1. Introduction

Çağla Cabaoğlu Gallery ("Gallery", "we", "us", or "our") is committed to protecting your privacy and personal data in accordance with the Turkish Personal Data Protection Law (KVKK - Law No. 6698), Electronic Commerce Law (Law No. 6563), and other applicable Turkish and international regulations.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website, galleries, or interact with our services. As the data controller, we are responsible for the processing of your personal data in accordance with applicable laws.

2. Data Controller Information

Contact details for the data controller are provided below:

Data Controller: Çağla Cabaoğlu Gallery
Address: Istanbul, Turkey
Email: info@caglacabaoglu.com
Website: https://caglacabaoglu.com

3. Personal Data We Collect

We may collect the following categories of personal data:

3.1 Identity Information

Name and surname
Date of birth (if provided)
Nationality (for international transactions)
Turkish identification number (TC Kimlik No.) - only when legally required

3.2 Contact Information

Email address
Telephone number
Postal address
Social media account information (if you interact with us on social platforms)

3.3 Transaction and Financial Information

Artwork purchase history and preferences
Billing and shipping addresses
Payment information (processed securely through third-party payment processors)
Auction participation records

3.4 Technical and Usage Data

IP address and device information
Browser type and version
Operating system
Pages visited, time spent on pages, and click patterns
Referral sources and exit pages
Cookie and tracking technology data

3.5 Marketing and Communication Data

Newsletter subscription preferences
Exhibition invitation and event attendance records
Art preference and interest information
Communication history with the Gallery

3.6 Visual and Audio Data

CCTV footage from our physical gallery spaces (for security purposes)
Photographs from gallery events (with your consent)

4. Legal Basis and Purposes of Data Processing

We process your personal data based on the following legal grounds as defined in KVKK Article 5:

4.1 Explicit Consent

When you subscribe to our newsletter, create an account, or participate in marketing activities, we process your data based on your explicit consent. You may withdraw your consent at any time.

4.2 Performance of Contract

Processing is necessary for the performance of our contractual obligations when you:

Purchase artwork or services from the Gallery
Commission artwork or consultancy services
Participate in auctions or private sales

4.3 Legal Obligations

We process personal data to comply with legal obligations under Turkish law, including:

Tax and accounting regulations
Anti-money laundering (AML) requirements
Electronic Commerce Law obligations
Consumer protection laws
Turkish Commercial Code requirements

4.4 Legitimate Interests

We process personal data for our legitimate business interests, including:

Security of our premises and website
Prevention of fraud and illegal activities
Business analytics and operational improvements
Network and information security

5. How We Use Your Personal Data

We process your personal data for the following purposes:

Providing gallery services and fulfilling artwork transactions
Sending newsletters, exhibition invitations, and event announcements (with consent)
Responding to your inquiries and providing customer support
Processing payments and managing financial transactions
Maintaining customer relationship management (CRM) systems
Conducting market research and analyzing visitor preferences
Improving our website, services, and user experience
Ensuring security of our physical and digital spaces
Complying with legal, regulatory, and tax obligations
Protecting our legal rights and preventing fraud
Managing vendor and partner relationships

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience and analyze website traffic. Cookies are small text files stored on your device that help us remember your preferences and understand how you use our website.

Types of Cookies We Use

Essential cookies: Required for website functionality and security
Performance cookies: Help us understand how visitors interact with our website
Functional cookies: Remember your preferences and settings
Marketing cookies: Used for targeted advertising (only with your consent)

You can control cookies through your browser settings. Please note that disabling certain cookies may affect website functionality. For detailed information, please see our Cookie Policy.

7. Sharing and Transfer of Personal Data

We do not sell your personal data to third parties. However, we may share your personal data with the following categories of recipients in accordance with KVKK:

7.1 Service Providers and Business Partners

IT service providers and cloud hosting services
Payment processors and financial institutions
Email marketing and CRM platforms
Shipping and logistics companies
Professional advisors (lawyers, accountants, consultants)
Marketing and analytics service providers

7.2 Legal and Regulatory Authorities

We may disclose your personal data to government authorities, law enforcement agencies, and regulatory bodies when required by Turkish law or to protect our legal rights.

7.3 International Data Transfers

Some of our service providers may be located outside Turkey. In such cases, we ensure that appropriate safeguards are in place in accordance with KVKK Article 9, including:

Standard contractual clauses approved by Turkish authorities
Adequate level of data protection in the recipient country
Your explicit consent for international transfers (when required)

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. Our security measures include:

Encryption of data in transit and at rest
Secure socket layer (SSL) technology for website communications
Access controls and authentication mechanisms
Regular security audits and vulnerability assessments
Employee training on data protection and security
Secure backup and disaster recovery procedures
Physical security measures for our premises and data centers

While we take all reasonable precautions, no method of transmission over the internet is completely secure. We cannot guarantee absolute security of your personal data.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Turkish law. Our retention periods vary depending on the type of data:

Transaction records: 10 years (as required by Turkish Tax Law and Commercial Code)
Marketing data: Until consent is withdrawn or 2 years of inactivity
CCTV footage: 30-60 days (unless required for legal proceedings)
Website logs and analytics: 12-24 months
Customer communication records: 3-5 years

After the retention period expires, we securely delete or anonymize your personal data in accordance with our data retention and destruction policy.

10. Your Rights Under KVKK

Under Turkish Personal Data Protection Law (KVKK Article 11), you have the following rights regarding your personal data:

Right to information: Learn whether we process your personal data
Right of access: Request information about how your data is processed
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data under certain conditions
Right to restriction: Request restriction of processing of your personal data
Right to data portability: Receive your data in a structured, commonly used format
Right to object: Object to processing of your personal data for certain purposes
Right not to be subject to automated decision-making: Request human review of automated decisions
Right to lodge a complaint: File a complaint with the Personal Data Protection Authority (KVKK Kurumu)

How to Exercise Your Rights

To exercise any of these rights, you may submit a written request to us via:

Email: info@caglacabaoglu.com
Registered mail: Çağla Cabaoğlu Gallery, Istanbul, Turkey
Secure electronic signature: Through the Turkish e-Government system

Your request must include your full name, Turkish ID number (or passport number for foreigners), contact information, and a clear description of your request. We will respond to your request within 30 days as required by KVKK.

We may request additional information to verify your identity before processing your request. We do not charge a fee for processing requests unless they are manifestly unfounded or excessive.

11. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately, and we will delete such information.

12. Marketing Communications

With your explicit consent, we may send you marketing communications about our exhibitions, events, new artworks, and gallery news via email, SMS, or other channels.

You can withdraw your consent and unsubscribe from marketing communications at any time by:

Clicking the "unsubscribe" link in our emails
Replying "STOP" to SMS messages
Contacting us directly at info@caglacabaoglu.com

Please note that even if you opt out of marketing communications, we may still send you transactional messages related to your purchases or account.

13. Third-Party Websites

Our website may contain links to third-party websites, social media platforms, or services. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will notify you of any material changes by:

Posting the updated policy on our website with a new "Last Updated" date
Sending you an email notification (if we have your email address)
Displaying a prominent notice on our website

We encourage you to review this Privacy Policy periodically. Your continued use of our website or services after changes are posted constitutes your acceptance of the revised policy.

15. Contact Information and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Çağla Cabaoğlu Gallery

Istanbul, Turkey

Email: info@caglacabaoglu.com

Website: https://caglacabaoglu.com

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu - KVKK):

Personal Data Protection Authority

Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No:4 Balgat, Çankaya, Ankara, Turkey

Website: https://www.kvkk.gov.tr

Email: kvkk@kvkk.gov.tr

16. Consent Declaration

By using our website and services, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal data as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our website or services.

This Privacy Policy is prepared in accordance with Turkish Personal Data Protection Law (KVKK - Law No. 6698), Electronic Commerce Law (Law No. 6563), and applicable Turkish and international data protection regulations.

Privacy Policy & Personal Data Protection Notice