KVKK Notice (Personal Data Protection)

Last Updated: May 2026

This notice is provided in English for convenience. The Turkish-language version is the controlling text under Law No. 6698 (KVKK).

1. Introduction & Purpose

This Personal Data Processing Notice (the "Notice") has been prepared under Law No. 6698 on the Protection of Personal Data ("KVKK") and related regulations. It explains how personal data obtained through the milsiz platform (the "Platform"), operated by milsiz LLC, is processed, stored, transferred, and protected.

This Notice covers users, artists, venues, curators, buyers, visitors, and other relevant persons who use the Platform via the milsiz website (milsiz.art), the application (app.milsiz.art), or any other digital channel.

milsiz processes personal data in accordance with law, fairness, and the principle of data minimisation, and applies necessary administrative and technical measures to safeguard data security.

2. Data Controller & Contact

Your personal data is processed by milsiz LLC as the Data Controller.

Data Controller (Platform Operator):
milsiz LLC
63 North Burritt Avenue, Room 100 East PMB1270, Buffalo, WY 82834, United States
[email protected]

Any request relating to your personal data under Article 11 of KVKK may be submitted to milsiz LLC at the contact email above.

3. Categories of Personal Data Processed

The following categories of personal data may be processed:

a. Identity Data

First name, last name, username, artist/venue name, profile name, date of birth (optional).

b. Contact Data

Email address, phone number, residential and shipping addresses, social-media links.

c. Financial Data

Bank account / IBAN information processed via Stripe (buyer-side) and a licensed payout infrastructure provider (seller-side payouts), transaction history, invoice data, payout records. Full payment-card information is not stored by milsiz.

d. Visual & Audio Data

Profile photo, cover image, images and videos of uploaded artworks, exhibition photos.

e. Artist / Venue / Curator Profile Data

Biography, exhibition history, art movement, technique, descriptions, artwork descriptions, portfolio and listing content.

f. Transaction Security Data

g. Cookie & Analytics Data

User-behaviour data collected via mandatory, performance, analytics, and targeting cookies.

h. Marketing & Communication Preferences

Email subscription preferences, campaign participation data, user interaction data.

4. Processing Purposes

Personal data is processed for the following purposes:

a. Provision of Services & Performance of Contractual Obligations

Creating user accounts, account verification, and access management.
Creating Artist / Venue / Curator profiles and managing uploads, portfolios, and listings.
Operating Platform interactions (likes, comments, follows, subscriptions, collections, etc.).
Operating the payment infrastructure (Stripe for buyer side; a licensed payout infrastructure provider for seller payouts) and routing artist/venue payouts.
Concluding, performing, and terminating user contracts, sale contracts, and artist–venue collaboration agreements.

b. Operational & Security Purposes

Maintaining the security of the Platform and user accounts.
Keeping system access logs and preventing potential misuse or unlawful activity.
Fulfilling obligations arising from KVKK and other applicable legislation.
Internal audits, log management, and risk analyses.

c. Marketing, Analytics & Product Development

Providing campaigns, announcements, and notifications to users.
Analysing user behaviour to improve the Platform experience.
Conducting statistical work to plan new features and products.

d. Communication & Support

Receiving and resolving user requests, complaints, and support enquiries.
Notifying users about account security, access issues, or payment status.

5. Methods of Collection & Legal Bases

Personal data is collected by milsiz through various digital channels via automatic, partially automatic, or manual methods.

Information provided directly by users during account registration and profile creation.
Artwork uploads, portfolio content, and exhibition information entered into the Platform by artists or venues.
Data processed via Stripe (buyer-side) and a licensed payout infrastructure provider (seller-side payouts) during payment flows. Full card data is processed by Stripe; milsiz only retains transaction outcome and invoice metadata.
Logs, IP, device, and analytics data collected automatically during use of the Platform.
Information shared directly via support, contact, or complaint channels.
Usage data collected via cookies and similar tracking technologies.

Legal Bases:

KVKK Art. 5/2(c): Necessary for the establishment or performance of a contract.
KVKK Art. 5/2(ç): Necessary for compliance with the controller's legal obligations.
KVKK Art. 5/2(f): Necessary for the controller's legitimate interests, provided that fundamental rights and freedoms of the data subject are not harmed.
KVKK Art. 5/1: Explicit consent (in particular for marketing, analytics, and cross-border data transfers).

