Privacy Policy

When you submit the contact form on this website, we collect the following personal data:

• Full name
• Email address
• Inquiry type (general, custom order, wholesale, collaboration, or other)
• Message content
• The pieces you ask about, if you come from a product page or your favorites
• Date and time of your consent
• IP address and browser user-agent (for fraud prevention and audit purposes)

If you create an account, we also store your name and email address (and, if you sign in with Google, basic Google profile details such as your name and profile image). This data is used solely to manage your account and the pieces you save. You can permanently delete your account and all associated data at any time from the “My Account” page.

We do not collect any special category data (sensitive personal data) and we do not use automated profiling or decision-making.

We process your personal data for the following purposes:

• Responding to your inquiry — Legal basis: GDPR Art. 6(1)(b) (performance of a contract or pre-contractual steps) and Art. 6(1)(f) (legitimate interests).
• Maintaining a consent audit trail — Legal basis: GDPR Art. 6(1)(c) (legal obligation) and Art. 7(1) (demonstrating consent).

We will never use your data for unsolicited marketing communications.

Your data is processed only by the following service providers, which we use to run this site and which act as data processors:

• Resend Inc. — email delivery (contact messages, account and newsletter emails).
• Supabase Inc. — database hosting (messages, accounts, favorites, newsletter subscriptions).
• Vercel Inc. — website hosting and cookie-free, aggregated visit statistics (Vercel Web Analytics, Speed Insights).
• Intuition Machines Inc. (hCaptcha) — spam protection on the contact and data request forms.
• Google LLC — authentication, only if you choose “Continue with Google”.

No other third parties receive your personal data. We do not sell, rent, or trade personal information.

Dilan Gürçam Ceramic Studio operates from Turkey. When you submit data through this site, your personal data may be processed in Turkey and in the countries where the providers listed in Section 4 run their servers (EU/EEA and USA).

• Under GDPR (Chapter V, Art. 44-49): transfers outside the EEA rely on Standard Contractual Clauses (SCCs) or equivalent safeguards in our providers' data processing agreements.
• Under KVKK (Madde 9): cross-border transfers are carried out with your explicit consent (captured via the contact, account and newsletter consent checkboxes) or, where applicable, under adequacy decisions of the Turkish Personal Data Protection Authority.

Contact messages and associated consent records are retained for a maximum of 2 (two) years following the completion of the communication. After this period, all personal data is permanently deleted. Account data is kept until you delete your account. You may also request early deletion at any time — see Section 10.

This website uses essential cookies only: session and security (CSRF) cookies for customer accounts and the admin login, short-lived verification cookies during Google sign-in, and your language preference. We also remember in your browser's local storage that you closed the cookie notice and the newsletter window (the notice closes by itself when you scroll or tap), and keep a page counter in session storage, which is cleared when you close the tab, so the newsletter window never appears on your first page. None of these are used for advertising or tracking.

• No Google Analytics; visit statistics come from cookie-free, aggregated Vercel Web Analytics
• No advertising or retargeting pixels
• No third-party marketing cookies

Because we only set essential cookies, no cookie consent banner is legally required. However, we display a brief informational notice on your first visit.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — “right to be forgotten”
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7) — at any time, without affecting prior processing

You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, the CNIL in France).

If you are located in Turkey, the Personal Data Protection Law (KVKK, Law No. 6698) grants you the following rights under Article 11:

• Learn whether your personal data is being processed
• Request information about the processing if it has occurred
• Learn the purpose of processing and whether data is used in accordance with that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request rectification of incomplete or inaccurate data
• Request erasure or destruction of your data under Article 7 of KVKK
• Request that rectification, erasure, or destruction be notified to third parties to whom the data has been transferred
• Object to any outcome against you resulting from automated analysis of your data
• Claim compensation for damage arising from unlawful processing

Legal basis for processing under KVKK: Article 5(2)(c) (legitimate interest in responding to customer inquiries) and Article 5(1) (explicit consent).

You may also lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

To exercise any of the rights listed above — including requesting deletion or a copy of your data — you can:

• Use our self-service Data Request Form
• Email us directly at dilangurcam@gmail.com

We will respond to your request within 30 days. Your request should include enough information to verify your identity.

We may update this policy from time to time to reflect legal, operational, or business changes. The policy version is displayed at the top of this page and is also recorded in our consent audit log (ConsentLog) whenever you submit a form, so you can always identify which version was in force when you consented.

Material changes will be announced on the website. Your continued use of the site after changes constitutes acknowledgement of the updated policy, though new consents will be re-requested where required by GDPR Art. 7 or KVKK Madde 5.