Privacy Policy
How Sun & Sky Real Estate collects, uses, shares and protects personal data when you use this website, write to us on WhatsApp, Instagram or Messenger, or talk to our AI assistant.
Last updated: 21 October 2026
1. Scope
This Privacy Policy applies to personal data processed by Sun & Sky Real Estate through this website, our official WhatsApp Business, Instagram and Facebook Messenger accounts, e-mail, telephone and in-person meetings, and the AI assistant that helps us answer messages. It is prepared in line with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to you, the EU General Data Protection Regulation ("GDPR").
Our separate KVKK Clarification Text (Aydınlatma Metni) fulfils the specific information duty under Article 10 of the KVKK. Our Cookie Policy explains the cookies used on this website.
2. Data controller
The data controller responsible for your personal data is:
- Trade name: Sun And Sky Emlakçılık Ltd. Şti.
- Brand: Sun & Sky Real Estate
- MERSİS number: 3137368648187410
- Tax office / tax number: Esenyurt Vergi Dairesi / 7820672580
- Trade registry: İstanbul Ticaret Sicil Müdürlüğü, No. 966471
- Registered address: Gökevler Mahallesi 2312. Sokak No: 16/91, Esenyurt, İstanbul, Türkiye
- Privacy e-mail: info@sunandskyrealestate.com
3. Personal data we collect
We collect only the data needed to answer you and to provide the real estate services you ask for. Depending on how you contact us, this may include:
- Identity data: name and surname, nationality and, if you proceed with a purchase, title deed, residence permit or citizenship application, passport and other identity document details.
- Contact data: telephone or WhatsApp number, e-mail address, country and city of residence, social media username.
- Customer request data: property preferences, budget range, preferred locations, viewing appointments, offers, questions about citizenship, residence permits and after-sales services.
- Contact form submissions: first and last name, e-mail address, telephone number, your message, the page and country it was sent from, the browser user agent and delivery status.
- Communication records: the content of e-mails, WhatsApp, Instagram and Messenger messages, comments and replies, voice notes, photos or documents you choose to send, and the date, time and delivery status of messages.
- Platform data provided by Meta: your WhatsApp profile name and number, Instagram or Facebook username, account identifier (such as a page-scoped or Instagram-scoped ID), profile picture and the ad or post that started the conversation, as made available under your platform settings.
- Transaction data: purchase, reservation and brokerage agreement details, payment records and invoicing data when you buy or sell through us.
- Technical data: IP address, browser and device type, pages requested, error and security logs, and cookies described in our Cookie Policy.
We do not ask for special categories of personal data (such as health, religion or biometric data). Please do not send such data in messages unless it is strictly necessary for a service you requested; if we receive it, we process it only as permitted by Article 6 of the KVKK.
4. Our AI assistant
To reply quickly in several languages, messages you send to our official WhatsApp, Instagram and Messenger accounts may be answered or drafted by an AI assistant operated on our behalf. The assistant uses the text of your message, the conversation history and our own property and service information to produce a reply.
To do this, the relevant message content is sent to AI service providers that process it on our instructions to generate the reply. We do not use the AI assistant to make decisions that produce legal effects for you or similarly significantly affect you. Prices and availability given in conversations are indicative and are always confirmed by a human advisor before any agreement.
You can ask to speak to a human advisor at any time by saying so in the conversation. You can also object to AI-assisted replies by writing to us; we will then handle your conversation manually.
5. Purposes and legal bases
We process personal data for the purposes below and rely on the legal bases in Article 5 of the KVKK and, where applicable, Article 6 of the GDPR:
| Purpose | Legal basis (KVKK / GDPR) |
|---|---|
| Answering enquiries received through the website, WhatsApp, Instagram, Messenger, e-mail or telephone, and sending the property information you ask for | Steps taken at your request before a contract (KVKK art. 5/2(c); GDPR art. 6(1)(b)); our legitimate interest in answering customer messages (KVKK art. 5/2(f); GDPR art. 6(1)(f)) |
| Arranging viewings, preparing offers, brokerage, title deed, residence permit and citizenship application support and after-sales services | Establishment and performance of a contract (KVKK art. 5/2(c); GDPR art. 6(1)(b)) |
| Using an AI assistant to draft or send replies and routing conversations to the right language or advisor | Legitimate interest in fast, multilingual customer service (KVKK art. 5/2(f); GDPR art. 6(1)(f)); steps taken at your request (KVKK art. 5/2(c); GDPR art. 6(1)(b)) |
| Meeting legal obligations, including real estate trade rules, tax and accounting, anti-money-laundering (Law No. 5549) and requests from authorities | Legal obligation and explicit provision of law (KVKK art. 5/2(a) and (ç); GDPR art. 6(1)(c)) |
| Keeping records needed to establish, exercise or defend legal claims | KVKK art. 5/2(e); GDPR art. 6(1)(f) |
| Operating, securing and improving the website and our messaging systems, preventing fraud, spam and misuse | Legitimate interest (KVKK art. 5/2(f); GDPR art. 6(1)(f)) |
| Sending new listings, campaigns or newsletters you have asked to receive | Explicit consent (KVKK art. 5/1; GDPR art. 6(1)(a)) and, for commercial electronic messages, consent under Law No. 6563 |
Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing carried out before it.
