Summary: You own and are responsible for the customer information you add to the CRM. İlancik processes it only on your behalf and only to provide the service; it does not sell it or share it with anyone else. Confidential documents are stored encrypted in a non-public store (EU). When you leave, you can export your data within 45 days.
Version code: dpa_v2. This agreement is an integral part of the İlancik CRM Service Agreement.
1. Parties and roles
- Controller — the "Customer": the real estate agency or independent agent using İlancik CRM. The Customer decides whose data is processed and for what purpose.
- Processor — "İlancik": APPLINEUM LTD (England and Wales, company no. 17275572, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). The support and operational part of the service is performed on APPLINEUM LTD's instructions and under the same obligations by joint operator TRENDWAY TRADING LTD (Armutlu Sokak, Çarşı Selvi Plaza D Blok No 5, Ozanköy, Kyrenia, TRNC).
This agreement is made under the TRNC Personal Data Protection Law No. 89/2007 (Art. 12) and, where applicable, the UK GDPR and Art. 28 EU GDPR. It takes effect upon the workspace owner's electronic acceptance on first entering the CRM and continues until the process in §11 is complete.
2. Nature of the processing
| Item | Description |
|---|---|
| Subject and purpose | Customer relationships, sales and letting processes, tenancy and booking records, document management, portals, reporting |
| Processing operations | Recording, storage, editing, viewing, transmission on the Customer's instruction (email, portal), backup, deletion |
| Data subjects | Buyers, sellers, tenants, landlords, guests and companions, guarantors, Customer staff, service providers (e.g. cleaners) |
| Data categories | Identity (name, nationality, ID/passport number — encrypted), contact, transaction (criteria, offers, contracts, payments), documents (ID/passport copies, contracts, title deeds, receipts), financial (IBAN — encrypted), interaction (notes, tasks, message log, listing view signals) |
| Special category data | The service is not designed for such data; the Customer agrees not to enter health, religion, political opinion or criminal data in notes |
| Duration | The term of the agreement and the deletion process in §11 |
3. Customer obligations
- Have a valid legal basis for all data entered (contract, request, legal obligation, legitimate interests or consent).
- Inform the people concerned (transparency obligation) and respond when they exercise their rights.
- Obtain written consent for marketing messages and record the proof in the CRM's "Marketing consent" field.
- Define team members' roles correctly and remove access for those who leave.
- Fulfil its own legal obligations such as guest registration and reporting to the Tourism Planning Department under the Holiday Homes Law No. 54/2025; the CRM offers supporting tools but does not take over the obligation.
- Make any filings required on its own side (e.g. registration with a data protection authority where required).
4. İlancik's obligations
- Process personal data only on the Customer's documented instructions. This agreement and the actions and settings the Customer makes in the CRM constitute instructions. If we believe an instruction is unlawful we will inform the Customer.
- Not use the data for its own purposes, sell it, share it with other customers or use it for advertising.
- Ensure that staff with access to the data are bound by confidentiality.
- Implement and keep up to date the security measures in §6.
- Provide the Customer with tools to handle data subject requests (export, rectification, permanent deletion / anonymisation) and forward requests received directly by İlancik to the Customer within 5 business days.
- Provide reasonable information and documents to demonstrate compliance with this agreement and, with reasonable notice and confidentiality, support audits no more than once a year.
- Inform the Customer of a data breach without undue delay and at the latest within 24 hours of becoming aware of it (§8).
5. Support access
- İlancik administrators see CRM contact data masked by default (e.g. "Ahmet Y.", "+90 533 * 12").
- Unmasked access is possible only on the Customer's support request, for a legal requirement or in a security incident, with a recorded reason, and is visible on the Customer's CRM audit screen.
- İlancik administrators cannot download the Customer's confidential documents; they see only the document type, size and date.
6. Security measures
- TLS encryption on all connections.
- AES-256-GCM encryption of sensitive fields such as ID/passport numbers, IBANs and credentials; IP addresses are stored only as keyed hashes (HMAC).
- Confidential documents in a separate, non-public store located in the European Union (Cloudflare R2); personal links valid for 5 minutes only; every download is written to the audit log.
