Cookie Policy

Controller and contact

This Cookie Policy applies to the website operated by the following data controller: Eren Can Kaya ("Noir Tattoo"). Venue: Veys Art Tattoo Studio, Çamlık Cd. No: 39, Konyaaltı / Antalya, Türkiye. Contact: thevoidink@gmail.com · +90 551 721 12 70.

Tax/registry no. (VKN/TCKN): [to be completed by the operator].

Last updated: 2026-09-02. This text is written to honestly reflect the site's real behaviour; a final legal review before publishing is recommended.

What cookies and local storage are

A cookie is a small text file that a website stores in your browser and can read back on a later visit. 'Local storage' (localStorage) is a similar browser storage area used for the same kinds of purposes, except it stays in the browser and is not sent to the server automatically.

These technologies can be used to remember settings such as your language, to store your preferences, or to provide security/spam protection. This site uses only the minimum cookies and storage that are genuinely needed.

1) Strictly necessary first-party cookies and local storage

The two items below are required for the site to work, belong to us (first-party), and do not require consent. Neither tracks you for advertising or analytics.

NEXT_LOCALE — Type: cookie (first-party). Purpose: to remember your chosen language (TR/EN/DE). What it does/tracks: stores only the language code; it holds no identity, behaviour or location data. Duration: persistent cookie, typically up to ~1 year (or until you clear it). It is updated by the site when you switch languages.

noir-consent — Type: local storage (localStorage) key (first-party). Purpose: to remember the choice you made in the cookie banner ('all' = accept all, or 'necessary' = necessary only), so the banner does not reappear on every visit. What it does/tracks: stores only that 'all' / 'necessary' value and nothing else; it is not sent to the server automatically. Duration: it stays in your browser until you clear it or change your choice.

2) Functional third-party services (only after interaction/consent)

By privacy-by-default design, the third-party services below are not loaded when the page opens; they activate only when you take an action or give consent.

Cloudflare Turnstile — Classification: strictly necessary / security (anti-abuse bot and spam protection; based on legitimate interest, no consent required). Provider: Cloudflare, Inc. (US/global). What it does/tracks: performs a 'are you human' assessment to stop the contact form being abused by automated bots; it does not perform cross-site advertising tracking. When it loads: to protect the form, when you interact with the contact form (when the form is focused); it is functionally required to submit the form and works independently of your banner choice. Storage/duration: it may use a short-lived verification token and functional storage limited to bot-detection. Cross-border: verification runs via US/global infrastructure.

Google Maps — Classification: functional (embedded location map). Provider: Google LLC (US). What it does/tracks: when you load the map, Google may set cookies and process your IP address. When it loads: only when (a) you have chosen 'Accept all' in the cookie banner AND (b) you click the click-to-load preview over the map. If you do neither, the map and all Google cookies/requests stay unloaded. Duration: cookies of various durations set by Google. Cross-border: data is transferred to the US.

3) What we do NOT use: no analytics, advertising or tracking

This site sets no analytics cookies, no advertising/targeting cookies, and no cross-site tracking cookies. There is no Google Analytics, Meta Pixel, ad network, heat-mapping or any similar tracker.

The only persistent items are the strictly necessary first-party cookie/storage listed above; third-party services load only when you interact or explicitly consent.

How consent works here

The site shows a cookie banner with two options: 'Accept all' and 'Necessary only'. Your choice is stored in your browser under the noir-consent key.

If you choose 'Necessary only': Google Maps will not load (no request reaches Google even if the click-to-load preview is clicked), and no non-essential third-party content is activated. Only the strictly necessary first-party cookie/storage (NEXT_LOCALE, noir-consent) keeps working.

If you choose 'Accept all': you can load the functional third-party content above (e.g. Google Maps on click).

Cloudflare Turnstile is a strictly necessary security measure and loads only when you interact with the contact form, independently of the banner choice, because protecting the form against spam and bots and enabling submission is functionally necessary (legitimate interest, no consent required). It does no advertising tracking.

Withdrawing or changing consent

You can withdraw or change your consent at any time. You can update your preference via the cookie banner.

Alternatively, clearing this site's local storage/cookies in your browser resets your noir-consent choice, and the banner will appear again on your next visit. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Browser-level cookie controls

From your browser settings you can view, block or delete cookies and site data. In most browsers these controls are under 'Privacy and security' (Chrome, Firefox, Safari, Edge, etc.).

If you block strictly necessary cookies/storage (e.g. NEXT_LOCALE), your language preference may not be remembered and some functions may not work as expected. Browser controls are an additional layer on top of the on-site banner choice above.

Photo uploads and explicit consent (special-category data)

On the contact form you may optionally upload up to 5 images (photos only). Because these photos can show body areas or existing tattoos, they may qualify as special-category personal data (health data) under KVKK Art. 6.

For this reason the form includes a separate KVKK explicit-consent checkbox; the form cannot be submitted without ticking it. We process the photos solely to assess your tattoo request.

Cross-border transfers and processors

The following service providers (processors/recipients) are involved in handling your form: Resend (delivery of the form e-mail — US); Cloudflare, Inc. (Turnstile bot protection and edge infrastructure — US/global); Vercel Inc. (hosting/CDN; request logs and IP may be processed — US/EU); Google LLC (Maps, only with your consent — US).

To prevent abuse of the form, the visitor's IP address is used only transiently (for rate/spam limiting) and is not stored long-term.

Through these services, data may be transferred to the US. Under KVKK Art. 9 the transfer relies on your explicit consent and/or appropriate safeguards; under GDPR (Chapter V), Standard Contractual Clauses (SCCs) where available plus explicit consent.

Retention and your rights

Your contact/appointment data is kept for at most 12 months unless it becomes an ongoing client relationship, after which it is deleted. If the relationship continues, it is kept for the relevant period.

Under KVKK Art. 11 you may exercise your rights to information, rectification, erasure, objection to processing and others via thevoidink@gmail.com. Studio policy: 18+ only; single-use sterile equipment; aftercare instructions provided.

Changes to this policy

This Cookie Policy may be updated as the site's technical behaviour or legal requirements change. The current version is always published on this page; the 'Last updated' date at the top indicates the version in force.

For questions: thevoidink@gmail.com.