Privacy Policy

The site currently has no visitor accounts, on-site payment or checkout. The enquiry form collects name, email, phone country code and number, optional nationality, interest, budget band, message, project/page/brochure context, any Match brief carried in the URL, language, newsletter choice, UTM parameters or gclid present in the URL, and technical anti-spam fields. It sends them to the site endpoint and, when configured, Zoho CRM EU; on failure, the visitor's device opens an email draft.

Operational data are collected from browser requests and provider infrastructure. The enquiry API rate-limits with a process-lifetime salted hash of the visitor IP header, not a permanent visitor profile. Sanitised CSP reports may contain the violated directive, status code and document/source/blocked URLs without query strings. Hosting providers process standard request data such as IP, URL, time and browser information to serve and protect the site.

Two first-party localStorage keys are found: icb-theme, storing dark, light or system after a visitor changes appearance, and icb.shortlist.v1, storing the visitor's saved shortlist of projects and offers (see the S1 module below). Neither sends itself to the server on its own. No first-party cookies, analytics/ad pixels, account storage or payment storage are active.

Mapbox loads on map pages and may receive IP, user agent, request and interaction data directly from the browser. Consent-gated Zoho SalesIQ is not loaded on entry; if the visitor chooses to load chat, Zoho may use its own cookies/storage. WhatsApp opens outside the site and may process connection/device data under its own terms; only if the visitor sends the prepared message does the company receive its content and the profile/phone details visible in the chat. Where a shortlist WhatsApp button is shown, the prepared message already includes the name, district and price of each saved shortlist item before the visitor sends it; see S1 below for what is stored and what that button sends.

Purposes and KVKK bases are: requested enquiry and pre-contract steps, Article 5/2(c); CRM lead management and proportionate follow-up, Article 5/2(f) legitimate interest after balancing visitor rights; legal/accounting obligations and claims, Articles 5/2(ç) and 5/2(e); security, abuse prevention, necessary hosting, maps and CSP diagnostics, Article 5/2(f); optional marketing and non-essential chat storage, explicit consent where required plus commercial-electronic-message rules. Special-category data are not requested and should not be put in free text; if received incidentally, they must be restricted and deleted unless an Article 6 condition applies.

Recipients, only for the stated purposes, are authorised company staff/advisers, Zoho CRM/SalesIQ, hosting and email providers, Mapbox, WhatsApp/Meta when chosen by the visitor, professional advisers and legally authorised public bodies. Data are obtained directly from the visitor, the URL/browser and those service channels by automated or electronic means.

Foreign-provider use must satisfy KVKK Article 9 as well as one of the conditions in Article 5 or 6. Routine transfers must not rely on the Article 9/6 incidental-transfer exceptions. The owner/lawyer must document the actual destination and role of each provider and confirm an adequacy decision or appropriate safeguard; a KVKK standard contract, if used, must be signed in the prescribed form and notified to the Authority within five business days. This policy does not claim that this release gate has been completed.

Retention: five years after the last contact with the enquirer, the owner's binding commitment recorded 3 September 2026 and stated in full in the KVKK notice below; a longer statutory retention or limitation period applies instead to the records it covers, and the security hash described above expires after ten minutes rather than being retained at all.

Under KVKK Article 11, data subjects may ask about processing, purposes and recipients; request correction, deletion/destruction and third-party notice where applicable; object to an adverse result produced solely by automated analysis; and seek compensation for unlawful processing. Responses are given as soon as possible and no later than 30 days.

If GDPR Article 3 applies, EU/EEA data subjects also have applicable rights to access, rectification, erasure, restriction, portability, objection, consent withdrawal and supervisory-authority complaint. GDPR bases are requested pre-contract steps/contract, legitimate interests, legal obligation and consent; this addendum does not assert that mere site accessibility makes GDPR apply.