Draft notice · 15 September 2026. The contact form is open for enquiries. Contracts are available only through private signature links shared with clients. The international transfer arrangement is still under review. Questions: info@siralstudio.com.
Contact
For personal data questions about the Siral Studio website and services, contact info@siralstudio.com.
Data we process and why
For enquiries and date availability, we process your name, phone number, email, occasion, date, city or venue and message to respond and plan the service. Client records include shoot details, packages and fees, payments and expenses, contract text, electronic acceptance choices and the signature drawn on screen. Private galleries include photo/video files, shared favourites, the visitor’s self-reported name, optional email, and the file and time of access and download requests. A visitor’s name is not verified identity. Contact and gallery login forms do not ask for identity or payment card numbers. While preparing a contract, the studio may enter a client’s Turkish identity number in an optional field where needed for the transaction. It appears only in that private contract and signed PDF. The review form records your names, service date, review and publication consent. Reviews are public only after studio approval. You can withdraw publication consent by contacting info@siralstudio.com. The signature field records the drawing, not biometric identity matching or pressure analysis.
Collection methods and legal grounds
Data is collected electronically through the website form, private contract and gallery links opened by the client, records entered by the studio and communication between the parties. Depending on the activity, processing relies on its direct connection to entering into or performing a contract, compliance with legal obligations for mandatory financial records and official requests, or establishing, exercising or protecting a right in disputes. Necessary security and abuse-prevention records are assessed under legitimate interests, subject to the rights and freedoms of the individual. Processing should remain necessary and proportionate for each activity.
Portfolio and publicity preferences
Use of photographs and videos in portfolios, social media or advertising is selected separately in the contract. Refusing permission does not prevent the service or private gallery access. Consent may be withdrawn where consent is required. A client’s choice does not remove the rights of other adults pictured.
Recipients
Cloudflare provides hosting, databases, private file storage, PDF generation and access security; Google Workspace provides business email. General activity notifications may be sent to the authorised studio owner’s device through Apple, Google or Mozilla notification services after device permission is granted. Cloudflare Turnstile protects the contact form against automated abuse. Necessary service information may be shared with the assigned team and, where legally required, competent authorities.
International transfers
Cloudflare, Google and device notification services may use infrastructure or support processes outside Türkiye. European data residency alone does not satisfy the transfer requirements of Turkish data protection law. An appropriate transfer mechanism must be identified for the service, recipient role and data flow, and any required agreements and notifications completed. At the time of preparing this notice, the applicable transfer mechanism has not been finalised. Applicable safeguards and notification steps under Article 9 of Law No. 6698 remain to be completed for regular client data transfers; general website consent does not replace them.
Retention and deletion
Unless otherwise agreed, gallery links remain open for 30 days from delivery. A longer period promised in the signed contract applies instead. The studio aims to archive final delivery files for six months; this is not a guarantee of indefinite storage. Closing a link does not delete the files at the same moment. Cloud files may be deleted after the local archive has been verified and the studio owner approves. Contracts, payment records and dispute records are retained separately for as long as applicable obligations and the protection of rights require. When a purpose ends, deletion, destruction or anonymisation is assessed against applicable retention duties.
Your rights and requests
Under Article 11 of Law No. 6698, you may ask whether your data is processed and request information, learn the purpose and whether it is used accordingly, learn domestic and international recipients, request correction of incomplete or inaccurate data and, where conditions are met, deletion or destruction and notification of these actions to recipients. You may object to an adverse result based solely on automated analysis and seek compensation for damage caused by unlawful processing. Requests may be submitted using the methods in the Communiqué on the Procedures and Principles of Application to the Data Controller. Contact info@siralstudio.com for submission details; you may use your email address recorded with us. Requests are addressed as soon as possible and within 30 days, depending on their nature. Any identity checks required for a request should be proportionate.