Privacy Policy.

Who we are

Kothari Properties is a sole proprietorship of Sunny Kothari. We decide how the personal data described here is used (in GDPR terms, the controller; under India’s DPDP Act, the data fiduciary). Our correspondence address is 1005, 10th Floor, Royale Heritage Building, Behind Rustomjee Elements, D.N. Nagar, Andheri (West), Mumbai 400 053, Maharashtra, India.

This policy covers kothari.properties and its associated domains kothariproperties.com and kothariproperties.in. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules, and, for visitors from those places, the EU and UK GDPR, Brazil’s LGPD and California’s privacy laws.

The short, itemised privacy notice lists each piece of data we ask for and why, in English, हिन्दी and मराठी. Other languages of the Eighth Schedule are available on request.

What we collect

Information you give us. When you submit the enquiry form, call, email or message us on WhatsApp or on our social media pages, we collect your name, phone number, email address (optional on the form), the type of enquiry, any location you mention (an area, a housing society or a plot), your message, how and when you would like us to reply (WhatsApp, a call or email, and a time of day), your time zone as your browser reports it, and your confirmation that you are enquiring as the end stakeholder, not as a broker. The form also asks a few optional questions for each type of enquiry: for a home, the budget, size, areas, the country you live in and your citizenship; for a society, its name, size and stage; for land, its area, place, title and price; for a partner, the company. Answer only what you choose. With an enquiry the form also sends the campaign tag of the link that brought you here and the name of the site that sent you (never the full address), if there were any, so we know where enquiries come from. If you came through a client’s referral link, the enquiry also records which client referred you, so we know whom to thank; we do not share the details of your enquiry with them, and a visit through such a link is counted per day with nothing about you. If you subscribe to our newsletter, we collect your email address and the date you subscribed. The enquiry form also has a separate, unticked box to get the newsletter by email; it works like the newsletter form, and nothing is sent until you click the link we email you.

Google review requests (only if you agree). After a visit or at possession we may ask whether you would be happy to be asked for a Google review. Only if you say yes do we record it, and then we send you one request by email (and on WhatsApp only if you get our updates there). We offer nothing for a review, and you can tell us at any time not to ask.

Project updates on WhatsApp (optional). The enquiry form has a separate box, unticked, to get project updates and our monthly Market Note on WhatsApp, at most twice a month. We send them only if you tick it and only to a mobile number you have confirmed with a code, and we keep your choice with the date and the version of the notice you saw. Your enquiry is answered either way. Tap Unsubscribe in any of these messages to stop them (messages about your enquiry still come), or reply STOP to stop all our WhatsApp messages. Each one is sent by Meta’s WhatsApp Business Platform.

Verification and security checks. To confirm your mobile number we send a one-time code on WhatsApp through Meta’s WhatsApp Business Platform or, if that does not work, by SMS through Google Firebase; each processes your number for that purpose only. If no code can reach you, you may still send the enquiry with your email address; we keep it marked as unverified and check the number when we reply. The newsletter form uses Cloudflare Turnstile, which checks for automated sign-ups using technical signals from your browser.

Technical information. Our hosting providers record standard server logs (IP address, browser type, pages requested, time of request) for security and reliability. Visit statistics and cookies are described below.

Visit statistics

We count visits to see which pages help people. How we count depends on your choice in the cookie banner.

If you don’t allow analytics (the default), we count only page views, with nothing that identifies you or your device: no cookie, no visitor number, and we do not read or keep your IP address for this. Each page view is kept on its own, to the minute, with the page, the site that sent you (on the first page only), any campaign tag in the link, your country (as Cloudflare reports it), the type of device, a rough screen size, whether you began the enquiry form, and roughly how long the page was on screen. None of these can be joined into a visit or a person.

If you allow analytics, your browser also keeps a random visitor number in a cookie (kp_vid, for 13 months), so we can tell a returning visitor from a new one. We then also keep your IP address on our server for 30 days, to spot fake and automated traffic, and after that only its network (the address with its last part removed). We never share it.

