Privacy Notice (KVKK)

1. Identity and contact details of the data controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Eren Can Kaya ("Noir Tattoo") as data controller, within the scope described below. Noir Tattoo operates as an independent tattoo artist at "Veys Art Tattoo Studio".

Address: Çamlık Cd. No: 39, Konyaaltı / Antalya, Türkiye. E-mail: thevoidink@gmail.com. Phone: +90 551 721 12 70. Tax/registry details: [Tax No.: to be completed].

This notice is prepared under KVKK Art. 10 and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation. For visitors in the EU/EEA, references to the GDPR are included where relevant; the controller is established in Türkiye, and the KVKK is the primary framework.

2. Scope of this notice

This notice concerns only the personal data we collect through the contact/appointment form ("/contact") on our website. There is no other personal-data collection point on the site.

We use no advertising or analytics tracking technologies.

3. Categories of personal data processed

Identity data: first and last name.

Contact data: e-mail address and phone number (including the country dial code).

Request data: the free-text message you enter in the form (your tattoo request, preferences, etc.).

Visual and special-category data: photos you optionally upload via the form (max. 5, images only). As these photos may show a body area or existing tattoos, they may constitute SPECIAL-CATEGORY data of a health nature within the meaning of KVKK Art. 6 (and Art. 9 GDPR). Uploading photos is entirely optional.

Transaction-security data: to prevent abuse/spam at the form endpoint, your IP address is used only transiently (for instantaneous rate-limiting) and is not stored long-term. The hosting infrastructure may also keep technical request logs.

4. Purposes of processing

Receiving, evaluating and responding to your contact/appointment request.

Assessing the feasibility and design of your tattoo request on the basis of any photos you upload.

Preventing spam and bot/abuse at the form endpoint and ensuring information security.

Fulfilling and following up on our obligations and any potential legal claims.

5. Legal bases (KVKK Art. 5 and Art. 6; GDPR Art. 6 and 9)

Your identity, contact and request data are processed on the basis of KVKK Art. 5/2-(c) (necessity for the establishment or performance of a contract/appointment made at your request), Art. 5/2-(e) (establishment, exercise or protection of a right) and Art. 5/2-(f) (our legitimate interest in responding to your enquiry). Under the GDPR these correspond to Art. 6(1)(b) and 6(1)(f).

The transient processing of your IP address for spam/bot prevention and security, together with the strictly necessary bot/spam protection on the form (Cloudflare Turnstile), relies on legitimate interest (KVKK Art. 5/2-(f); GDPR Art. 6(1)(f)) and requires no consent.

Because photos you choose to upload may contain special-category (health) data, they are processed solely on the basis of your EXPLICIT CONSENT under KVKK Art. 6 (and Art. 9(2)(a) GDPR). This consent is obtained via the KVKK consent checkbox on the form; you may also contact us without uploading any photo.

The use of strictly necessary first-party cookies/local storage is based on legitimate interest (KVKK Art. 5/2-(f)), as it is required for the site to function, and does not require consent.

6. Method of collection

Your personal data is collected by electronic and automated means when you complete and submit the contact/appointment form on our website.

Your IP address is processed server-side only momentarily, for rate-limiting/abuse-prevention during submission.

7. Cookies and local storage

We use only strictly necessary first-party technologies: (1) NEXT_LOCALE — a first-party cookie set by the i18n layer to remember your chosen language; (2) "noir-consent" — a localStorage entry storing your cookie-banner choice ("all" or "necessary").

There are no analytics, advertising or tracking cookies of any kind on the site.

8. Transfers to third parties and cross-border transfer (KVKK Art. 9)

To the extent necessary to provide the service, your personal data is processed via the following non-Türkiye service providers (processors/recipients):

Resend — delivery of your form submission to us by e-mail (US).

Cloudflare, Inc. — Cloudflare Turnstile bot/spam protection on the form, plus edge infrastructure; Turnstile is a strictly necessary security measure that loads to protect the form against automated abuse (legitimate interest, no consent required), loads when the form is focused and may set functional storage (US/global).

Vercel Inc. — hosting/CDN for the site; may process technical request logs and IP addresses (US/EU).

Google LLC — the embedded Google Maps on the contact page; it activates only after you accept "all" in the cookie banner and load the map (click-to-load), in which case it sets cookies and processes your IP address (US).

As some of these providers process data on servers located in the United States, these operations constitute a cross-border transfer within the meaning of KVKK Art. 9. Such transfers are carried out on the basis of your explicit consent and/or the appropriate safeguards foreseen in Art. 9 (e.g. standard contracts or undertakings approved by the Board). Under the GDPR, transfers rely on Standard Contractual Clauses where available and/or your explicit consent (Chapter V, Art. 44-49).

Privacy by default: Turnstile is a strictly necessary security measure that loads on form interaction to protect the form against spam and bot abuse (legitimate interest, no consent required); Google Maps loads only with your explicit consent, and no data is transferred to Google unless and until you consent.

9. Retention and destruction

Your contact/appointment data is kept for as long as needed to conclude your request and for no more than 12 months. At the end of this period, unless the relationship has become an ongoing client relationship, your data is deleted, destroyed or anonymised.

If the relationship becomes an ongoing client relationship, data is kept for the period required by that relationship and by legal obligations.

Transiently processed data such as IP addresses is not stored long-term.

10. Your rights as a data subject (KVKK Art. 11)

Under KVKK Art. 11 you have the right to: (a) learn whether your data is processed; (b) request information if it has been processed; (c) learn the purpose of processing and whether it is used accordingly; (ç) know the third parties to whom it is transferred in Türkiye or abroad; (d) request rectification of incomplete or incorrect data; (e) request erasure or destruction; (f) request that rectification/erasure be notified to third parties to whom the data was transferred; (g) object to a result to your detriment arising from analysis solely by automated means; and (ğ) claim compensation for damage suffered due to unlawful processing. EU/EEA data subjects additionally have the GDPR rights of access, rectification, erasure, restriction, portability and objection.

11. How to apply and response time

You may submit requests regarding your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller: in writing to the address above with a wet-ink signed petition, or via registered electronic mail (KEP), secure electronic signature, or the e-mail address registered in our system, to thevoidink@gmail.com.

Your application should include: your name and surname (and signature if in writing), your Turkish ID number (or passport/ID number for foreign nationals), an address for notification, your e-mail/phone if any, and the subject of your request.

Your request will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest; however, if the process entails an additional cost, a fee may be charged per the tariff set by the Board.

If your application is rejected, you find the response insufficient, or you receive no timely response, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and, in any case, within 60 days of the application date.

12. Withdrawing consent

You may withdraw your explicit consent to the processing of photos/special-category data and to the cross-border transfer at any time, without giving reasons, by notifying thevoidink@gmail.com.

You may also change your preference for consent-based content such as Google Maps by selecting "necessary" only in the cookie banner.

Withdrawal of consent takes effect for the future and does not affect processing lawfully carried out before the withdrawal.

13. Additional information and studio policy

Our services are provided only to persons aged 18 and over; we do not knowingly process the data of minors.

Single-use sterile equipment is used in the studio, and aftercare instructions are provided to you following the procedure.

This notice may be updated from time to time; the current version is published on this page.