record-cleanup process. This does not mean all customer records or previously sent emails are erased after 90 days.

Contact, enquiry, contract and email records should be retained only as long as necessary for their purpose, applicable legal retention duties and the protection of rights. Data whose retention ground has ended is deleted, destroyed or anonymised through an appropriate process. If a legal retention requirement continues when your request is assessed, its scope and reason will be explained.

9. Security and access

Administrative and technical measures include access permissions, site/organisation scope controls, encrypted connections and security records. No internet service can guarantee absolute security. Avoiding unnecessary data and using official channels reduces risk. Please inform us of suspected incidents.

10. Your rights and applications

Under KVKK Article 11, you may learn whether data is processed, obtain information about processing, learn its purpose and whether use is consistent with that purpose, identify domestic or foreign recipients, request correction of incomplete or inaccurate data, request deletion or destruction when statutory conditions are met and notification of these actions to recipients, object to a detrimental result arising exclusively from automated analysis, and seek compensation for damage caused by unlawful processing.

Send applications in writing to the address above or through an electronic method meeting the applicable application rules. [email protected] is our contact address for questions and applications; registered-email and other procedural requirements apply to formal electronic applications. Proportionate identity verification and information needed to resolve the request may be requested. Applications are answered as soon as possible and within 30 days under the legal procedure; a legally permitted fee may apply where the operation entails additional cost. Your right to apply to the Turkish Personal Data Protection Board remains available.

Where EU/EEA or another jurisdiction’s data protection rules apply to a specific activity, their additional rights remain unaffected. These may include restriction, portability, objection and a complaint to the competent supervisory authority, to the extent applicable.

11. Children, scope and updates

Our services are not designed for children. Minors should not submit transaction requests or sensitive information without the necessary support of a parent or legal representative. Contact us about unnecessary data or information shared by mistake.

The current update date appears above. Significant changes should be communicated appropriately; a policy update does not itself create new explicit consent. For website usage rules, see our Terms of Use.