GDPR Privacy Notice

Data Controller Identity

Data controller: FINEHOME K X3 Ι.Κ.Ε. (Ιδιωτική Κεφαλαιουχική Εταιρεία), trading as «Golviz – Fine Home»
Γ.Ε.ΜΗ. No: 171664006000
Address: Καραολή Δημητρίου των Κυπρίων 30, 546 30 Thessaloniki, Greece
Email: invest@goldenvizeler.com

1. Purpose and Legal Basis

This notice has been prepared by the data controller, FINEHOME K X3 Ι.Κ.Ε. (Golviz – Fine Home), pursuant to the EU General Data Protection Regulation (GDPR – 2016/679). Your personal data is processed in accordance with the purposes and legal bases set out below.

2. Personal Data Processed

• Identity data: First name, last name
• Contact data: Email address, phone number
• Transaction data: Enquiry content, property preferences
• Security data: IP address, browser information, login time

3. Purposes of Processing Personal Data

• Publishing property listings and passing enquiries to the relevant real estate offices
• Replying to your enquiry and communication
• Fulfilment of legal obligations
• Improvement of service quality
• Contract management processes

Method of collection and legal basis: Your data is collected electronically through the site's enquiry and listing-alert forms, sign-in/registration screens and the site's technical logs. Legal bases: processing necessary for the conclusion or performance of a contract in connection with your request (KVKK Art. 5/2-c), legal obligation (Art. 5/2-ç), legitimate interest (security and fraud prevention, Art. 5/2-f) and your explicit consent for listing alerts and campaign measurement (Art. 5/1). You can withdraw consent at any time.

4. Transfer of Personal Data

Your personal data may be shared with the real estate office(s) you send an enquiry to, service providers and legal authorities in accordance with GDPR regulations. All transfers are carried out with the necessary security measures in place. Our service providers:

• Supabase (database and sign-in), Vercel (hosting)
• Resend (email delivery), Cloudflare Turnstile (bot check), Cloudinary (images), Sentry (error logs), Stripe (office payments)
• DeepL (translation), Google Gemini (AI)
• Google Workspace (management mailbox), GitHub (encrypted backups), Firecrawl (reading listing pages)
• Google Analytics and Google Ads (only with cookie consent: visit statistics and ad measurement; IP address, browser details, pages viewed, enquiry and WhatsApp-click events)
• OpenFreeMap, Google Maps and YouTube (maps and videos), Web Push (notification services of Apple, Google, Mozilla and Microsoft)

A customer's name, phone and email are not sent to AI and translation providers; an enquiry message is translated after phone numbers, emails, links and usernames have been masked (personal names in the message are not masked); text typed into the search box or the assistant goes to Google Gemini. Our Privacy Policy explains in detail what data goes to which provider.

5. Rights of Data Subjects

Under GDPR Articles 15–22, you have the following rights:

• To learn whether your personal data is being processed
• To request information if it is being processed
• To learn the purpose of processing and whether data is used in accordance with that purpose
• To know the third parties to whom data is transferred domestically or abroad
• To request correction of incomplete or inaccurate data
• To request erasure or destruction under Article 17 GDPR
• To request restriction of processing
• To object to automated decisions producing adverse effects
• To claim compensation for damages arising from unlawful processing

6. How to Exercise Your Rights

To exercise your rights, you may send an email to invest@goldenvizeler.com or submit a written request to our address above. Your requests will be answered within 30 days at the latest. For erasure requests, records tied to your address are found and deleted together with all their copies; the offices you sent your enquiry to are told to delete their own copies (offices are separate controllers). Payment and invoice records cannot be erased during the legal retention period.

7. Data Security

Technical and administrative measures such as SSL encryption, secure databases and access controls are applied to ensure the security of your personal data. Encrypted daily backups of the database are kept for disaster recovery; if a backup is restored, the data of erased persons is deleted again.

8. Retention

Data is kept while the purpose continues and for legal retention periods, then deleted or anonymised. The main periods are in section 5 of our Privacy Policy.