Privacy and personal data

1. Data controller

This notice is issued under the Turkish Personal Data Protection Law No. 6698 (KVKK). The data controller for personal data processed on artcycle.co is Uğur Karataş.

Contact for personal data requests: artcycle.co@gmail.com.

2. What we process and why

Personal data is processed only for the purposes below and only as far as needed:

• Offers and enquiries about a work: name, email, message, an optional offer amount and the work concerned. Purpose: passing your request to the artist and replying to you.
• Artist applications: name, email, introduction, optional portfolio link, city, images and portfolio file. Purpose: reviewing the application and telling you the result.
• Art lover, collaboration, media and general messages: name, email, message, optional organisation or subject. Purpose: replying to you.
• Email newsletter: email address, language, the topics you chose (Journal, exhibition openings and invitations, Weekly Artwork, artcycle news), the page you signed up on, the version of the consent text, and the times you sent the form and opened the confirmation link. Purpose: sending emails on the topics you chose and being able to show your consent when needed. Your sign-up starts when you open the confirmation link sent to your email; if you are signed in to your account, your email is already verified and it starts at once. Your IP address is not kept. The newsletter carries no sales or offer information.
• Account: email address, language and, if you add it, your full name. When you first sign in with Google or Apple, your name comes from there; you can change or delete it. No password is kept; your age or any other identity detail is not asked. Purpose: providing your account and, while you are signed in, filling in the offer form and the guestbook with your name.
• Account centre: the works, articles, exhibitions and Weekly Artwork pages you save, the status of offers you made while signed in, and your notification choices. What you saved on this device without signing in is added to your account automatically when you sign in (page addresses only). You get an email when your offer changes; you can turn this off in your account.
• Guestbook: your note and, if you write it, your name. Purpose: publishing the note on the exhibition page once approved. Your email address is not asked.
• Security: to prevent abuse of forms, IP addresses are counted briefly in memory and not stored; Cloudflare Turnstile may be used to tell automated submissions apart.
• Artists' own data (name, biography, work details, images): published on the site under the agreement with the artist. AI service providers may be used for draft translations of artists' texts; the artist can turn this off.

3. How data is collected and legal basis

Data is collected electronically and directly from you, when you fill in a form, confirm a newsletter sign-up or use your account.

Legal bases (KVKK Article 5): being directly related to setting up or performing a contract, for replying to your request, reviewing your application and providing your account; the controller’s legitimate interest, for site security; a legal obligation, for proving your newsletter consent; your explicit consent, for the email newsletter, for publishing a guestbook note and for the transfer to the email service provider abroad (Resend, US).

This notice is for information and asks for no approval. The consent box on a form shows only your consent. You can withdraw consent at any time: for the newsletter, with the link in every email or from your account.

4. Transfers and service providers

Personal data is not sold and not shared for advertising or profiling. Offers and enquiries are passed only to the artist of the work concerned. The site works with the providers below; some are located abroad, so your data may be transferred outside Türkiye:

• netcup (Germany): the server hosting the site and its database.
• Cloudflare (US based, global network): domain routing, content delivery, attack protection and form verification (Turnstile).
• Resend (US): sending sign-in link, confirmation, newsletter and notification emails; only the recipient address and the email content. This transfer is based on your explicit consent.
• Backup service (Backblaze B2): encrypted storage of server backups.

5. Retention

When the period ends, the record is deleted:

• Offers: 2 years.
• Contact, art lover, collaboration and media messages: 1 year.
• Artist applications: while under review; 6 months if unsuccessful. Records of artists who have had an exhibition are kept for as long as they appear on the site.
• Images (up to 5) and the portfolio file (PDF) uploaded with an artist application: deleted after 90 days.
• Comment pins in 3D exhibitions (artist preview): 3 months after the exhibition closes.
• Email newsletter: your address is deleted the moment you leave. As legal proof, only the consent and leaving dates, the topics you chose and an irreversible digest of your address are kept for 3 years, then deleted. A sign-up you never confirm is deleted after 30 days. Every email carries a topic preferences link and a one-click unsubscribe link.
• Account: until you delete it. You can delete your account yourself under Account and security, with a confirmation link sent to your email; your name, what you saved, your newsletter subscription and your offer records are deleted too.
• Guestbook note: your name is deleted after 1 year; the note may stay on the exhibition page without a name. Your notes also stay without your name when you delete your account.

6. Cookies and measurement

The site uses only cookies that are strictly necessary, so there is no cookie banner. Visitor cookies are the language choice (`dil`, 1 year) and, when you sign in to your account, an encrypted cookie that keeps you signed in (deleted when you sign out). Authorised people signing in to the admin panel get a session cookie.

What you save without signing in stays only in your browser’s storage; when you sign in, the page addresses are added to your account.

Visit statistics are kept with a cookieless tool running on our own server (Umami); IP addresses are not stored and no per person record is created.

In 3D exhibitions only four anonymous total counters reach the server: entering, moving to a stop, starting the guided tour and leaving. Interaction details such as gaze, time and touch stay on your device.

7. Your rights

Under KVKK Article 11 you have the right to:

• Learn whether your personal data is processed and request information if it is.
• Learn the purpose of processing and whether data is used accordingly.
• Know the third parties in Türkiye or abroad to whom it is transferred.
• Ask for correction if it is incomplete or wrong, for deletion or destruction under KVKK Article 7, and for these actions to be notified to recipients.
• Object to a result against you arising solely from automated analysis.
• Claim compensation for damage caused by unlawful processing.

8. Requests

Send your request to artcycle.co@gmail.com from the email address you used on the form or subscription. You will receive a free answer within 30 days at the latest. A deletion request removes the record completely; the digest and dates kept to prove you left the newsletter are deleted when their retention period ends.

If you have an account, you can download a copy of your data as a file and delete the account yourself under Account and security.

The general contact address shown on the site is contact@artcycle.co; personal data requests go to the address above.

9. Changes

This notice is updated when the way data is processed changes. The current version is always on this page; the last update date is shown at the top. The Turkish version prevails.