Data Protection Notice / KVKK Information Notice

Last updated: 19 July 2026

Inkwallart respects your privacy and is committed to processing
personal data lawfully, fairly, transparently and securely.

This Data Protection Notice explains how we collect, use, disclose,
store and protect personal data when you:

  • Visit our website;
  • Create a customer account;
  • Place or receive an order;
  • Order a personalised product;
  • Contact customer support;
  • Subscribe to marketing communications;
  • Submit a review or other content;
  • Participate in a promotion or survey;
  • Make a trade, artist or business enquiry; or
  • Otherwise interact with Inkwallart.

This Notice is intended to provide information required under
applicable data protection laws, including:

  • The UK General Data Protection Regulation;
  • The UK Data Protection Act 2018;
  • The EU General Data Protection Regulation;
  • Turkish Law No. 6698 on the Protection of Personal Data, where
    applicable; and
  • Other applicable privacy and data protection laws.

This Notice should be read together with our

Privacy Policy

and

Cookie Policy
.

1. Important Information About This Notice

This Notice is provided for transparency and information purposes.

It is not an explicit consent form. Where we need your consent for a
particular processing activity, such as certain marketing or
advertising activities, we will request that consent separately.

Refusing or withdrawing optional consent will not affect processing
that is necessary to:

  • Process and deliver an order;
  • Comply with a legal obligation;
  • Prevent fraud;
  • Protect account and website security; or
  • Establish, exercise or defend legal rights.

2. Data Controller

The organisation responsible for deciding how and why your personal
data is processed is:

Legal company name:
[COMPANY LEGAL NAME]

Trading name:
Inkwallart

Company registration number:
[COMPANY REGISTRATION NUMBER]

VAT or tax number:
[VAT OR TAX NUMBER]

Registered address:
[REGISTERED BUSINESS ADDRESS]

Privacy email:

[email protected]

Customer support email:

[email protected]

Website:

www.inkwallart.com

For the purposes of applicable law, [COMPANY LEGAL NAME] acts as the
data controller or, under Turkish terminology, the “veri sorumlusu”.

3. Data Protection Representatives

Where required by applicable law, our appointed representatives are:

UK Representative

Name:
[UK REPRESENTATIVE NAME]

Address:
[UK REPRESENTATIVE ADDRESS]

Email:
[UK REPRESENTATIVE EMAIL]

European Union Representative

Name:
[EU REPRESENTATIVE NAME]

Address:
[EU REPRESENTATIVE ADDRESS]

Email:
[EU REPRESENTATIVE EMAIL]

Türkiye Representative

Name:
[TÜRKİYE REPRESENTATIVE NAME, IF REQUIRED]

Address:
[TÜRKİYE REPRESENTATIVE ADDRESS]

Email:
[TÜRKİYE REPRESENTATIVE EMAIL]


4. Categories of Personal Data We Process

Depending on how you interact with Inkwallart, we may process the
following categories of personal data.

4.1 Identity Information

  • First name;
  • Last name;
  • Account or customer identifier;
  • Company name;
  • Job title, where relevant; and
  • Signature, where required for a business or legal process.

4.2 Contact Information

  • Email address;
  • Telephone number;
  • Billing address;
  • Delivery address;
  • Business address; and
  • Communication preferences.

4.3 Account Information

  • Login credentials;
  • Encrypted or cryptographically protected password information;
  • Saved addresses;
  • Wishlist items;
  • Recently viewed products;
  • Account preferences; and
  • Account activity.

4.4 Order and Transaction Information

  • Products ordered;
  • Order number;
  • Order date and status;
  • Order value;
  • Selected currency;
  • Discount or promotion information;
  • Payment status;
  • Transaction reference;
  • Delivery and tracking information;
  • Returns, cancellations and refunds; and
  • Customer service history.

4.5 Payment Information

Payment information is generally collected and processed directly by
our authorised payment providers.

We may receive limited payment-related information such as:

  • Payment method;
  • Payment status;
  • Card type;
  • Limited masked card information;
  • Billing verification result;
  • Transaction reference; and
  • Fraud or risk indicators.