With your permission, for each visit we store the pages you open and how long each one was on screen, the site that sent you here, any campaign tag in the link you followed, your country and city (worked out from the network by Cloudflare), the type of device, the browser family, a rough screen size (phone, tablet, laptop or large screen), and whether you began filling in the enquiry form. If you withdraw it, the visitor number and IP address are removed from your visits at once. We do not record what you type until you send it. We keep visit statistics for 13 months.

Visits from bots and other automated programs are left out. If your browser sends Do Not Track or Global Privacy Control, we treat it as a refusal and do not count your visit at all, unless you allow analytics yourself. The devices our own team uses carry a small marker, with no identifier, so that our own visits are left out too. Visitors never get it.

Cookies and your choices

On your first visit we ask before anything optional runs. Reject all is as easy as Accept all, and nothing is switched on in advance. You can change or withdraw your choice at any time, as easily as you gave it: open cookie settings. Your choice lasts 12 months, and we ask again sooner if this policy changes.

Google Ads. With your permission, the Google Ads tag notes which of our ads you came from, so that if you send an enquiry Google can tell us which ad led to it. It sends Google the ad click, the pages you open on this site and our enquiry reference, never your name, number or email. We also keep the ad click reference with your enquiry, so we can later tell Google, by that reference alone, whether the enquiry became a qualified lead, a site visit or a booking. Ad personalisation and Google signals are off. We use Google Consent Mode, so nothing from Google loads until you allow Advertising. Google handles this data under its own advertising policy.

We keep a record of each choice (the consent ID, the date, this policy’s version, what you allowed and your country) as proof, for 24 months. It holds no IP address. The consent ID shows in cookie settings; quote it if you ask us about your choice.

How we use it, and why we may

We do not sell personal data, and we do not share it for advertising aimed at you on other sites.

Where your data is stored

In India. Enquiries, newsletter sign-ups, visit statistics and consent records are stored in a database on a server we operate in India.

Some providers we use work from other countries. Your data reaches them only for the job described:

Where data goes outside India, it goes only to countries the Government of India has not restricted. For visitors from the EU and UK, Google and Cloudflare rely on the EU–US Data Privacy Framework and standard contractual clauses.

Sharing

We do not sell or rent personal data. We share it only:

• With your consent, for example when you ask us to introduce you to a specific developer
• With the service providers listed above, under confidentiality obligations
• When required by law, a court order or a lawful request from a government authority

Newsletter

Our newsletter is sent occasionally and only to people who sign up (on the newsletter form, or with the box on the enquiry form) and confirm by the link we email them. Every email carries an unsubscribe link, and you can also unsubscribe at any time by writing to hello@kothari.properties. We remove your address within seven days and never share or sell the list.

Security & retention

The site is served over HTTPS. The database is not reachable from the internet, administrative access is limited to a private network, and backups are encrypted. No method of transmission is perfectly secure, but we follow reasonable security practices as required under the IT Act.

Your rights

Wherever you live, you may at any time:

• Ask for a summary of the personal data we hold about you and how we use it, and a copy of it
• Ask us to correct, complete, update or erase it
• Withdraw your consent as easily as you gave it, after which we stop processing for that purpose (for cookies, use cookie settings)
• Object to processing, where the law where you live gives that right
• Nominate another person to exercise these rights if you die or cannot act
• Raise a grievance with us

Use our privacy request form (a code to your mobile shows the request is yours), or write to the Grievance Officer below with what you need. We may ask you to confirm it is you before we act.

Grievance Officer. Sunny Kothari, Kothari Properties, 1005, 10th Floor, Royale Heritage Building, Behind Rustomjee Elements, D.N. Nagar, Andheri (West), Mumbai 400 053, Maharashtra, India. Email hello@kothari.properties. We respond as soon as we can, and within 90 days at the latest.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India; in the EU, to the data protection authority where you live; in the UK, to the Information Commissioner’s Office; in Brazil, to the ANPD; and in California, to the California Privacy Protection Agency.

Children

Our services are meant for adults. We do not knowingly collect data from anyone under 18.

Changes

We may update this policy. The date at the top of this page shows when it last changed. If a change affects cookies, we ask for your choice again.