6. Who we share data with
We do not sell personal data. We share it only where needed for the purposes above, with:
- Meta Platforms (WhatsApp, Instagram, Facebook Messenger), which operate the channels you use to contact us. Meta processes messages under its own terms and privacy policies and, for the WhatsApp Business Platform, also as our service provider.
- AI service providers that generate or draft replies on our behalf.
- Cloudflare, which hosts this website, stores contact form submissions in its database service and provides content delivery, security (including Turnstile spam protection on the contact form) and storage services.
- E-mail delivery providers (such as Resend) that send contact form notifications to us and confirmation e-mails to you.
- Google, which provides business e-mail, document and spreadsheet services we use to manage enquiries and listings, and YouTube video embeds on some listing pages.
- Other IT, hosting, database and communication service providers that support our systems.
- Property developers, sellers, notaries, sworn translators, valuation companies, banks, lawyers and other parties involved in a transaction, only to the extent needed for the service you asked for.
- Public authorities, such as land registry offices (Tapu), the Presidency of Migration Management, tax offices, MASAK and courts, where the law requires it.
Our service providers may only use personal data on our instructions and must keep it confidential and secure.
7. International transfers
Some of the service providers listed above (including Meta, Google, Cloudflare and AI service providers) store or process data on servers located outside Türkiye, mainly in the European Union and the United States.
Transfers abroad are carried out in line with Article 9 of the KVKK: on the basis of an adequacy decision where one exists, appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority, or, for occasional transfers, one of the exceptions in Article 9(6), such as the transfer being necessary to perform a contract with you or to take steps you requested. Where the GDPR applies, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
8. How long we keep data
We keep personal data only for as long as needed for the purpose it was collected for and for the periods required by law, after which it is erased, destroyed or anonymised in line with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. As a rule:
- Enquiries and conversations that do not lead to a transaction: up to 2 years after the last contact.
- Contracts, transaction, invoicing and accounting records: 10 years after the end of the contractual relationship (Turkish Commercial Code, Tax Procedure Law, Turkish Code of Obligations).
- Customer identification records under anti-money-laundering rules: 8 years from the transaction.
- Marketing consent and opt-out records: as long as the consent is valid and 1 year after withdrawal, plus the period required by Law No. 6563.
- Security and server logs: up to 2 years, unless needed longer to investigate an incident.
Where a dispute or legal request is pending, we may keep the relevant data until it is finally resolved.
9. Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed;
- request information about the processing if it is processed;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request correction of incomplete or inaccurate data;
- request erasure or destruction of your data under the conditions of Article 7 of the KVKK;
- request that corrections, erasure or destruction be notified to the third parties to whom the data was transferred;
- object to a result that is against you and arises from analysis of your data exclusively by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection (including to processing based on legitimate interests and to direct marketing at any time), and the right not to be subject to a decision based solely on automated processing. You can withdraw consent at any time.
You also have the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and, where the GDPR applies, with the supervisory authority of your country of residence.
10. How to exercise your rights
Send your request to info@sunandskyrealestate.com or by registered mail to our registered address. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, a written request should include your name and surname, signature (for written applications), nationality, a passport or identity number, your contact address, e-mail or telephone number, and a clear description of your request.
We respond free of charge as soon as possible and within 30 days at the latest. If the request requires a separate cost, we may charge the fee set by the Personal Data Protection Board. We may ask you to verify your identity before acting on a request. If your request is rejected, the answer is found insufficient, or we do not respond in time, you may complain to the Board within 30 days of our answer and in any case within 60 days of your application.
11. Children
Our services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.
12. Security
We take the technical and administrative measures required by Article 12 of the KVKK to prevent unlawful processing of, and access to, personal data. These include encrypted connections (HTTPS), access controls limited to authorised staff, two-factor authentication on business accounts, logging, use of reputable service providers and confidentiality obligations for staff. No transmission over the internet is completely secure; if a data breach occurs, we will notify the Board and affected persons as required by law.
13. Third-party platforms and links
When you use WhatsApp, Instagram, Facebook, YouTube or other third-party services, their own privacy policies also apply to the data they collect. We are not responsible for the practices of third-party websites linked from our pages.
14. Changes to this policy
We may update this Privacy Policy when our services, providers or legal requirements change. The current version is always published on this page with its last-updated date. Where changes are significant, we will take reasonable steps to inform you.
15. Contact
For any privacy question, write to info@sunandskyrealestate.com.
Sun & Sky Real Estate
Privacy contact
Write to us to ask a privacy question, exercise any of your rights, or withdraw consent. We reply within 30 days at the latest.