Skip to content
Dornika

Privacy Policy and Personal Data Protection Notice

Last updated: November 12, 2026

This notice explains how we process your personal data when you use the dornikaltd.com website (the “Site”), become a member, post a listing or contact us. We process your personal data in accordance with the applicable legislation, in particular the Personal Data Protection Law (Kişisel Verilerin Korunması Yasası, No. 89/2007) in force in the TRNC (Turkish Republic of Northern Cyprus). For individuals using our services from the European Union, the rights arising under the General Data Protection Regulation (GDPR) are also reserved.

1. Data controller

The data controller is Dornika (“Dornika”, “we”), with its place of business at Şht. İbrahim Ramadan Sokak No: 21, Yenişehir, Nicosia (Lefkoşa), TRNC. For any matter concerning your personal data, you can reach us at the e-mail address on our contact page or via our telephone and WhatsApp line.

2. What data do we process, and for what purposes?

When you visit the Site

  • Data: Your IP address, browser and device information, and the pages you visit and the time of your visit.
  • Purpose: To display the Site to you, ensure security, prevent misuse and excessive requests, and fix errors.
  • Legal basis: Our legitimate interest in operating the Site securely.

We do not use tracking tools for advertising, profiling or visitor statistics. Your favourites, your comparison list and your language, theme and currency preferences are stored only in your own browser. For details, please see our Cookie Policy.

When you become a member

  • Data: Your first and last name, e-mail address, telephone number and whether that number uses WhatsApp, your password (only an irreversibly encrypted form is stored), your preferred language, and the dates of your registration and last login. If you sign in with Google, Facebook or X, also your account ID on that service, your name, e-mail address and profile photo.
  • Purpose: To create and manage your account, verify your e-mail address, secure your sign-in and send password reset links.
  • Legal basis: The conclusion and performance of the membership agreement.

When you post a listing

  • Data: Listing details (location, price, features, description) and the photos you upload.
  • Publicly visible: The listing page shows your name in abbreviated form (e.g. “Ahmet Y.”), your telephone number, a WhatsApp button and the date you became a member, so that interested parties can contact you directly. Your e-mail address is not shown.
  • Photos: Hidden information in the photos you upload, such as location (GPS) and device data, is automatically removed before the photos are saved.
  • Purpose: To review and publish your listing, translate it into other languages and keep you informed about your listing (e.g. that it has been approved or needs corrections).
  • Legal basis: The performance of the membership agreement.

When you use the AI tools

When you press the “Write with AI” or “Translate into the other languages” buttons, or when empty language fields are translated automatically as your listing is saved, your listing title, description, listing details and (for the writing tool) your listing photos are sent to Google's Gemini AI service. Your name, e-mail address and telephone number are not sent. We record which tool you used and when, in order to keep count of your usage allowance.

When you contact us

  • Data: The name, nationality and contact details you send us via WhatsApp, telephone or e-mail, and the content of your request.
  • Purpose: To respond to your request, provide consultancy services and prepare offers for you.
  • Legal basis: Taking steps at your request prior to entering into a contract, and the performance of the contract.

The contact forms on the Site do not save your information on our server; they open WhatsApp with a pre-filled message, and you send the message yourself. Conversations conducted via WhatsApp are additionally subject to the privacy terms of WhatsApp (Meta).

Security records

To protect your account, we record failed login attempts, the verification codes sent (only in encrypted form) and significant actions on your account. The legal basis is our legitimate interest in keeping the service secure, and our legal obligations.

E-mails

We only send you essential e-mails relating to your account and your listings: verification codes, password reset links, e-mail change confirmations and listing status notifications. We do not send marketing e-mails; should we do so in the future, we will do so only with your explicit consent.

3. With whom do we share your data?

We do not sell your personal data or share it with anyone for advertising purposes. Your data is disclosed to others only in the following cases and only to the extent necessary:

  • Hosting service: Our server provider in Türkiye, on whose servers the Site and the database run.
  • Resend (USA): Sending verification code, password reset and notification e-mails.
  • Google (USA): The Gemini AI service (only the listing content described above) and the “Continue with Google” sign-in.
  • Meta (Facebook) and X: Only if you choose to sign in with these accounts, for the sign-in process.
  • Image storage service: If used, for storing listing photos and displaying them quickly (e.g. Cloudinary).
  • Competent authorities: In the event of a court order or a legal obligation, only the data requested.

