Privacy Policy

Controller and contact

This notice explains personal data processing through the Görkem Studio website. The controller is Görkem Atlayan. Location: Amsterdam, Netherlands. Privacy requests and contact: info@gorkematlayan.com. The location is not a complete postal address.

Data, purposes and legal grounds

• Enquiries and proposals: Your name, email, message, selected service and any phone, budget or timing details you provide are used to answer your enquiry, prepare a proposal and take pre-contractual steps you request. The basis is GDPR Article 6(1)(b); correspondence with representatives of organisations relies on the legitimate interest in handling business enquiries under Article 6(1)(f). Where Turkish Law No. 6698 applies, Article 5(2)(c) or (f) is assessed subject to its conditions.
• Service and record management: Client contact details, accepted proposals, project correspondence and invoice information are processed to perform contracts and meet applicable accounting/tax obligations under GDPR Article 6(1)(b) and (c), or the relevant Turkish-law provisions where applicable. Necessary records may also be kept on an appropriate legal basis to establish, exercise or defend legal claims.
• Security: Server connections may involve IP addresses and technical request information for delivery, abuse prevention and access security. Form records may contain an IP-derived hash and browser information. This processing relies on the legitimate interest in providing a secure service; a hash is not treated as anonymous data.
• Optional analytics: Only with separate consent, we process random visitor/session identifiers, public page paths, project and service interactions, scroll depth and visit duration, language, device/browser categories and country. The purpose is to understand and improve site use. The basis is GDPR Article 6(1)(a), and explicit consent under Turkish law where applicable. New analytics records do not store raw IP addresses, cities or coordinates. Random identifiers are not anonymisation.

Data comes directly from forms, service correspondence, browser requests and consented interactions. Name, email and enquiry details are needed to handle a form; optional fields may be left blank. Declining analytics does not prevent contact. Please do not submit sensitive data, identification documents or payment-card details in message fields. Sending a form does not give marketing permission. If you allow analytics, campaign-source information and the referring hostname may also be associated with your enquiry.

Recipients and international processing

We use Vercel for hosting and content delivery, Supabase for database/storage and administrator authentication, and Brevo for transactional email. The Supabase project's primary database region is eu-west-1 in the EU. This does not mean all provider support, network, subprocessor and backup operations occur exclusively in the EU. Providers may process the data necessary for their services. Disclosures may also be made to competent authorities when required by law and professional advisers where necessary.

Transfers outside the EEA require a valid mechanism and necessary safeguards under GDPR Chapter V; cookie consent does not replace those requirements. Transfers subject to Turkish law separately require compliance with its current Article 9. You can request information about relevant recipients and the applicable transfer safeguards, including a copy, at our contact address. This notice itself is not a transfer agreement or adequacy decision.

Retention and deletion

A daily housekeeping process removes raw analytics and analytics-consent records older than 180 days. Browser-storage durations are described in the Cookie Policy. Enquiries are retained to resolve the request and complete necessary follow-up; records becoming part of a business relationship are kept according to the contract, applicable mandatory accounting/tax periods and specific legal-claim needs. Deletion or anonymisation must follow when data is no longer needed; a live dispute or mandatory retention obligation may defer deletion of relevant records. Infrastructure-log and backup periods depend on provider service configuration. On request, we can explain the retention grounds applying to your data.

Your rights and requests

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability, and object to processing. You may object to legitimate-interest processing based on your particular situation. Analytics consent can be withdrawn on the Cookie Preferences page. Withdrawal does not affect the lawfulness of earlier processing and does not automatically erase historical server records; you may separately request erasure.

Send requests to info@gorkematlayan.com. We request only necessary, proportionate identity verification. GDPR requests are normally answered within one month; if a permitted extension is necessary, we explain why within the first month. You may complain to a competent supervisory authority, including the Dutch Autoriteit Persoonsgegevens. Where Turkish law applies, its Article 11 rights, Article 13 maximum thirty-day response period and complaint procedures also remain available.

We do not use solely automated decisions producing legal or similarly significant effects, or sell personal data. Linked external sites have their own privacy practices. If purposes or scope change, we update this notice and seek fresh permission where required.