6. Domestic & Cross-Border Transfers

Personal data may be transferred to service providers in Türkiye or abroad for service provision, security, legal compliance, and technical operations, with appropriate safeguards.

a. Domestic Transfers

Data may be transferred to business partners, accounting, legal, and consulting providers, and infrastructure support providers established in Türkiye, only for legal compliance, contract performance, and technical support.

b. Cross-Border Transfers

milsiz's infrastructure is hosted in the European Union (Germany / Frankfurt), and certain service providers are based in the European Union or the United States. Cross-border transfers may occur to:

milsiz LLC (USA): As main operator of the Platform, conducting technical oversight and operations.
Payment Infrastructure Provider — Stripe (USA and EU): Buyer-side payment collection and invoicing.
Payout Infrastructure Provider (licensed international remitter): Seller-side payout processing.
Hosting and storage providers (EU-based): Platform server and database hosting, secure storage of artwork images and user data.

Cross-border transfers are made only where the data subject has given explicit consent under KVKK Art. 9 or where transfer to countries of adequate protection (declared by the Authority) is satisfied. Transfers are protected by TLS/SSL; data is shared only as needed for the processing purpose; data is never sold for commercial purposes.

7. Retention Periods

Personal data is retained only for as long as necessary for the processing purpose and for any mandatory retention period required by law.

User registration data: 2 years after account closure to address potential disputes or claims.
Payment and invoicing data: 10 years per the Tax Procedure Law and the Turkish Commercial Code.
Artist / Venue profile, artwork images, and biography data: while the account is active; permanently deleted upon deletion request.
Communication and support data: 3 years from resolution of the request.
Log records, IP, and access data: 2 years per Law No. 5651.
Marketing and communication preferences: until the user withdraws consent; deleted or anonymised immediately upon withdrawal.

Once the retention period ends or the processing purpose is fulfilled, data is securely deleted, destroyed, or anonymised in accordance with milsiz's Data Retention and Destruction Policy. These operations are reviewed at least every six (6) months.

8. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of KVKK, every individual whose personal data is processed has the right to:

Learn whether their personal data is being processed.
Request information about the processing if it is taking place.
Learn the purpose of processing and whether the data is used in line with that purpose.
Know the third parties to whom data is transferred domestically or abroad.
Request correction of incomplete or incorrectly processed data.
Request deletion or destruction of personal data when the reasons for processing have ceased.
Request that correction and deletion are notified to third parties to whom the data was transferred.
Object to a result that adversely affects the data subject when produced solely by automated processing.
Claim compensation for damages caused by unlawful processing.

9. How to Apply & Lodge Complaints

To exercise your rights, apply to milsiz LLC via:

a. Written Application

A wet-signed petition delivered in person or via notary to: milsiz LLC, 63 North Burritt Avenue, Room 100 East PMB1270, Buffalo, WY 82834, United States.

b. Electronic Application

Send via your registered email to [email protected]. Applications signed with secure electronic signature or mobile signature are preferred.

c. Required Application Information

Name, surname, and signature (for written applications).
Turkish ID number (TC Kimlik) for citizens; passport or ID number for foreigners.
Address for notification.
Email, phone, and fax number (if any).
Subject of the request and supporting information/documents.

d. Review of Applications

Applications are concluded within thirty (30) days at the latest, free of charge. If the request requires additional cost, the fee may be charged according to the tariff set by the Personal Data Protection Authority. If the application is rejected or the response is unsatisfactory, the data subject may complain to the Authority within thirty (30) days of receipt of the response or sixty (60) days of the application date.

10. Cookies & Tracking Technologies

milsiz uses cookies and similar tracking technologies to improve user experience, secure service delivery, measure performance, and remember preferences.

Mandatory cookies: Required for core Platform functionality.
Performance and analytics cookies: Used to analyse usage data.
Functional cookies: Remember preferences such as language and session state.
Targeting and marketing cookies: Activated only with explicit consent.

You can partially or fully disable cookies via browser settings; certain Platform features may not work properly if cookies are disabled.

11. Changes & Updates

milsiz may update this Notice from time to time in line with legislative changes, technical requirements, or service updates. The updated Notice takes effect on the date it is published at milsiz.art. Users are advised to review this Notice periodically.

Effective Date

This Notice is effective from the date of publication.