Inkwallart does not intend to directly store complete payment card
numbers or card security codes.

4.6 Personalisation Information

If you order a personalised or custom-made product, we may process
information that you choose to provide, including:

  • Names and initials;
  • Dates;
  • Locations;
  • Coordinates;
  • Personal messages;
  • Birth information;
  • Customer-selected colours;
  • Custom measurements;
  • Photographs;
  • Pet photographs;
  • House or building photographs; and
  • Other personalisation instructions.

4.7 Customer Service and Communication Information

  • Emails and messages;
  • Support requests;
  • Complaint details;
  • Call or chat records, where applicable;
  • Return and refund communications;
  • Survey responses;
  • Product feedback; and
  • Other correspondence.

4.8 Technical and Usage Information

  • Internet Protocol address;
  • Device type;
  • Browser type and version;
  • Operating system;
  • Device and cookie identifiers;
  • Approximate location;
  • Language and time-zone settings;
  • Website navigation activity;
  • Pages and products viewed;
  • Referring website or advertisement;
  • Shopping cart activity;
  • Session duration;
  • Login activity;
  • Website performance information; and
  • Error and security logs.

4.9 Marketing Information

  • Newsletter subscription status;
  • Marketing permissions;
  • Email open and interaction information;
  • Product interests;
  • Advertising audience identifiers;
  • Campaign attribution information;
  • Abandoned cart information; and
  • Responses to promotions or competitions.

4.10 Fraud Prevention and Security Information

  • Payment verification results;
  • Suspicious transaction indicators;
  • Failed payment attempts;
  • Device and network identifiers;
  • Account login activity;
  • Chargeback information;
  • Security incident records; and
  • Fraud-screening results.

5. Special Categories of Personal Data

Inkwallart does not intentionally request or collect sensitive or
special-category personal data through its normal retail activities.

Please do not submit information concerning matters such as:

  • Health or medical conditions;
  • Biometric or genetic information;
  • Religious or philosophical beliefs;
  • Political opinions;
  • Trade union membership;
  • Sexual orientation or sex life;
  • Race or ethnic origin; or
  • Criminal convictions or offences.

If such information is included incidentally in customer-supplied
content, we will process it only where legally permitted and as
reasonably necessary to provide the requested service.

6. How We Collect Personal Data

We may collect personal data:

Directly From You

For example, when you:

  • Create an account;
  • Place an order;
  • Submit personalisation details;
  • Contact customer support;
  • Subscribe to marketing communications;
  • Request a refund or return;
  • Submit a review;
  • Enter a promotion;
  • Complete a survey; or
  • Submit a business or artist enquiry.

Automatically

We may collect technical and usage information through:

  • Cookies;
  • Pixels and tags;
  • Local storage;
  • Server logs;
  • Analytics tools;
  • Advertising technologies;
  • Security technologies; and
  • Similar technologies.

From Third Parties

We may receive personal data from:

  • E-commerce platforms;
  • Payment providers;
  • Delivery and fulfilment providers;
  • Fraud prevention providers;
  • Analytics providers;
  • Advertising platforms;
  • Social media platforms;
  • Email marketing providers;
  • Customer service platforms;
  • Review platforms;
  • Business partners; and
  • Publicly available sources.

7. Purposes and Legal Bases for Processing

We process personal data only where we have an appropriate legal basis.

