Privacy notice

Data controller

This notice covers website visitors, people contacting us by telephone, email or WhatsApp, and individuals whose information is processed in connection with our services. The data controller is WOX GAYRİMENKUL DEĞERLEME VE DANIŞMANLIK LTD. ŞTİ. (WoxVal).

Postal address for requests: 23 Nisan Mah. Adalet Sok. No:12/14 Keçiören/Ankara, Türkiye. Email: [email protected].

Information and collection methods

There is no contact form on this website, and telephone calls are not audio-recorded. Information is collected electronically or on paper through calls, email, WhatsApp, site inspections and documents provided for the service.

Information includes names, contact details, enquiries and correspondence and, where needed for the service, title deeds, ownership and share details, property addresses and characteristics, projects, official documents and report contents. Documents may also contain identity and signature details. Third-party information is considered only to the extent needed for the work. Please do not send unnecessary identity documents, banking details or special-category personal data with an initial enquiry.

Purposes and legal grounds

Assessing quotation requests, defining the scope and delivering valuation or advisory services using necessary data relating to contracting parties: Article 5(2)(c) of Turkish Law No. 6698, where directly related to and necessary for entering into or performing a contract.

Mandatory business and accounting records and lawful authority requests: Article 5(2)(ç), compliance with a legal obligation. Using or retaining necessary records for claims and disputes: Article 5(2)(e), establishing, exercising or protecting a right.

Answering general enquiries, managing service communications and website security: Article 5(2)(f), necessary legitimate interests without prejudice to fundamental rights and freedoms. Each ground applies only to the relevant purpose and necessary data. Sending documents is not blanket consent to processing or marketing.

Recipients and sharing purposes

Enquiries reach the company’s authorised representative. Necessary information and documents may be shared with technical specialists and business partners in Türkiye to perform technical work and assessments required by the service. Title deeds and relevant official documents are shared through OneDrive links restricted to designated recipients. Information may also be provided to competent public authorities and courts where legally required.

Google Workspace, WhatsApp, Microsoft OneDrive and Cloudflare are used for communications, file storage and website delivery. Processing by these providers is assessed separately in relation to the service used.

Cloud services and international transfers

Having business partners in Türkiye does not mean that cloud and communication services process data only in Türkiye. Content, communication data or technical connection data may be processed abroad through these services.

Contractual confirmation of the applicable transfer safeguard under Article 9 of Turkish Law No. 6698 has not yet been completed for the accounts in use. This notice is neither consent to transfers nor an assurance of transfer compliance. Please do not send unnecessary personal documents through these channels; contact us first about document delivery methods.

Retention and deletion

The company’s retention period for client report files is five years from report delivery. This is not a statutory minimum for all personal data. Where a longer mandatory legal period or an ongoing dispute applies, only necessary documents are retained longer, with a recorded reason and end condition. Specific statutory report-retention duties are assessed according to the work and the entity concerned.

When the retention period and reason end, files under the company’s control are to be deleted and sharing links revoked; copies downloaded by recipients are handled separately. High economic value alone does not justify indefinite retention. Initial enquiries and quotations that do not become report files are retained only for their purpose and any necessary protection of rights or legal retention duty.

The main client archive is in a personal OneDrive account accessed only by the company’s authorised representative; selected documents may be shared as described above. The standard WhatsApp application is used without cloud chat backups.

Website use and cookies

The site code does not use advertising or behavioural-tracking cookies or an embedded WhatsApp chat plugin. Cloudflare Web Analytics is used for visit and page-view statistics and loading performance. According to the provider, this measurement does not create visitor identifiers through cookies or local storage. These statistics are not counts of unique clients or completed sales. Cloudflare may process technical data such as IP address, request time, requested page and browser details to deliver and secure the website. Necessary security technologies serve a different purpose from advertising tracking.

Opening WhatsApp or other external links takes you to the relevant provider’s service, where its own privacy terms also apply. Using a link does not constitute marketing permission.

Marketing communications

We do not currently send bulk advertising messages. Contacting us for a service or quotation does not grant permission for subsequent advertising. Any future marketing communications require a separate process for applicable permissions, information and opt-out rights.

Your rights and requests

Under Article 11 of Turkish Law No. 6698, you may ask whether your data is processed and request information, learn its purposes, whether use matches those purposes and its domestic or overseas recipients, request correction and, where statutory conditions apply, deletion or destruction and notification to recipients. You may object to an adverse outcome based solely on automated analysis and seek compensation for unlawful processing.

You may send a written request to the company address above. You may also apply to [email protected] from an email address previously provided to us and held in our records, or ask for guidance on application methods. Requests must include your name, signature if written, legally required identifying information, postal address, available notification email/telephone and the request itself. Identity verification is proportionate; an identity document is not required for an initial general enquiry.

Valid requests are answered as soon as possible and within 30 days. Requests are generally free of charge; where additional costs arise, only the tariff set by the Turkish Personal Data Protection Board may apply.