Campaign Pages Privacy Notice

Last updated: 24 October 2026

This notice explains how we process personal data collected through the contact form and cookies on our campaign pages, under the Turkish Personal Data Protection Law No. 6698 (KVKK) Art. 10 and, for people living in the European Union, the General Data Protection Regulation (GDPR) Art. 13.

Controller

MUHAMMED USTEM MERHABA EMLAK (Merhaba Emlak), Muratpaşa Mah. Cumhuriyet Cad. No: 155 A, Bayrampaşa/İstanbul. E-mail: info@merhabaemlak.com. MERSIS: 1578175152200001.

Data we process

What you enter in the form: name, phone, e-mail, country of residence, the property's province/district, type and number, the service you want, your preferred contact channel and time, your message and your answers to any extra questions; which campaign link brought you (campaign code and UTM data); your marketing permissions, if you gave them; your cookie choice (with a pseudonymous choice ID). For form security, your IP address and browser details are processed during bot protection (Cloudflare Turnstile) and rate limiting. Only if you consent to marketing cookies: Meta cookie IDs (_fbp, _fbc) and the ad click ID (fbclid).

How we collect it

Electronically, through the form and cookies on the campaign page, by automated and partly automated means. The required form fields are needed to handle your request; without them we cannot contact you.

Purposes and legal bases

Receiving your contact request, passing it to the right consultant, talking to you and preparing our offer: steps prior to entering into a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Your request may be scored automatically from the details you give so our consultants can prioritise it; the score alone does not lead to any decision about you. Form security and abuse prevention (Turnstile, rate limiting) and recording which of our ad campaigns brought you: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Sending you marketing messages: only the consent you give per channel (GDPR Art. 6(1)(a); KVKK Art. 5(1); Turkish Law No. 6563). Measuring our ads with Meta Pixel and the Conversions API: only your consent to marketing cookies (GDPR Art. 6(1)(a); KVKK Art. 5(1)). Meeting legal obligations and defending legal claims (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e)).

Recipients and transfers

We are a business established in Türkiye; if you live in the EU, you give the details in the form directly to us, a controller in Türkiye (the European Commission has not adopted an adequacy decision for Türkiye). We share your data with: the consultant who will contact you; infrastructure providers processing it on our behalf (hosting and bot protection: Cloudflare; e-mail: Resend; both are US companies); if you give a marketing permission, the Turkish Message Management System (İleti Yönetim Sistemi A.Ş., İYS) to record it, as Turkish law requires; and competent authorities and courts when they request it. If you consent to marketing cookies and send the form, your e-mail, phone and country are converted to SHA-256 hash values and sent, with your IP address, browser details and Meta cookie IDs, to Meta: to Meta Platforms Ireland Ltd. if you live in the EU, otherwise to Meta Platforms, Inc. (USA). Meta uses these values to match people to their accounts, deletes the contact details after matching, may keep the event data for up to two years and may transfer data to the USA. Your form answers, property details and message are never sent to Meta. Under GDPR Chapter V, transfers abroad rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. Under KVKK Art. 9 we are signing the Turkish Data Protection Board's standard contracts with these providers and notifying the Board; we will update this notice once that is complete.

Joint controllership with Meta

Only if you consent to marketing cookies and live in the EU: we and Meta Platforms Ireland Ltd. are joint controllers for collecting data with the Meta Pixel and sending it to Meta (GDPR Art. 26). The essence of the arrangement: we are responsible for informing you and obtaining your consent for this step; you can exercise your rights of access, rectification, erasure, restriction and portability (GDPR Arts. 15–20) for the data sent to Meta against Meta; we pass on to Meta any request we receive that concerns Meta. Meta alone is responsible for what happens to the data once Meta has it: Meta Privacy Policy, https://www.facebook.com/privacy/policy.

Retention

Request records are kept for up to 2 years after the request is closed and are deleted in a yearly scheduled destruction. If a service agreement follows, the property file is kept for at least 5 years (Turkish Regulation on Real Estate Trading, Art. 14(2)(k)) and for the periods set by contract and tax law. Proof of marketing permissions is kept for at least 3 years after the permission ends; proof of phone-marketing permissions for at least 5 years from when it was given and from each use. Your cookie choice stays in your browser under a pseudonymous ID for up to 180 days; the record of your choices is kept on our server for 3 years as proof, without your IP address or contact details.

Your rights

Under GDPR Arts. 15–22 you may access, rectify or erase your data, restrict its processing, receive it in a portable format and withdraw any consent at any time, without affecting earlier processing. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (GDPR Art. 21). Under Turkish KVKK Art. 11 you also have the rights listed there, including to learn whether and why your data is processed and to whom it was transferred, to have corrections and erasures notified to those recipients, to object to an adverse result of purely automated analysis and to claim compensation. Write to info@merhabaemlak.com or to the postal address above; we reply free of charge within 30 days. If we refuse your request, our answer is inadequate or we do not answer in time, you may also complain to the Turkish Personal Data Protection Board (KVK Kurulu) within 30 days of learning our answer and in any case within 60 days of your request (KVKK Art. 14).

Complaints (if you live in the EU)

You may lodge a complaint with the data protection supervisory authority of the EU country where you live, work or where you believe the infringement took place (GDPR Art. 77).

Our EU representative

Our EU representative under GDPR Art. 27: Ahmet Sina Ustem, Bergstraße 2, 87509, Deutschland, ahmetsina@merhabaemlak.com. You may also contact this representative about your personal data.

Cookies

These are the cookies our campaign pages can use. Non-essential cookies (Meta) are only set if you allow them; you can change your choice at any time with the “Cookie preferences” link at the bottom of the campaign page.

merhaba.session_token
Type
Strictly necessary
Set by
Merhaba Emlak (first party)
Purpose
Keeps you securely signed in to your account.
When
Only when you sign in.
Duration
7 days (renewed while you use it) or until you sign out
merhaba.session_data
Type
Strictly necessary
Set by
Merhaba Emlak (first party)
Purpose
A short-lived copy of the session, so pages that need sign-in open quickly.
When
Only when you sign in.
Duration
5 minutes
me_consent
Type
Strictly necessary
Set by
Merhaba Emlak (first party)
Purpose
Stores your cookie choice on campaign pages (whether you allowed marketing cookies) and a pseudonymous choice ID, so we don't ask again and can prove your decision.
When
Only when you save your cookie choice on a campaign page.
Duration
180 days
NEXT_LOCALE
Type
Functional
Set by
Merhaba Emlak (first party)
Purpose
Remembers the site language you chose (Turkish / English).
When
Only when you change the language with the language switcher.
Duration
1 year
_fbp
Type
Marketing (Meta)
Set by
Meta Platforms Ireland Ltd. (on our domain, set by the Meta Pixel)
Purpose
The ID the Meta Pixel uses to recognise your browser and measure the effect of our ads (visits, form submissions).
When
Only on campaign pages, when measurement is switched on and you allowed marketing cookies.
Duration
90 days
_fbc
Type
Marketing (Meta)
Set by
Meta Platforms Ireland Ltd. (on our domain, set by the Meta Pixel)
Purpose
If you arrived by clicking a Meta (Facebook / Instagram) ad, stores the ad click ID (fbclid).
When
Only on campaign pages, when measurement is switched on and you allowed marketing cookies.
Duration
90 days