Processing Purpose Categories of Data UK / EU Legal Basis KVKK Basis, Where Applicable
Processing, producing, delivering and managing orders Identity, contact, order, transaction, delivery and
personalisation information 		Performance of a contract Processing necessary for the establishment or performance of a
contract
Processing payments and refunds Identity, transaction, payment and billing information Performance of a contract, legal obligation and legitimate
interests 		Contractual necessity, legal obligation and legitimate
interests
Managing customer accounts Identity, contact, account and technical information Performance of a contract and legitimate interests Contractual necessity and legitimate interests
Providing customer support and handling complaints Identity, contact, order and communication information Performance of a contract, legal obligation and legitimate
interests 		Contractual necessity, legal obligation and establishment,
exercise or protection of a right
Managing returns, refunds and legal guarantees Identity, contact, order, transaction and communication
information 		Performance of a contract and legal obligation Contractual necessity, legal obligation and protection of a
right
Preventing fraud and protecting accounts and transactions Transaction, payment, technical, fraud and security information Legitimate interests and legal obligation Legal obligation and legitimate interests, provided that
fundamental rights are not harmed
Meeting tax, accounting and regulatory obligations Identity, contact, order, payment and transaction information Legal obligation Processing expressly required by law and compliance with legal
obligations
Sending requested or permitted marketing communications Identity, contact, marketing preference and interaction
information 		Consent or legitimate interests, where legally permitted Explicit consent or another applicable lawful processing basis
Measuring website use and improving products and services Technical, usage, device and analytics information Consent where required and legitimate interests Explicit consent where required or legitimate interests
Personalising advertising and measuring campaigns Technical, cookie, marketing and advertising information Consent where required Explicit consent where required
Establishing, exercising or defending legal claims Relevant identity, contact, order, transaction and
communication information 		Legitimate interests and legal obligation Processing necessary for the establishment, exercise or
protection of a right

8. Providing Personal Data

Certain information is required to enter into or perform a sales
contract.

If you do not provide required information, we may be unable to:

  • Accept or process your order;
  • Verify payment;
  • Produce a personalised product;
  • Deliver your order;
  • Provide account services;
  • Complete a return or refund; or
  • Respond to a legal or customer support request.

Information requested solely for optional marketing, advertising or
personalisation purposes will be identified separately where
appropriate.

9. Personal Data About Other People

You may provide information about another person when:

  • Sending a product as a gift;
  • Providing a separate delivery recipient;
  • Ordering a personalised family product;
  • Uploading a photograph containing another person; or
  • Acting on behalf of a business or organisation.

You must ensure that you are authorised to provide that information and
that the individual is appropriately informed where required.

You should not provide sensitive information about another person
without a valid legal basis and their appropriate permission.

10. Recipients of Personal Data

Personal data may be disclosed to service providers and other
recipients where necessary for the purposes described in this Notice.

Recipient categories may include:

  • E-commerce and website hosting providers;
  • Cloud storage and information technology providers;
  • Payment processors and financial institutions;
  • Fraud prevention and security providers;
  • Printing, framing and production partners;
  • Warehouses and fulfilment centres;
  • Postal services and delivery companies;
  • Customs and import service providers;
  • Email and customer communication providers;
  • Customer support platforms;
  • Analytics providers;
  • Advertising and social media platforms;
  • Product review providers;
  • Accountants, auditors, lawyers and insurers;
  • Tax, customs and regulatory authorities;
  • Courts and law enforcement authorities; and
  • Potential purchasers or successors to our business.

Service providers are required to process personal data only for
authorised purposes and subject to appropriate security and
confidentiality requirements.

11. International Transfers

Inkwallart operates internationally and may use service providers,
fulfilment partners or technical infrastructure located outside your
country.

Your personal data may therefore be transferred to or accessed from
countries outside:

  • The United Kingdom;
  • The European Economic Area;
  • Türkiye; or
  • Your country of residence.

Where required, international transfers will be supported by an
appropriate legal mechanism, which may include:

  • An adequacy decision or adequacy regulation;
  • European Commission Standard Contractual Clauses;
  • The UK International Data Transfer Agreement;
  • The UK Addendum to Standard Contractual Clauses;
  • Binding corporate rules;
  • Standard contracts approved under Turkish data protection law;
  • Another legally recognised appropriate safeguard; or
  • A limited legal exception where permitted.

Additional technical and organisational safeguards may also be used,
such as encryption, access restrictions and data minimisation.

You may contact

[email protected]

for more information about the relevant transfer safeguards.

12. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for
the purpose for which it was collected and to comply with legal,
accounting, tax, security and dispute-resolution requirements.

