Privacy Policy

1. Data controller

The controller of your personal data on this site is FINEHOME K X3 Ι.Κ.Ε. (Γ.Ε.ΜΗ. 171664006000), Καραολή Δημητρίου των Κυπρίων 30, 546 30 Thessaloniki, Greece, trading as Golviz – Fine Home and Golviz. Contact: invest@goldenvizeler.com. Because we are established in Greece, your data is processed under the EU General Data Protection Regulation (GDPR) wherever you live, including Türkiye; visitors in Türkiye can also read our KVKK notice.

2. What we process, why, and on what basis

• Enquiry / "I'm interested" form (name, phone, email, visit dates, your note): to pass your request to the relevant real estate office so it can reply. Basis: performing the service you requested (GDPR Art. 6(1)(b)).
• Listing alerts (email): to send you listings matching a search you set up. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Technical data (IP address, browser, error logs): to keep the site secure, block fake and automated submissions and fix errors. Basis: legitimate interest (Art. 6(1)(f)).
• Office account (office details, listings, payments): to run the account, the contract and invoicing. Basis: contract and legal obligation (Art. 6(1)(b), (c)).
• Analytics cookie: we measure the campaign source only if you consent. See the Cookie Policy.

3. Who receives your enquiry

When you send an enquiry, your name, phone, email and note go to the office that published the listing and, where the request is routed to several offices, to the offices that will handle it. Golviz management receives a copy to check that offices follow up. Other offices cannot see your contact details. The office that receives your enquiry becomes a controller in its own right when it contacts you and is responsible for its own privacy practices. We do not sell your data or share it with third parties for advertising.

4. Our service providers

These providers act only on our instructions under data processing agreements:

• Supabase (database and sign-in; EU, Ireland region), Vercel (hosting; functions in Dublin)
• Resend (email delivery), Cloudflare Turnstile (bot check)
• Cloudinary (images), Sentry (error logs), Stripe (office payments; card details never reach us)
• DeepL (translation) and Google Gemini (AI: search, assistant, translation fallback, listing import and content checks); details below
• Google Workspace (management mailbox invest@goldenvizeler.com: a copy of every enquiry we receive arrives here)
• GitHub (encrypted database backups), Firecrawl (reading listing pages that offices import; contains no customer data)
• Web Push (browser notifications, through the notification services of Apple, Google, Mozilla and Microsoft; encrypted)
• Google Analytics and Google Ads (only with cookie consent: visit statistics and ad measurement; IP address, browser details, pages viewed, enquiry and WhatsApp-click events)
• OpenFreeMap, Google Maps and YouTube (maps and videos; your IP address is visible to the provider when they load)

AI and translation. The name, phone number and email you type into an enquiry form are not sent to DeepL or Google; the AI assistants used by offices and by management see a customer only as an enquiry code, a masked name (for example "Al***"), a status and the listing of interest. When your enquiry message is translated into the office's language it goes to DeepL (to Google Gemini if DeepL is unavailable); before it is sent, phone numbers, email addresses, links and usernames are masked, but personal names written in the message are not. Personal names in appointment titles and notes are likewise not masked in the assistant's context (only phone numbers and email addresses are). Text you type into the search box or the assistant (up to 1,000 characters) is sent to Google Gemini to produce an answer. Listing texts that offices upload are translated and checked for content; office profile photos and logos are also checked with Google Gemini for inappropriate content and contact details. For this reason we recommend not writing personal details in your message or in those boxes unless needed.

For transfers outside the EU/EEA (for example to the US) we rely on safeguards such as the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

5. Retention

We keep data while the purpose continues and for legal retention periods, then delete or anonymise it. Deleted listings and appointments also stay in a trash for 30 days, then are permanently erased. Main periods for the copies kept on this site:

• Enquiry form: your name, phone, email and message are deleted after 12 months; the enquiry record itself (masked name, status, date, listing of interest) is deleted after 24 months. Closed enquiries are deleted after 6 months without activity. Management notes are deleted after 12 months.
• Appointments: titles and notes are anonymised after 24 months.
• Email records: the content of a sent email is deleted after 90 days, the record itself (recipient, subject, status) after 12 months.
• Office sign-up: IP addresses kept for rate limiting during sign-up are deleted after 30 days.
• Listing alerts: when you unsubscribe, your email address is replaced by a hash value and the record is deleted after 24 months. Unconfirmed subscriptions are deleted after 14 days.
• Deleted office accounts: contact details such as name, email, phone, WhatsApp and address are anonymised 90 days after the account is deleted; the account can be restored during that time. If an office asks for its personal data to be erased at once, we do not wait.
• Payment and invoice records: kept for 6 years from the end of the year of the transaction, as tax and accounting law requires; longer if a tax audit or a court case applies.

Offices that receive your enquiry keep their own copies for their own periods.

Backups. Encrypted daily backups of the database are kept for disaster recovery; they are stored, encrypted, in private repositories and on devices that only the operator can access. Backups are not kept longer than 90 days; older ones are deleted. Deleted data does not vanish from backups at once; if a backup is ever restored we delete the data of erased persons again.

6. Your rights

You can access, correct, erase, restrict, port and object to the processing of your data, and withdraw consent at any time. Write to invest@goldenvizeler.com; we verify your identity and reply within 30 days. When you ask for erasure we find the records tied to your address (copies of the enquiry, email records, listing-alert subscriptions) together with all their copies and delete them; we also tell the offices we sent your enquiry to, so that they delete their own copies (offices are separate controllers). Payment and invoice records cannot be erased until the legal retention period has ended (GDPR Art. 17(3)(b)); they are kept only for the legal obligation. If you are not satisfied you may complain to the Hellenic Data Protection Authority (dpa.gr) or, in Türkiye, to the KVKK Authority.

7. Security and breach notification

We protect data with encrypted connections, access control, role separation and encrypted daily backups. If a breach affects your data we notify the supervisory authority within 72 hours where required and tell you without undue delay when the risk to you is high.

8. Updates

When we change this policy we update the date above and announce important changes on the site.