These service providers process your data only on our behalf and in accordance with our instructions.

4. Transfers abroad

The Site's servers are located in Türkiye; in addition, some of the service providers we use (such as Resend and Google) process data in the European Union or the United States of America. Your data is therefore transferred outside the TRNC. We carry out these transfers in accordance with Article 11 of Law No. 89/2007: to the extent necessary for the performance of the membership agreement and of the service you request (for example, sending an e-mail verification code, or your pressing an AI button), with the standard contractual clauses and security measures offered by the providers, and only to the extent required by the service.

5. How long do we keep your data?

  • Membership information: For as long as your account remains open. When you delete your account, your name, e-mail address, telephone number, password, profile photo and linked social accounts are deleted immediately; the account record is anonymised.
  • Listings: When your account is deleted or you delete your listing, the listing is taken down immediately. Records of deleted listings may be kept for a limited period so that possible disputes and fraud complaints can be investigated, and are then deleted.
  • Verification codes and failed login records: Codes are valid for 10 minutes and password reset links for 1 hour; these records are deleted within 7 days at the latest.
  • Session: The member session ends when you log out or after 30 days at the latest.
  • Statutory retention obligations: If we offer paid services in the future, invoices and accounting records will be kept for the period prescribed by law.

6. Your rights

Under Law No. 89/2007, you have the following rights. If you are in the European Union, the same rights also apply to you, including the rights under the GDPR to data portability and to request the restriction of processing.

  • To learn whether your personal data is processed, which data is processed, from which source and for what purpose, and to whom it has been transferred;
  • To request the correction of inaccurate or incomplete data;
  • To request the deletion of your data or the cessation (blocking) of its processing, and to request that these actions be notified to the parties to whom your data has been transferred;
  • To object, on legitimate grounds, to the processing of your data;
  • To refuse the use of your data for marketing purposes;
  • To withdraw your consent at any time where processing is based on consent;
  • To receive your data in a structured and commonly used format (data portability);
  • To claim compensation for damage suffered as a result of the unlawful processing of your data.

To exercise these rights, you can write to us through the channels on our contact page. To verify your identity, we may ask you to write from the e-mail address registered to your account. We will respond to your application in writing and free of charge within 30 days at the latest (within 15 working days for objections). If you are not satisfied with our response, you may lodge a complaint with the TRNC Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.ct.tr). If you are in the European Union, you may also apply to the data protection authority in your country of residence.

7. Deleting your account and your data

You can delete your account and the personal data linked to it yourself at any time:

  1. Sign in to the Site and open the My account → Profile page.
  2. In the “Delete account” section at the bottom of the page, enter your password (if you signed in with Google, Facebook or X without creating a password, type your e-mail address).
  3. Press the “Delete my account” button. Your account, your listings and your linked social accounts are removed immediately.

If you cannot access your account, or if you would like to ask us to delete an account you signed in to with Facebook, Google or X, write to us; we will delete it within 30 days at the latest after verifying your request. You can also separately remove Dornika's access to your Facebook, Google or X account in the “connected apps” section of that service's account settings.

8. How do we protect your data?

  • Connections to the Site are encrypted (HTTPS).
  • Passwords are stored in irreversibly encrypted form; no one, including our staff, can see your password.
  • For new memberships, the e-mail address is confirmed with a verification code; repeated failed login attempts are temporarily blocked.
  • Only our authorised staff can access the administration panel, using a password and, on unrecognised devices, an e-mail verification code.
  • When you change or reset your password, your sessions on other devices are signed out.

9. Children

The Site is not designed for persons under the age of 18, and we do not knowingly accept memberships from persons under 18. If we become aware of such an account, we will delete it.

10. Changes

We may update this notice in line with changes to the Site or to the legislation. The current version is always available on this page, and the date of the last update appears at the top of the page. We will notify our members of significant changes by e-mail or via the Site.