Data Category Indicative Retention Approach
Order and transaction records Retained for the applicable tax, accounting, consumer
protection and legal limitation periods
Customer account data Retained while the account remains active and for a limited
period after closure for security and legal purposes
Customer support communications Retained for the period necessary to resolve the request and
manage possible complaints or disputes
Personalisation files Retained for the period needed to produce the order and manage
reprints, complaints, returns or refunds
Marketing information Retained until consent is withdrawn, an objection is made or
the information is no longer required, subject to maintaining
a suppression record
Fraud and security records Retained for the period reasonably required to detect,
investigate and prevent fraud or misuse
Cookie and analytics data Retained according to the lifespan stated in the Cookie Policy
or cookie preference tool
Legal claims and dispute records Retained until the relevant legal limitation period and related
proceedings have ended

When personal data is no longer required, it will be deleted, destroyed
or anonymised in accordance with applicable law and our internal
retention procedures.

13. Automated Processing and Fraud Screening

We may use automated systems to identify potentially fraudulent,
unauthorised or high-risk transactions.

These systems may consider information such as:

  • Payment verification results;
  • Transaction patterns;
  • Delivery and billing information;
  • Device and network indicators;
  • Previous fraudulent activity; and
  • Information supplied by fraud prevention providers.

Where a decision would produce a legal or similarly significant effect,
we will provide the protections required by applicable law, including
human review where appropriate.

You may contact us if you believe an order or account has been
incorrectly affected by an automated decision.

14. Data Security

We use appropriate technical and organisational measures designed to
protect personal data against:

  • Unauthorised access;
  • Accidental loss;
  • Unlawful disclosure;
  • Alteration;
  • Misuse;
  • Destruction; and
  • Other unlawful processing.

Security measures may include:

  • Encrypted data transmission;
  • Access controls;
  • Password and authentication controls;
  • Secure payment processing;
  • Security monitoring;
  • Employee and contractor access restrictions;
  • Data backup and recovery processes;
  • Security assessments of relevant service providers;
  • Software maintenance and updates; and
  • Incident response procedures.

No online system can guarantee complete security. You are responsible
for keeping your account credentials confidential and notifying us of
suspected unauthorised account activity.

15. UK and European Data Protection Rights

If UK or European data protection law applies to you, you may have the
right to:

  • Request confirmation of whether we process your personal data;
  • Request access to your personal data;
  • Request correction of inaccurate or incomplete personal data;
  • Request deletion of personal data in certain circumstances;
  • Request restriction of processing in certain circumstances;
  • Object to processing based on legitimate interests;
  • Object at any time to direct marketing;
  • Request transfer of certain information in a structured,
    commonly used and machine-readable format;
  • Withdraw consent at any time where processing is based on consent;
  • Request information about international transfer safeguards;
  • Request human review of certain automated decisions; and
  • Lodge a complaint with an appropriate supervisory authority.

These rights are not absolute and may be subject to legal conditions,
exemptions and verification requirements.

Withdrawing consent does not affect the lawfulness of processing
completed before consent was withdrawn.

16. Rights Under Turkish Law No. 6698

Where Turkish Law No. 6698 on the Protection of Personal Data applies,
you may have the right to:

  • Learn whether your personal data is being processed;
  • Request information if your personal data has been processed;
  • Learn the purpose of processing and whether the data is being used
    in accordance with that purpose;
  • Learn the third parties to whom personal data has been transferred
    domestically or internationally;
  • Request correction of incomplete or inaccurate personal data;
  • Request deletion or destruction of personal data where the legal
    conditions are met;
  • Request notification of correction, deletion or destruction to
    third parties to whom the data was transferred;
  • Object to a result arising against you through analysis exclusively
    by automated systems; and
  • Request compensation where you suffer damage because personal data
    was processed unlawfully.

Rights under Turkish law will apply only to the extent that the relevant
processing falls within the territorial and material scope of that law.

17. How to Exercise Your Rights

To submit a data protection request, contact:

Inkwallart Privacy Team

[COMPANY LEGAL NAME]

[REGISTERED BUSINESS ADDRESS]

Email:

[email protected]

Please use the subject line:

Data Protection Request

Your request should include:

  • Your full name;
  • The email address associated with your account or order;
  • Your order number, where relevant;
  • The country in which you reside;
  • A clear description of the right you wish to exercise; and
  • Any information reasonably required to locate the relevant data.

