Privacy and Personal Data Protection Notice

1. Purpose and Scope

This notice explains how personal data is processed in respect of people who visit the cbimperia.com website, complete a contact or project information form, request an investment meeting, or contact IMPERIA by telephone, e-mail or WhatsApp.

Your personal data is processed in accordance with Law no. 6698 on the Protection of Personal Data and related legislation, for specified, explicit and legitimate purposes, and in a manner connected with, limited to and proportionate to those purposes.

2. Data Controller

The data controller in respect of your personal data is:

In this notice, “IMPERIA” refers to the data controller identified above, namely IMPERIA Gayrimenkul – Cahit Bahçıvan.

3. Personal Data That May Be Processed

Depending on the nature of your contact with IMPERIA, the following personal data may be processed:

Identity data

Name and surname.

Contact data

Telephone number, e-mail address and preferred method of contact.

Client and enquiry data

The service, project, unit or residence type you are interested in; your investment preferences; your message; your advisory request; meeting notes and communication history.

Transaction security and technical data

The date and time the form was submitted, the source page, the referring page, browser and device type, technical error and security records, UTM and campaign source information, and limited or anonymised IP information kept for security purposes.

Cookie and preference data

Site language, cookie preferences and, where you have given explicit consent, analytics or performance information.

Legal process data

Records relating to data protection applications, complaints, requests and the responses given to them.

IMPERIA does not request special categories of personal data through the website forms. Please do not write health data, biometric data, criminal convictions, political opinions, religious beliefs or similar sensitive information into the message fields.

4. Methods of Collection

Your personal data may be collected by the following means:

• The contact, project information and meeting request forms on the website
• E-mail correspondence
• Telephone calls
• WhatsApp messages
• Face-to-face or online meetings
• Website and server records
• Cookies and similar technologies
• Documents and information you share directly

Data may be processed wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system.

5. Purposes of Processing

Your personal data may be processed for the following purposes:

• Responding to your contact or information request
• Providing information about the project or service you are interested in
• Planning investment and real estate advisory meetings
• Managing appointment and follow-up processes
• Following up client requests through the CRM system
• Assessing project, unit or service options suitable for you
• Contacting the project developer or business partner in relation to your request
• Improving service quality and client processes
• Ensuring form, e-mail and system security
• Preventing misuse, spam submissions and unauthorised access
• Fulfilling legal obligations
• Establishing, exercising or protecting a right
• Responding to requests from competent authorities and institutions
• Carrying out statistical and reporting work
• Carrying out analytics or marketing activities where you have given explicit consent

Your personal data is not automatically used to send advertising or marketing messages unrelated to your request.

If commercial electronic messages are planned, a separate and optional permission process is carried out for that purpose.

6. Legal Grounds

Depending on the nature of the specific processing, your personal data may be processed on the following legal grounds:

• That it is directly related to the conclusion or performance of a contract
• That it is mandatory for the data controller to fulfil a legal obligation
• That processing is mandatory for the establishment, exercise or protection of a right
• That processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• That it is expressly provided for by law
• The explicit consent of the data subject, in respect of analytics, advertising, marketing or non-essential cookie operations for which explicit consent is required

The core processing carried out in order to respond to a contact or project information request is not based on explicit consent alone.

The duty to inform and explicit consent are separate matters.

7. Parties to Whom Personal Data May Be Transferred

Your personal data may be transferred to the following groups of recipients, limited to and to the extent necessary for the purpose of processing:

• Suppliers providing website, hosting, database, e-mail, security and technical support services
• Brevo or similar e-mail delivery service providers
• Supabase or similar database and cloud infrastructure providers
• Technical service providers used to develop and host the website
• Only where you make an enquiry about a specific project, the relevant project developer, project owner or authorised sales partner
• Professional advisers providing legal, accounting and information technology services
• Competent public authorities, courts, enforcement offices and other legally authorised bodies

Where your enquiry about a specific project is to be transferred to the project developer, only the data necessary to follow up the enquiry is shared.

Your personal data is not sold to third parties.

8. Transfers Abroad

Service providers located abroad, or using servers abroad, may be used for the website, e-mail delivery, database, cloud infrastructure and technical support services.

For this reason, limited personal data such as name, surname, e-mail, telephone, message, enquiry details and technical records may be processed abroad or transferred abroad.

Transfers abroad are carried out taking into account the conditions set out in Article 9 of Law no. 6698 and the applicable transfer mechanisms.

Where a transfer or cookie activity requires explicit consent, the relevant operation is not initiated without the necessary information being provided and permission obtained.

9. Retention Periods

Personal data is retained only for as long as necessary for the purpose for which it is processed.

Contact and project enquiries that do not result in a contract or an active advisory relationship are retained for no more than two years from the date of last contact.

Where an advisory, brokerage, sales or contractual relationship is established, the relevant records may be retained for the duration of that relationship and thereafter for the applicable statutory retention, limitation and evidentiary periods.

Records of legal applications and disputes are retained until the relevant process is concluded and the applicable periods have expired.

Technical security and system records are retained for no more than twelve months, according to security and error-investigation needs.

Cookie preferences are retained for no more than six months from the date of the preference. If the policy or the cookies used change, you may be asked to make your choice again.

Where the retention period expires or the purpose of processing ceases to exist, the data is deleted, destroyed or anonymised.

10. Data Security

IMPERIA applies appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data and to ensure that data is stored securely.

These measures may include limiting access rights, the use of secure connections, user authorisation, logging and error tracking, confidentiality obligations, supplier controls and the necessary security updates.

No transmission of data over the internet can be guaranteed to be entirely free of risk. Reasonable and appropriate security measures are nevertheless applied.

11. Rights of the Data Subject

Under Article 11 of Law no. 6698, by applying to the data controller you have the right to:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose of processing and whether the data is used in accordance with that purpose
• Know the third parties to whom the data is transferred, in Türkiye or abroad
• Request rectification if the data has been processed incompletely or inaccurately
• Request erasure or destruction of the data within the conditions provided by law
• Request that rectification, erasure or destruction be notified to the third parties to whom the data has been transferred
• Object to a result arising against you as a consequence of the data being analysed exclusively by automated systems
• Claim compensation for damage suffered as a result of the unlawful processing of the data

Any rights that visitors located outside Türkiye may have under the mandatory legislation to which they are subject are reserved.

12. Applying to the Data Controller

You may submit your requests under Turkish data protection law by one of the following means:

It is recommended that the words “Kişisel Veri Başvurusu” be used in the subject line of your e-mail or in your written application.

The application must contain the following information:

• Name and surname
• A signature, in the case of written applications
• The Turkish national identity number for citizens of the Republic of Türkiye; the passport or identity number for foreign nationals
• An address for service of notice
• An e-mail address and telephone number for notification, if any
• A clear and comprehensible description of the request
• Information and documents supporting the request

Applications are concluded as soon as possible according to the nature of the request, and in any event within thirty days at the latest.

13. Children's Data

The website is not directed at children.

Persons under the age of eighteen should not submit personal data through the site. If it is understood that a child's personal data has been submitted without the knowledge of a parent or legal representative, the necessary examination may be carried out and the data may be deleted.

14. Other Websites

The website may contain links to third-party websites or social media platforms.

IMPERIA is not responsible for the privacy practices of those sites. It is recommended that the relevant privacy texts be reviewed before visiting third-party sites.

15. Changes to This Notice

This notice may be updated if there is a change in the systems or services used or in the applicable legislation.

The current version and the date of last update are published on this page.

16. Contact

For questions about this notice or about your personal data: