Privacy notice

Data controller ("controller" in the Law)

Hacıali Motors is the trading name of MOSRA TRADING LTD., registration number MŞ29395. Address: Öğretmenler Caddesi No. 10, Ortaköy, Nicosia (Lefkoşa), TRNC. Phone and WhatsApp: +90 533 880 33 33. Email: [email protected].

The website is built, hosted and run for Hacıali Motors by Elevates Digital Services OÜ (Estonia, registry code 17455911). Elevates processes your data only on our instructions and only for the purposes stated in this notice.

Information kept only in your browser

Your favourites, your comparison list and your cookie choice are stored only in your own browser; your language choice is kept in a cookie in your browser until you close it. None of them is stored on the website's server, and we never see your favourites or your comparison list.

Information that reaches us, why, and on what legal basis

Some of this information you give us yourself, through a form on the site, by WhatsApp, phone or email. The rest reaches us automatically while you use the site: technical details of each visit always, and Google Analytics data only if you agree.

Requests you send through the site's forms

• Contact form: your name, phone number, your email address if you give it, the subject and your message. We use them to answer you.
• Question about a car: your name, phone number, your message and the car concerned. We use them to answer you.
• Test drive request: the car, your name, phone number, the day and time slot you prefer and any note. We use them to arrange the test drive.
• "Notify me on arrival", for cars on the way: the car, your name, phone number and any message. We use them to call you when the car arrives.
• Trade in: the make, model, model year, mileage, fuel type and gearbox of your car, your notes, up to six photos, your name and phone number. We use them to assess your car and get back to you. Photos may show your number plate or people; please keep people out of them.

With each request the site also records the language and the page it was sent from. Your request is stored in the site's administration panel, where it is shown only to our staff once they log in to the panel, and a notification of it is sent to our email address. Our staff add a status and internal notes to each request so they can follow it up. The site sends you no message; we call or write to you ourselves.

Legal basis: taking steps you ask for before a possible purchase or sale (Law No. 89/2007, Article 6(2)).

You are under no legal obligation to give us information. Without your name and phone number, however, we cannot get back to you.

Opening list

Before the showroom opened, the site let you leave your phone number and its country code to be told about the opening. We use the number only to call you once to tell you we have opened. Your number was sent to our email address ([email protected]) through Brevo and is kept only in that mailbox. Legal basis: the consent you gave by pressing "Notify me" (Article 6). You can withdraw it at any time by writing to us.

Messages by WhatsApp, phone or email

When you write to us by WhatsApp or email, or call us, we receive your name, phone number, your email address if you email us, and what you tell us. The WhatsApp buttons on the site open a message ready to send, naming the car if you pressed the button on a car's page, or containing what you filled in if you chose to send the contact form by WhatsApp; you decide whether to send it. We use these messages to answer you and to arrange what you ask for.

Legal basis: taking steps you ask for before a possible purchase or sale (Article 6(2)).

Every time you visit the site

Your browser automatically sends your IP address, browser details, the pages you open (including searches and filters you use on the site) and the time. This traffic reaches the site through Cloudflare, which passes it to our server on our behalf to run the site and protect it against attacks, and sees your IP address while doing so. The site's server keeps no record of your visits: your IP address is held only in its memory, for about an hour, to limit the number of requests. To find faults, the server keeps technical error records, which are deleted after 14 days.

To keep automated spam out, every form on the site is checked by Cloudflare Turnstile, which looks at your IP address and signals from your browser (such as the browser type and its connection settings), and the number of requests and login attempts from one IP address is limited. Cloudflare also uses these signals, as a controller in its own right, to improve its detection of automated traffic.

Legal basis: our legitimate interest in providing the site securely (Article 6(5)). Error records may remain for about two more weeks in the hosting company's server snapshots.

Only if you agree: Google Analytics

If you accept Statistics cookies in the cookie banner, Google Analytics 4 loads and records: the pages and cars you view, the searches and filters you use, clicks on the WhatsApp buttons and the sending of a form (not what you wrote in it), the site or campaign that brought you here, device type, browser, screen size, language and your approximate location (city, region and country) derived from your IP address. Your IP address reaches Google to determine your location, but Google Analytics does not store it. A random identifier, kept in a cookie for up to two years, is used to recognise returning browsers.

The purpose is to understand which cars and pages interest people, so we can improve the site. Google Signals and advertising features are switched off. Your name, phone number, email address and what you write in a form are not sent to Google Analytics. Detailed visit data is deleted automatically after 14 months at the latest; summary reports such as total visit counts remain.