You may also use:


Data Protection Request Form

18. Identity Verification

We may request information reasonably necessary to verify your identity
and protect personal data against unauthorised disclosure.

Verification information will be used only to:

  • Confirm your identity;
  • Confirm your authority to make the request;
  • Locate the relevant personal data; and
  • Prevent fraudulent or abusive requests.

We will not request more information than reasonably necessary for the
relevant verification process.

If an authorised representative submits a request, we may require
evidence of that person’s authority and may also verify your identity
directly.

19. Response Times and Fees

We will respond to data protection requests within the period required
by the law that applies to the request.

We may extend the response period where legally permitted because of
the complexity or number of requests. If this happens, we will explain
the extension where required.

Data protection requests are normally handled without charge.

Where permitted by law, we may charge a reasonable fee or refuse to act
on a request that is manifestly unfounded, excessive or repetitive.

20. Marketing Preferences

You may stop receiving promotional emails by:

  • Selecting the unsubscribe link in a marketing email;
  • Updating your customer account preferences;
  • Using the available communication preference centre; or
  • Contacting

    [email protected]
    .

After unsubscribing from marketing, you may continue to receive
essential service communications relating to:

  • Orders;
  • Payments;
  • Deliveries;
  • Returns and refunds;
  • Account security;
  • Customer service requests; and
  • Important legal or policy updates.

Advertising cookie preferences must be managed separately through our
cookie preference tool.

21. Cookies and Similar Technologies

We use cookies and similar technologies to:

  • Operate the website;
  • Maintain shopping cart and checkout functions;
  • Protect website and account security;
  • Remember preferences;
  • Measure website performance;
  • Understand website usage; and
  • Provide advertising where permitted.

Non-essential cookies are activated only in accordance with applicable
consent requirements.

More information is available in our

Cookie Policy
.

You may review or change your choices here:


Manage Cookie Preferences

22. Children’s Personal Data

The Inkwallart website is not directed at children under the age of 16.

We do not knowingly collect personal data directly from children under
16 without appropriate parent or guardian involvement where required.

Personalised products may contain a child’s name, birth information or
photograph where submitted by a parent, guardian or another authorised
adult.

Adults submitting such information must ensure that:

  • They are authorised to provide it;
  • The information is limited to what is necessary;
  • The content does not create an unnecessary privacy risk; and
  • The product is ordered for a lawful purpose.

Contact us if you believe a child’s personal data has been submitted
without appropriate authority.

23. Complaints

We encourage you to contact us first if you have concerns about how we
process personal data.

Contact:


[email protected]

You may also have the right to complain to the relevant data protection
authority.

United Kingdom

You may complain to the UK Information Commissioner’s Office where UK
data protection law applies.

European Economic Area

You may complain to the data protection authority in the country where
you live, work or believe an infringement occurred.

Lead supervisory authority:
[NAME OF RELEVANT EU DATA PROTECTION AUTHORITY]

Türkiye

Where Turkish data protection law applies, you may have the right to
apply to the data controller and subsequently submit a complaint to the
Turkish Personal Data Protection Authority in accordance with the
applicable procedure and legal time limits.

24. Changes to This Notice

We may update this Notice to reflect:

  • Changes to our business;
  • Changes to the products or services we provide;
  • Changes to the personal data we process;
  • Changes to service providers;
  • Changes to international transfer arrangements;
  • Changes in law or regulatory guidance; or
  • Changes to our security or privacy practices.

The updated version will be published on this page with a revised
“Last updated” date.

Where a change materially affects how personal data is used, we may
provide an additional notice by email, website notification or another
appropriate method.

25. Contact Us

For questions about this Notice or the processing of personal data,
contact:

Inkwallart Privacy Team

[COMPANY LEGAL NAME]

[REGISTERED BUSINESS ADDRESS]

Privacy email:

[email protected]

Customer support:

[email protected]

Website:

www.inkwallart.com