Privacy policy

This policy explains how Bead Art Gallery (“we”, beadartgallery.com) handles personal data. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and Türkiye’s Personal Data Protection Law No. 6698 (KVKK).

What we collect

When you send a form (price request, offer, artwork question, gallery inquiry or general message) we store what you enter: name, email address, buyer type, organisation and website if given, the subject, the amount and currency of an offer, your message, and the artwork concerned. We also store the date and time, your IP address, the country that your IP address maps to (determined by Cloudflare) and your browser’s user-agent string (browser and operating system). This helps us judge whether a message is genuine, understand where our visitors come from and protect the forms from abuse; it is kept together with the inquiry.

For security we also keep a one-way, keyed hash of your IP address for 30 days to limit repeated submissions.

Server logs. Our hosting and network providers process IP addresses and request details in technical logs to deliver and protect the website.

Why we use it, and on what legal basis

• To answer your inquiry and discuss a possible acquisition — steps taken at your request before a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To keep the website and forms secure and free of spam — our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To keep records a completed sale requires by law — legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).

We do not sell your data, use it for advertising or add you to a mailing list.

Cookies and analytics

The public website sets no cookies. A strictly necessary session cookie is used only in the private administration area. Visits are counted with Cloudflare Web Analytics, which uses no cookies and does not track individual visitors across sites. We use no advertising or tracking tools.

Who processes the data

• Hetzner Online GmbH — website hosting (data centres in the EU).
• Cloudflare, Inc. — content delivery and security for the website.
• Resend — delivery of the notification and confirmation emails sent after you use a form.
• Our email provider, where your message is received and answered.

Some of these providers process data outside your country, including in the United States. Where this happens, transfers rely on the safeguards provided by those providers, such as the European Commission’s Standard Contractual Clauses.

How long we keep it

Inquiries and related correspondence are kept for up to 24 months after our last exchange, unless a completed sale requires longer retention by law. Security records (hashed IP data) are deleted after 30 days; the IP address, country and browser details stored with an inquiry are deleted with it.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy of it. Under KVKK you may also exercise the rights listed in Article 11. To do so, use the contact form. You may also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority — KVKK).

Changes

If this policy changes, the updated version will be published on this page with a new date.