KVKK Lighting and Privacy Policy

Updated 23 October 2026 · Version 2026-10-24.1

This notice explains personal data processing for Aktif Sanat membership, artist profiles, artworks, courses, publications, comments, forums and support. It is a privacy notice, not consent or a sales contract.

1. Operator and requests

The data controller is Urnova LTD ŞTİ. Aktif Sanat is an initiative of inovalixus and Urnova LTD ŞTİ.

Postal address for notices and written requests: Fatih Mah Güneş Sokak No 16 Silivri / İstanbul, Türkiye. You do not need membership or login to make a postal data-protection request. Members may also write from their registered email address to the management email shown on the contact page.

2. Data and collection

We process names, email, account type, telephone, verification and preference records; for artists, profile photos, short profiles, CVs, optional awards, Instagram and sales links. Art images, specifications, prices and availability, requests, bids, payment declarations, necessary delivery addresses, favourites, publication access, comments, forum posts and support messages are recorded.

Information comes electronically from forms, uploads, account actions, correspondence and authorised administrator entries, and physically from written requests. Existing artist and artwork records were migrated from the former Aktif Sanat site. Browser, session, IP and server access records arise technically. Do not put health information, identity documents or unnecessary third-party data in profiles or messages.

3. Purposes and legal grounds

• Membership, verification, artist promotion, favourites, requests and publication access: processing necessary to enter into or perform a contract, Turkish Law No. 6698 (KVKK), Article 5(2)(c).
• Data-subject requests and applicable statutory record duties: Article 5(2)(a) and (ç); establishment, exercise or protection of rights: Article 5(2)(e).
• Access security, abuse prevention and troubleshooting: legitimate interests that do not harm fundamental rights, Article 5(2)(f), limited to necessary data.
• Optional art and course announcement emails: separate explicit consent under Article 5(1). You can withdraw this in account settings without losing membership. Withdrawal does not retrospectively invalidate lawful processing.

Accepting a privacy notice is not a service condition. Membership terms and optional marketing consent are separate. Required fields serve the relevant service; an action may be unavailable without necessary information. The system does not make legally or similarly significant decisions about you solely through automated analysis.

4. Publication, recipients and international processing

Approved artist names, photos, biographies, artworks, prices and social links are public. Approved comments and forum posts show the display name. Artist email and telephone are not public profile fields. Management contact details are visible to logged-in members; the postal privacy-request address is public.

Once uploaded, approved and published, artwork images can be seen by others and technically captured, downloaded or copied. This does not grant permission to copy or use the artwork unlawfully.

Authorised administrators review accounts and requests to operate the service. Request notifications go to management’s domain email and Özgür Aslan’s management Gmail address; they contain the artwork/title, request number and panel link. Artists can see requests for their own work, but buyer contact details and artist email notifications require administrator approval. Communication channels are agreed with artists.

Güzel Hosting provides hosting and system email. Servers are in Türkiye. No sales abroad have taken place yet. Necessary records may be provided to competent authorities under a lawful request or duty. Banks, carriers and direct sellers process information for their own transactions.

Normal correspondence uses the rented Turkish email server; Gmail may also be used. WhatsApp is only for artists who separately and voluntarily join the artist community, without affecting membership or publication. Other participants may see telephone/profile details; artists may leave. Gmail and WhatsApp involve international providers. Turkish servers or the absence of foreign sales do not establish that no international data transfer occurs. You may request details of recipients, safeguards and the Article 9 transfer basis through the channels below.

Following Instagram, WhatsApp, Shopier or other external links takes you to services with their own privacy terms. A gallery image, artwork/artist names and link selected for sharing are passed to your chosen application.

5. Payments and publications

The site collects no card details and makes no automatic charges. A bank-transfer answer is your declaration; management verifies payment separately. PDFs require login and access permission. A payment-approved access code is account- and publication-specific, valid for 30 days and usable once. Management delivers it manually to the registered email address. Payment and consumer rights are described in the terms.

6. Retention and deletion

Requests, correspondence, emails, technical logs and server/device backups have a general maximum retention of one year, subject to the shorter technical periods below. Records legally requiring longer retention are separated for that obligation only and removed when it ends. Published artist profiles and works remain while the account and publication request continue.

Choose a password at registration and use your account immediately. Artists must verify their email before submitting their profile for administrator approval. Email verification, email-change and password-reset links last 24 hours; a new verification email invalidates the previous link. Temporary photos from failed or incomplete uploads are subject to two-day cleanup; profile photos and artworks saved to an account remain while the account/publication continues.

Account and content records remain while the service relationship and processing purpose continue. You can export data, request content removal and delete your account in the panel. Account deletion removes active profiles/content and clears direct identity/contact fields in requests. It does not instantly erase server/device backups, mailboxes, external services or copies taken by others; these environments also need consideration when dealing with deletion requests.

Data whose legal processing basis has ended must be erased, destroyed or anonymised. Records needed for a continuing statutory obligation or dispute are restricted to that purpose and necessary period. Erasure/destruction operations must be documented and those logs kept for at least three years. You may request the reason, duration and backup status for your particular records.

7. Your rights and applications

Under Article 11 you can ask whether and why data are processed, whether use matches the purpose, and who receives data domestically or abroad; obtain information or correction; request erasure/destruction where conditions are met and notification to recipients; object to adverse results based solely on automated analysis; and seek compensation for unlawful processing.

Write to the address in section 1. Include your name, signature for a written request, Turkish identity number for Turkish citizens or nationality and passport/identity number for others, service address, available notification email/telephone, request details and relevant supporting documents. Do not send unnecessary identity photocopies or sensitive data. Proportionate further verification may be needed. Creating an account is not required.

Requests are answered as soon as their nature permits and within 30 days. They are normally free; only charges permitted by the Authority’s tariff may apply. Rejections must be reasoned. You can complain to the Board within 30 days of learning the response and, in all cases, within 60 days of the original request. If unanswered, you may complain after the 30-day response period and within that 60-day limit.

8. Security and notifications

HTTPS, password hashing, role/ownership checks, security tokens, upload type/size checks and private PDF access controls are applied. Camera, microphone and location permission are not requested. Verification, password and request emails use the operational email system. Application delivery logs contain subject, date and result, not message bodies or verification links.

After learning of a personal data breach, the controller must notify the Board without delay and within 72 hours, and affected individuals as soon as reasonably possible after identifying them. Report security/privacy issues through section 1.

9. Cookies and browser storage

• First-party as_guest: visitor-form security, 24 hours.
• First-party WordPress login cookies: browser session, or 14 days with “remember me”; normal server-side session validation lasts two days.
• Local as-consent remembers the cookie-notice choice; as-exhibit-scene, as-exhibit-music and as-exhibit-volume remember your gallery and sound settings. They stay until changed or site data is cleared.

No advertising or third-party analytics cookies are used. The counter retains aggregate page views for the last 60 days, without individual browsing profiles. Logs retain the latest 100 browser error types/paths/lines, 50 email delivery results and 500 authorised actions. Rate limiting briefly uses an IP hash; hosting access logs are separate. You can clear cookies/site data in your browser; login may be required again.

Changes in purposes or recipients require updated notice and, where necessary, separate consent. Updating this notice does not itself create new consent.