Privacy notice

Effective from 15 November 2026. This notice explains how ALFO (alfo.tr), a real-estate agency in North Cyprus, handles personal data when you use island.alfo.tr and when you contact us through it. We process personal data under the North Cyprus Personal Data Protection Law (Kişisel Verilerin Korunması Yasası, Law No. 89/2007).

Who is responsible

ALFO is the controller of the personal data described here. For any question about your data, or to exercise your rights, write to [email protected].

What we collect

Enquiries and requests: when you ask about a development or a home, request a call back or a viewing, ask about a stay or a lease, or ask us to list your home, we collect your name, your email address and/or phone number, your message, the times you prefer, and, for rentals, your dates, the number of adults and children and the lease term you want. When you list a home we also collect its address, area, type and your note about it.

Website chat: if chat is offered, we keep the messages you write and, when you ask to speak to a person, your name, email address and phone number. Answers written by our assistant are marked as AI answers.

Customer area: if you sign in to the customer area, we use the email address or phone number you sign in with to send you a one-time code. Inside the customer area we keep what you submit there, such as service requests, listing requests, tenancy applications (including employment, income, referee and guarantor details) and documents you upload.

Identity and due diligence: when you reserve or buy a home, list one with us or apply for a tenancy, the law may require us to verify your identity and the source of funds. We then keep the documents and checks this requires.

Technical data: the address of the page you sent a request from, including campaign tags (such as utm_source or gclid) in that address, and your browser's time zone. We keep your IP address only as a one-way digest, to limit abuse of our forms. Campaign tags are kept in a cookie only if you allow measurement; see our cookie policy.

Why we use it and on what basis

To answer your enquiry, arrange viewings and prepare offers or contracts you ask for: these are steps taken at your request. To meet our legal obligations, such as identity checks and keeping transaction records. To keep the site and our records secure and to prevent abuse: our legitimate interest. To send you news and offers by email or WhatsApp: only with your consent, which you can withdraw at any time. To measure how visitors arrive at the site: only if you allow it on the cookie banner.

Who we share it with

Developers: we market homes on behalf of their developers. We pass your enquiry to the developer of a home only if you tick the box that allows it, and then only your name, your email address or phone number, your question or preferred times, your language and the consent you gave.

Service providers: Cloudflare carries the site's traffic and protects it, so your requests pass through its network, which may be outside North Cyprus. The site, its data and our assistant's language model run on equipment we operate ourselves; we do not send your messages to an outside AI provider.

Authorities: we disclose personal data to public authorities when the law requires it. We do not sell personal data.

How long we keep it

An enquiry or conversation that does not lead to a transaction is deleted or anonymised 24 months after its last activity. An offer that is not accepted is kept for 24 months. Contracts, payments and the records the law requires us to keep are kept for 10 years. Our audit trail is kept for at least 7 years and holds personal values only as digests. Backups are kept for at most 37 days.

Your rights

You may ask whether we hold data about you and for a copy of it, ask us to correct it, to erase it, or to restrict or stop using it, and you may object to its use and withdraw a consent at any time. When we erase your data we keep your email address and phone number on a suppression list so that we do not contact you again. Where the law requires us to keep a record, we minimise it instead of erasing it.

To make a request, write to [email protected]. We will confirm your identity before we act, and we answer within 30 days; where a request is complex we may extend this once, by up to 60 days, and tell you why. You may also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) of North Cyprus.

Security

The site is served only over encrypted connections. Our staff sign in with a password and a second factor, see only what their role allows, and their actions are recorded in an audit trail. If a breach puts your data at risk, we report it to the Personal Data Protection Board and tell you where the law requires it.

Children

The site is meant for adults. We do not knowingly collect personal data from anyone under 18.

Changes to this notice

We will publish any change to this notice on this page, with its new effective date.