Privacy and Personal Data Processing Notice

1. Data controller

VİALİFE GROUP, Kyrenia (Girne), Turkish Republic of Northern Cyprus. Contact and requests: [email protected].

2. Data we process

Only data needed to provide the service:

• Identity and contact: name, e-mail, telephone (if provided), preferred language.
• Property and relation data: the unit you are related to and in what capacity, the type of document checked to verify it and the dates.
• Requests and communication: your requests, messages, announcements, quotes and replies.
• Operations: inspection / maintenance visits, access authorisations, reports and photos, key handovers.
• Cashbook entries: amounts, dates, payment method, related unit and description of dues and site income / expenses.
• Account and security: account, roles, password (irreversibly hashed only), two-step verification records, sessions, IP address, browser information and audit records.
• For staff and partners: assignments, visit declarations and uploaded documents.

3. Purposes

We process personal data to:

• provide site and property management services and handle requests and work;
• share reports, announcements and quotes with owners about their property;
• record dues collections and site expenses and report them to the management board;
• keep accounts secure, prevent unauthorised access and keep actions traceable;
• comply with legal obligations and protect rights in disputes;
• send service e-mails (invitations, password resets, notifications).

4. Legal bases

Performance of the management / service contract with you or the site you represent, Vialife's legal obligations, Vialife's legitimate interests (e.g. security logs) provided your fundamental rights are not harmed, and your explicit consent where required. Marketing messages need separate consent, which you can withdraw at any time under My account → Notifications.

5. Sharing

Your data is never sold. It is shared only as needed and limited by permissions with:

• authorised Vialife staff (each person only sees what their role requires);
• contractors assigned to a job (only data about that job);
• the site's management board or authorised representatives (site cashbook and site-wide information);
• infrastructure providers: the hosting server; Cloudflare for domain, security and traffic protection; Cloudflare R2 for encrypted backups; the e-mail delivery service. Their infrastructure may be abroad; transfers are limited to what the service needs and protected by appropriate measures;
• competent public authorities, only where legally required.

6. Retention

Data is kept as long as the purpose and applicable law require, then deleted, destroyed or anonymised.

• Account and relation records: during the relationship and afterwards as needed for possible disputes.
• Cashbook records: for the period required by law. They are not deleted; errors are marked by reasoned cancellation.
• Security and audit records: as long as needed for security and accountability.
• Bulk import source files: securely deleted within 90 days after the import.
• Backups: encrypted backups are kept for at most 180 days and then deleted.

7. Security

HTTPS only; mandatory two-step verification for management accounts; role- and scope-based access; logged actions; malware-scanned private file storage; encrypted backups in a separate location.

8. Your rights

You may ask whether your data is processed and request information; learn the purpose and recipients; request correction; request deletion where legal conditions are met; object and withdraw consent; and claim compensation for damage caused by unlawful processing.

9. Requests

Send requests to [email protected] with information allowing us to verify your identity. They are answered free of charge within the legal period. You may also apply to the competent supervisory authority.

System e-mails come from [email protected]; replies to that address are not processed.

10. Changes

This notice may be updated; the current version is always published on this page.