Privacy Policy

About this policy

This Privacy Policy explains how we process your personal data when you visit the Noir Tattoo website or use our contact form. Although we operate in Türkiye, this policy is written with the EU General Data Protection Regulation (GDPR) in mind for visitors from the European Union/EEA.

For visitors in Türkiye, the detailed disclosure is set out in our KVKK Privacy Notice, which this policy complements. In case of any conflict, the KVKK Privacy Notice prevails for processing in Türkiye.

Last updated: 2026-09-02.

Who we are (data controller)

The data controller is Eren Can Kaya ("Noir Tattoo"), an independent tattoo artist operating at the 'Veys Art Tattoo Studio' venue.

Address: Çamlık Cd. No: 39, Konyaaltı / Antalya, Türkiye.

E-mail: thevoidink@gmail.com · Phone: +90 551 721 12 70.

Tax/registry no.: [to be completed].

What we collect and why

Our only data-collection point is the contact form on the site (/contact). Through this form we process: your full name; e-mail address; phone number (with country dial code); your free-text message; and, optionally, any photos you upload (maximum 5, images only).

We process this data solely to assess your request, answer your questions and, where relevant, arrange an appointment.

Photos you upload may show body areas or your existing tattoos and can therefore constitute special-category personal data, including health data, under KVKK Art. 6 (GDPR Art. 9). We process such data only with your explicit consent, and the KVKK consent checkbox on the form covers it. You are not required to upload any photo.

When you submit the form, your IP address is used only transiently for rate-limiting and abuse prevention on the form endpoint; it is not stored long-term.

Cookies and local storage

The site sets no advertising, analytics or tracking cookies. We use only two strictly-necessary first-party items required for the site to function:

NEXT_LOCALE — a first-party cookie set by the internationalisation (i18n) layer to remember your chosen language; strictly necessary.

noir-consent — a localStorage key that stores your cookie-banner choice ('all' or 'necessary'); strictly necessary.

Beyond these, no analytics, advertising or tracking cookies or similar technologies are used anywhere on the site.

Third-party services (loaded only on interaction/consent)

We follow a privacy-by-default approach: the third-party services below are not loaded by default and only activate after you interact with them or give your consent.

Cloudflare Turnstile — a strictly necessary security measure that protects the form against abuse (bot/spam protection); it relies on legitimate interest, requires no consent, and loads when the form is focused. Provider: Cloudflare, Inc. (US/global). It may set functional storage.

Google Maps — an embedded map on the contact page, sitting behind a click-to-load facade that loads only after you accept 'all'. Provider: Google LLC (US). When loaded, it sets cookies and processes your IP address.

Legal bases (GDPR Art. 6 and Art. 9)

Handling your contact/appointment request: GDPR Art. 6(1)(b) (steps taken at your request) and/or Art. 6(1)(f) legitimate interest (answering your enquiries, preventing abuse).

Photos and any health/special-category data they may contain: GDPR Art. 9(2)(a) explicit consent — given via the KVKK consent checkbox on the form. Under KVKK, the basis is your explicit consent under Art. 6.

Strictly-necessary cookies/storage (NEXT_LOCALE, noir-consent): necessary to provide the service (GDPR Art. 6(1)(f) and the ePrivacy 'strictly necessary' exemption).

Anti-abuse bot/spam protection on the form (Cloudflare Turnstile): as a strictly necessary security measure, legitimate interest (GDPR Art. 6(1)(f)); no consent required.

Consent-based third-party content (Google Maps) and the related cross-border transfer: GDPR Art. 6(1)(a) and Art. 49(1)(a) explicit consent.

For consent-based processing, you may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

Recipients, processors and international transfers

We do not sell your personal data. We use a limited number of service providers (processors) strictly for the purposes described in this policy:

Resend — transactional e-mail delivery of your form submission to us, US.

Cloudflare, Inc. — Turnstile bot/spam protection and edge/CDN infrastructure, US/global.

Vercel Inc. — hosting/CDN; in doing so it processes request logs and your IP address, US/EU.

Google LLC — Google Maps, only when loaded with your consent, US.

International transfers: these providers may process data in the United States. Under GDPR Chapter V, such transfers rely on Standard Contractual Clauses (SCCs) where available and/or on your explicit consent under Art. 49(1)(a). Under KVKK Art. 9, the legal basis is your explicit consent and/or appropriate safeguards.

Retention

We keep your contact/appointment data for as long as needed to handle your request, and for a maximum of 12 months.

If the contact does not develop into an ongoing client relationship, your data — including any photos you uploaded — is deleted at the end of that period.

Your rights

If you are in the EU/EEA, under GDPR Art. 15–22 you have the rights to: access (Art. 15), rectification (Art. 16), erasure / to be forgotten (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You may also withdraw your consent at any time under Art. 7(3).

If you are in Türkiye, please also see the KVKK Privacy Notice for your rights under KVKK Art. 11 (information, rectification, erasure, objection and others).

To exercise your rights, contact us at thevoidink@gmail.com.

If you believe the processing is unlawful, you have the right to lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Authority/Board (KVKK); in the EU/EEA, the data protection authority of your country.

Security measures

We take reasonable technical and organisational measures to protect your data: site and form traffic is encrypted with HTTPS/TLS; access to the form is protected by bot protection (Cloudflare Turnstile); your IP address is used only transiently for abuse prevention and is not stored; the data and photos you send are processed with limited access, solely to assess your request; and we work with reputable service providers.

No transmission over the internet is 100% secure, but we take care to minimise the risk.

Children

The studio serves only persons aged 18 and over. Our website and services are not directed at anyone under 18, and we do not knowingly collect personal data from them. If we become aware that someone under 18 has sent us data, we delete it.

As a matter of studio practice, single-use sterile equipment is used and aftercare instructions are provided after every procedure.

Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published on this page together with the last-updated date.

How to contact us

For any question or request about privacy and data protection: Eren Can Kaya ("Noir Tattoo"), 'Veys Art Tattoo Studio', Çamlık Cd. No: 39, Konyaaltı / Antalya, Türkiye.

E-mail: thevoidink@gmail.com · Phone: +90 551 721 12 70.