- Role-based access (owner, manager, agent, assistant) and logical separation between workspaces.
- Unpredictable, time-limited and revocable keys for portal links; no cookies or trackers on portal pages.
- Audit log (2 years), automatic enforcement of retention periods and encrypted backups kept in the United Kingdom.
7. Sub-processors
The Customer gives general authorisation for the sub-processors below. İlancik enters into written agreements with sub-processors providing protection equivalent to this agreement and remains liable to the Customer for their acts.
| Sub-processor | Service | Data location |
|---|---|---|
| TRENDWAY TRADING LTD (joint operator) | Support, TRNC operation, incident management | TRNC |
| Hosting (server) provider | Application and database server | Turkey |
| Backup infrastructure | Encrypted database backups | United Kingdom |
| İlancik's own email server | Transactional emails (notifications, portal links, reports) | Turkey |
| Cloudflare, Inc. | Confidential document store (R2), CDN, security | Confidential documents EU; global network |
| Cloudinary Ltd. | Listing photos only (not confidential documents) | Global CDN |
| OpenRouter, Inc. and the selected model provider | AI assistant — only if the Customer enables it; phone, email and surname are not sent | USA |
| Stripe Payments Europe Ltd. / Stripe, Inc. | Subscription payments (only the Customer's billing details) | EU / USA |
We will notify the Customer by email and in the CRM 30 days before adding or replacing a sub-processor. If the Customer objects on reasonable grounds, it may stop using the relevant feature or terminate the agreement with a pro-rata refund for the remaining period.
8. Data breach
- When İlancik becomes aware of a breach affecting Customer data, it informs the Customer by email and in-app notification without undue delay and at the latest within 24 hours.
- The notice includes the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken and proposed, and a contact person. Where not all information is yet available, it is provided in phases.
- TRENDWAY TRADING LTD coordinates incident management. İlancik assists the Customer in meeting its obligations to notify the authority and the people affected.
9. International transfers
Some sub-processors are outside the TRNC, the UK or the EU. İlancik makes these transfers only to the extent necessary to provide the service and relies on the safeguards of applicable law: adequacy decisions, standard contractual clauses together with the UK IDTA or Addendum, and transfer risk assessments where required. Confidential documents are stored only in the EU.
10. Platform forms and lead pool
- For the forms on listing pages ("Ask the owner", "Create a request", booking request, "call you back?" card), İlancik is the controller at the moment of collection and obtains the necessary consent.
- When the data is passed to the Customer with the data subject's consent (form delivery or "Take the lead"), it becomes a CRM record for which the Customer is the controller.
- The Customer agrees to contact people received this way only about the subject of their request, not to add them to marketing lists without consent and to respect notices of withdrawal of consent.
11. Retention, return and deletion
| Data | Period |
|---|---|
| Tenant ID image linked to a tenancy | Until the tenancy end date; then deleted automatically |
| Guest ID and guest registration form | 2 years from check-out |
| Contracts, receipts and financial records | 10 years from the end |
| Audit logs | 2 years |
| Interaction signals | 12 months |
| AI portfolio reports | 90 days |
| Platform form records (İlancik side) | 24 months from first contact |
- The Customer can delete a contact at any time with "Delete permanently" on the contact card; where a statutory retention barrier exists (e.g. party to an active tenancy, open ledger entry) the contact is anonymised and the relevant record is kept for the statutory period.
- On closure of a workspace the Customer can export all its data (CSV/JSON + documents) for 45 days. After that period the data is permanently deleted; records subject to statutory retention are kept, with access blocked, only for the relevant period.
- Copies in backups are deleted automatically at the end of the backup cycle.
12. Liability and governing law
- The parties' liability is subject to the limits in §12 of the İlancik CRM Service Agreement; however, no limitation applies to intentional or grossly negligent breach of the data protection obligations in this agreement.
- This agreement is governed by TRNC law; the Kyrenia (Girne) District Court has jurisdiction. Data subjects' rights under applicable data protection law remain unaffected.
- In case of conflict between this agreement and the Service Agreement regarding personal data, this agreement prevails.
Contact and breach notification: [email protected]