Personal data protection notice (KVK)

Controller

Northea Private Property Advisory is the data controller. Requests concerning personal data: privacy@northea.dev.

Data we collect

Enquiries and briefs: name, email, telephone, preferred language, interest, budget range, timing, privacy requirements and free-text messages.

Client portal: email address, one-time codes (stored hashed), session identifiers, journey status, notes to your advisor, and documents you upload when asked (identity, proof of address, source of funds, source of wealth, company documents, powers of attorney).

Website: strictly necessary technical data; first-party analytics events only with your consent.

Eligibility pre-check: nationality and country of residence are asked only because the foreign-buyer framework depends on them and are not stored unless you proceed to a consultation.

Purposes and legal bases

Responding to enquiries and preparing a private brief (steps prior to a contract at your request).

Performing an engagement: search, viewings, dossier preparation, coordination of independent professionals, completion and aftercare (contract).

Anti-money-laundering and know-your-customer checks, sanctions screening and record keeping (legal obligation and legitimate interest in preventing financial crime).

Security of the website and the portal, and analytics with consent (legitimate interest; consent).

Special categories and sensitive documents

Northea never requests passports, bank statements or proof of funds through public web forms. Such documents are collected only in the client portal, only when required for a qualified transaction, and are encrypted in transit and at rest.

Recipients

Independent lawyers, accountants, banks, surveyors, developers and owners, only as necessary for your transaction and, where practicable, with your knowledge.

Service providers hosting the website, database and file storage under contractual confidentiality.

Authorities where required by law.

International transfers

Hosting and storage providers may process data outside the TRNC, including in the European Union, the United Kingdom and the United States, under contractual safeguards. Details are available on request.

Retention

Enquiries without engagement: 24 months. Engagement records and AML/KYC documents: the period required by applicable law after completion, then deleted. Portal documents: for the duration of the engagement plus the statutory retention period. Analytics: 13 months.

Your rights

Access, rectification, erasure, restriction, objection, portability and withdrawal of consent, by writing to privacy@northea.dev. You may also complain to the competent data protection authority in the TRNC or, where the GDPR or UK GDPR applies, in your country of residence.

Security

Access to client data is limited to the responsible advisor and the persons who need it for your transaction. Portal sessions expire; documents are stored in a private bucket and served only to the authenticated client and Northea.

Explicit consent

Where processing relies on explicit consent (for example transfers abroad or non-essential analytics), consent is requested separately and may be withdrawn at any time without affecting the lawfulness of earlier processing.