Privacy Policy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Andor Bolyki, Bruckdorfer Straße 3, 06112 Halle (Saale), Deutschland. Email: andor.bolyki@bolykiproperty.com.

Phone: +49 152 02967660

We have not appointed a data protection officer. For any privacy questions or to exercise your rights, contact us at the email address above.

2. The short version

• We only process data you give us through our forms or by message, plus technically necessary server data.
• We currently use no analytics, advertising or tracking services (no Google Analytics, Meta Pixel or TikTok Pixel).
• We do not embed third-party content (no embedded videos, maps, social media plugins or external fonts).
• The only cookie that is not strictly necessary (attributing referral links) is set only with your consent.
• We do not sell your data.

3. Hosting and server log files

This website is hosted by Netlify, Inc. (USA). When you visit, the hosting provider processes technically necessary connection data in server log files: IP address, date and time, requested URL, amount of data transferred, HTTP status code, browser type and version, operating system and the previously visited page (referrer).

Purpose: delivering the website and ensuring stability and security (defending against attacks). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation). Log files are kept only for a short time; the exact period is determined by the hosting provider.

We have or will conclude a data processing agreement with the hosting provider under Art. 28 GDPR. The provider is based in the USA (see “Transfers to third countries”).

4. Contacting us by email, phone or messenger

If you contact us by email, phone or messenger, we process the data you share (e.g. name, contact details, content of your message) solely to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

If you give a phone number in a form, we may contact you about your enquiry by phone or messenger (e.g. WhatsApp). For WhatsApp, the operator (WhatsApp Ireland Ltd. / Meta) processes communication data under its own privacy terms. If you prefer to be contacted only by email or phone, please tell us.

If you click a WhatsApp link on this website, WhatsApp opens on your device. Data is only transmitted to WhatsApp once you send a message there.

Appointment booking: the contact page links to a booking system (cal.com). Only when you click the link does its page open in a new tab; nothing is transmitted there beforehand. When you book, the provider processes your details (name, email, chosen time) under its own privacy terms and passes them to us so we can attend the appointment and get in touch (Art. 6(1)(b) GDPR). The appointment is stored in our Google Calendar and we receive an email notification.

5. Enquiry, callback and contact forms

When you use one of our forms, we process: first name, last name, email address, phone/WhatsApp number (where requested), your interest (country or market, type of property or plan), budget range and timeframe (voluntary), how you found us (voluntary), your message, the chosen language, the page you were on, the time of your enquiry, and the time and version of the privacy policy you confirmed (proof of your consent).

Purpose: handling your enquiry, advising you, contacting you to prepare a possible contract, and internal organisation (tracking the status of your enquiry).

Legal bases: Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(a) GDPR insofar as you consent in the form to the processing and to being contacted. You can withdraw your consent at any time with effect for the future, e.g. by email to andor.bolyki@bolykiproperty.com. Processing carried out before withdrawal remains lawful.

Required fields are marked with * in the form; without them we cannot handle your enquiry. All other information is voluntary. We send marketing emails, newsletters or messages beyond your specific enquiry only with separate, explicit consent.

6. Sharing with local partners and project providers

Our aim is to connect you with suitable property opportunities and local partners (e.g. developers, owners, managers or advisers) in Indonesia (Bali) and Thailand. We pass your personal data to such parties only if you explicitly ask us to and have consented to the transfer beforehand (Art. 6(1)(a) and Art. 49(1)(a) GDPR).

Please note: there is no EU Commission adequacy decision for Indonesia or Thailand; the level of data protection there may differ from the EU standard. We will point out this risk before any transfer.

7. Partner applications

When you apply for a collaboration, we process: first name, last name, email address, phone/WhatsApp number, country, city, occupation, social media profiles and website (voluntary), your answers about motivation, support, experience, network and reach, preferred markets, how you found us, language, page visited, time, and the time and version of the privacy policy you confirmed.

Purpose: reviewing your application and contacting you to prepare a possible collaboration. To review it, we may look at the publicly accessible profiles you provide. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Art. 6(1)(a) GDPR (consent, see above).

8. Where your enquiry came from: referral links and campaigns

If you reach us through a link with parameters (e.g. ?ref=… for referral partners or utm_… parameters for campaigns), we read them from the address bar. If you submit a form, we send them along with your details and store them with your enquiry: referral/partner code, UTM source, medium, campaign, content and the first page you visited.

Purpose: attributing the enquiry to the referral partner or campaign (e.g. for settling with partners and evaluating our channels). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct attribution). You may object at any time (Art. 21 GDPR).

Only if you agree in the cookie banner to the category “Origin & referrals” do we additionally store these parameters for 30 days in a cookie (bp_attr), so attribution still works if you visit several pages before sending an enquiry. Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Details in the Cookie Policy.

9. Cookies and similar technologies

We use only a few cookies: one that stores your cookie choice, one for your language choice (only if you switch the language yourself) and — only with your consent — the cookie for attributing referral links. We use neither your browser’s local storage nor third-party cookies. All details are in the Cookie Policy. You can change your settings there and in the footer at any time.

10. Recipients and processors

• Netlify, Inc. (USA): hosting of the website (server log files).
• Supabase: storage of form data in a database (database region: Frankfurt (EU)).

• IONOS SE and Google (Gmail): email communication.

• Resend (Resend, Inc., USA): sending an internal email notification to us when you submit a form (contains the details from your enquiry).

Advisers (e.g. lawyers, tax advisers) may also receive data where necessary, bound by their duty of confidentiality. We have or will conclude contracts under Art. 28 GDPR with all processors.

11. Transfers to third countries

Some service providers (e.g. hosting) are based in the USA or may process data there. Transfers rely on EU Standard Contractual Clauses (Art. 46 GDPR) or — where the provider is certified — on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Data is shared with partners in Indonesia or Thailand only as described in section 6.

12. Retention

• Server log files: only briefly (period set by the hosting provider).
• Form enquiries: up to 12 months after the last contact if no contract is concluded; then we delete them.
• Partner applications that do not lead to a collaboration: 6 months after the application process ends.
• If a contract is concluded: for the duration of the contractual relationship and beyond where statutory retention obligations apply (e.g. commercial and tax law).
• Proof of consent: as long as the related data is stored.
• Cookies: see the Cookie Policy.

13. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR), e.g. where you live or work or where the controller is based

Just write to andor.bolyki@bolykiproperty.com. We may ask you to verify your identity.

14. Necessity of data and automated decisions

Providing your data is voluntary. Without the fields marked as required, however, we cannot process your enquiry or application. There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

15. Data security

Data between your browser and our website is transmitted encrypted (TLS/HTTPS). Access to stored enquiries is limited to people who need them to handle them. We adapt our technical and organisational measures to the state of the art.

17. Users in Austria and Switzerland

This policy follows the GDPR. If you are in Austria or Switzerland, the same standard of protection applies to you; you can also exercise your rights via the address above.

18. Changes

We update this policy when features of the website or the legal situation change — in particular before we start using analytics or advertising services. Version: 2026-09-20.