Privacy notice (KVKK)مسودة

DRAFT: pending legal review. This text will be reviewed by a lawyer before publication; open points are marked below.

Data controller: Arya Kaya (aryakaya.art). You can reach us through the contact form on this site or our Instagram account (@arya.kaya.art). This notice explains how your personal data is processed under the Turkish Personal Data Protection Law No. 6698 (KVKK).

Data processed: When you use the contact form — your name, email address, phone number if given, your message and the work you are interested in; to protect the form from abuse, an irreversible hash of your IP address and the time of submission. If you write on WhatsApp or Instagram — your profile details on that channel and your message.

Purposes: Responding to your enquiry; communicating with you about the sale and delivery of a work; protecting the form against spam and abuse; where a sale takes place, meeting statutory invoicing and record-keeping obligations.

Legal bases (KVKK art. 5): processing necessary to conclude or perform a contract (art. 5/2-c); the legitimate interest of the controller — security of the form and prevention of abuse (art. 5/2-f); where a sale takes place, legal obligation under tax and commercial law (art. 5/2-ç). No consent checkbox is used; this notice fulfils the duty to inform.

Transfers: The site is hosted on Cloudflare (servers, security verification and database; data is stored in the European Union region). Form emails are delivered through Resend. Instagram and WhatsApp messages pass through Meta Platforms services. As these providers are located abroad, transfers fall under KVKK art. 9; the basis (adequacy decision, standard contract or explicit consent) will be settled in the legal review.

Retention: The IP hash is deleted after 30 days. Enquiries that do not lead to a sale are deleted or anonymised after 24 months. Records relating to a sale are kept for the retention period required by tax and commercial law (10 years).

Your rights (KVKK art. 11): to learn whether your personal data is processed; to request information if it is; to learn the purpose and whether data is used accordingly; to know the third parties to whom it is transferred in Turkey or abroad; to request correction of incomplete or inaccurate data; to request erasure or destruction under the conditions of art. 7; to request that corrections and erasures be notified to third parties; to object to a result against you produced solely by automated analysis; to claim compensation for damage caused by unlawful processing.

Requests: To exercise your rights, write to us through the contact form or our Instagram account; requests are answered within 30 days at the latest. The formal written address for applications and the VERBİS registration question will be settled with legal advice.

Cookies: The site uses no non-essential cookies and runs no visitor tracking. Security verification (Cloudflare Turnstile) runs only on the contact form. The management panel uses a session cookie for authorised users only.

Version: 2026-10-31 draft. The version is updated when the text changes; form submissions record which version was shown.