Legal basis: your explicit consent (Article 6).

Only if you agree: the Google map

If you accept Maps cookies in the cookie banner, or press "Load the map" in the map area, the Google map showing where our showroom is will load on the home and contact pages. Your browser then connects directly to Google's servers; Google receives your IP address, may set its own cookies and may read cookies it set earlier. If you do not agree, a short notice with a "Load the map" button appears where the map would be.

Legal basis: your explicit consent (Article 6).

You do not have to agree. Even if you refuse, the listings, the forms and the rest of the site work; only the map is replaced by a short notice. You can withdraw your consent at any time through "Cookie settings" at the bottom of every page; statistics data already sent stays in Google Analytics until its retention period ends.

Who receives it, and why

• Elevates Digital Services OÜ (Estonia): builds, hosts and maintains the site for us, and runs the Google Analytics account on our behalf.
• Hostinger: the server holding the site, its database and your requests, in Düsseldorf, Germany. Hostinger's own full server snapshots are kept in Lithuania for about two weeks. Hostinger also hosts our email address, [email protected].
• Cloudflare, Inc. (USA): protects and speeds up the site, runs the Turnstile check on the forms and receives reports of connection errors from your browser, and sees your IP address while doing so. It also stores car photos, the photos you attach to your trade in request and the site's backups.
• Brevo (France): delivers the notification email of each new request to us. It keeps a record of each email it delivers, which can include its content, until it is deleted by us or under Brevo's own rules.
• Google, statistics and the map (Google Ireland Limited and Google LLC): receives your data only if you agree. This data is processed on servers abroad, including in the United States; the legal basis for this transfer is your explicit consent (Article 11(2)(A)).
• WhatsApp (Meta): when you write to us on WhatsApp, your message travels over WhatsApp's infrastructure under WhatsApp's own terms. You start this transfer yourself. If your message is a request about a car, the transfer is needed to take the steps you ask us to take before a possible purchase or sale (Article 11(2)(B)).
• Public authorities: only where the law requires it, and only as much as it requires.

Your requests are stored outside Northern Cyprus, on the server in Germany, where the EU General Data Protection Regulation applies. Photos, backups and emails are stored by the providers listed above.

We do not sell or rent your information, and we do not use it for advertising. We do not send you promotional or advertising messages without your written consent.

How long we keep it

• Requests sent through the site, including trade in details and photos: deleted from the site by our staff 12 months after we last dealt with them, or earlier if you ask. If you buy a car from us or sell us yours, the records of that sale are kept for the period the law requires.
• Opening list: deleted no later than three months after we open.
• WhatsApp conversations and emails: until your request is completed.
• Your IP address, used to limit requests: about an hour, in the server's memory only. The server's technical error records: 14 days. The hosting company's server snapshots: about two weeks.
• Detailed visit data in Google Analytics: 14 months at the latest.
• Your favourites and comparison list: in your own browser until you delete them. Your language choice: until you close your browser. Your cookie choice: until you change it or clear your browser data.
• The site's backups: up to 6 months. Data deleted from the site disappears from the backups within 6 months, as older backups are deleted.

How it is protected

The site works only over an encrypted connection (HTTPS). Requests and trade in photos are shown only to our staff once they log in to the administration panel; Elevates can access them only to run and maintain the site for us. The number of login attempts is limited.

Your rights

Under Law No. 89/2007 you can:

• find out whether personal data about you is processed, and ask what data is processed and where it came from, why it is processed, who has received it and which categories of data are involved (Article 14);
• ask for your data to be corrected, deleted or blocked from use, and ask for this to be notified to any third party that received it (Article 14);
• object at any time, on legitimate grounds relating to your particular situation, to the processing of your data (Article 15);
• withdraw any consent you gave, at any time. For cookies, use "Cookie settings" at the bottom of every page.

Send your request in writing to [email protected], to our WhatsApp line or to our showroom address. We reply in writing within 30 days to requests for information, correction, deletion or blocking (Article 14), and within 15 working days to objections (Article 15).

If you get no reply within these periods, or find our reply unsatisfactory, you can apply to the Personal Data Protection Board of Northern Cyprus (Kişisel Verileri Koruma Kurulu). You can also take any complaint about how the Law is applied directly to the Board at any time (Article 34; kvkk.gov.ct.tr).

Cookies

Our Cookie policy lists one by one what the site stores on your device, why, and for how long.

Changes

If we change this notice, we publish the new text on this page with its update date. Before using your data for a new purpose, we inform you separately.