Last updated 18 August 2026
This site sets no cookies. It shows no advertising, builds no profile of you and carries no social or marketing pixels. Every file that makes up the page — the fonts included — comes from our own server. One thing sits outside that: the site is delivered through Cloudflare, which also counts visits for us without a cookie and without recording anyone individually. Section 3 says exactly what that means and how to tell us to stop. The only thing ever written to your device is a note of a choice you made yourself, named in section 2. We hold personal data beyond that only if you write to us, and then only to answer you.
1. Who is responsible
YUNART, trading as Kilim Collection, is the controller of the data described here.
Fırat Apartmanı, Binbirdirek, Klodfarer Cd. No:10 D:1, 34122 Fatih / İstanbul, Türkiye
[email protected]
+90 (212) 517 37 14
2. What the website itself collects
Our hosting provider keeps standard server logs: the IP address the request came from, the date and time, the file requested, the referring page and the browser's user agent string. A web server writes these automatically and we cannot switch them off.
- Purpose: keeping the site online and defending it against abuse.
- Legal basis: legitimate interest, Article 6(1)(f) GDPR.
- Retention: 30 days, after which the provider deletes or anonymises them.
Beyond those logs and the measurement described in section 3: no cookies, no fingerprinting, no A/B testing, no heat maps, no advertising or remarketing tags and no social pixels.
One thing is stored on your device, and it is ours rather than anyone else's. When we are showing an announcement — a fair we are exhibiting at, say — and you close it, your browser keeps a note under the key kc-promo in local storage. It records which announcement it was and the day you dismissed it, so the same notice does not meet you on every visit. It says nothing about who you are, it is never transmitted to us or to anyone else, no server can read it, and clearing your browsing data removes it.
Nothing on the page embeds a video or a map that calls another server on its own. The atelier film is hosted by us. If an announcement carries a film from YouTube, what you see first is a still image of ours with a play button on it; YouTube is contacted only if you press play, and that is your decision to make. The address in the footer is a plain link, so nothing is requested from Google unless you choose to click it.
3. Cloudflare, and how we count visits
The site is served through Cloudflare, a content delivery network. Every request for this page passes through their machines before it reaches ours, which is what makes the site quick outside Türkiye and what absorbs attacks on it. In doing so Cloudflare sees your IP address, the file you asked for and your browser's user agent, in the same way our own server does. Cloudflare acts as our processor.
The same service also counts visits for us, and we want to be exact about what that is and is not. It sets no cookie. It writes nothing to your device. It cannot recognise you when you come back, and it cannot follow you to any other site. What reaches us is a tally: how many times the page was opened, which site sent the reader, and a country, browser and device type — never a name, never an individual visitor, never a profile. We could not single you out from it if we tried.
- Purpose: knowing whether the site is read at all, and from where, so we know whether it is worth keeping.
- Legal basis: legitimate interest, Article 6(1)(f) GDPR — and Article 5(2)(f) KVKK. We rely on this rather than asking for consent because nothing is stored on or read from your device, which is the thing consent exists to govern, and because a count that cannot identify anyone weighs very lightly against knowing whether our own site works.
- Retention: Cloudflare holds the aggregated figures for six months. We receive no raw record and keep none ourselves.
You have the right to object to this under Article 21 GDPR, and you do not have to give a reason. Write to [email protected] and we will exclude you. Blocking the domain static.cloudflareinsights.com in your browser, or any tracker blocker, stops the count from your side immediately and breaks nothing on the page.
4. When you contact us
If you email, telephone, message us on WhatsApp or write through Etsy or Instagram, we receive what you send: your name, your email address or number, your company if you have one, and the content of your message.
- Purpose: answering you, preparing a quotation, and where it becomes an order, fulfilling it.
- Legal basis: steps taken at your request before a contract, Article 6(1)(b), or our legitimate interest in replying to a business enquiry, Article 6(1)(f).
- Retention: correspondence that leads nowhere is deleted within three years. Correspondence tied to an order is kept for as long as Turkish commercial and tax law requires.
If you reach us through WhatsApp, Instagram or Etsy, that platform has already processed your data under its own terms before the message arrives with us, and we have no control over that part. Email and the telephone are the most private routes.
5. What we never do
We do not sell, rent or trade personal data. We do not build advertising profiles. We do not add you to a mailing list because you wrote to us once. We do not use anything you send us to train software.
6. Who else can see it
Our web host, which runs the server and therefore holds the logs; Cloudflare, which delivers the site and, if you allowed it, counts the visit; and our email provider, which carries our mail. All three act as processors on our instructions. Where there is a shipment, the carrier and the customs authority receive the delivery details they need. No one else.
7. Where the data sits
We are in Türkiye and the data you send us stays here. Cloudflare is the exception: it is a global network, so the request that fetches this page is handled by whichever of their locations is nearest you, and the traffic is covered by their standard contractual clauses. Nothing you type ever passes through it, because the site has no forms — writing to us is an ordinary email from your own mail program to ours.
As for the rest: For visitors in the European Economic Area and the United Kingdom that is a transfer to a third country. It happens because you have chosen to contact a Turkish workshop directly, and it is limited to what is necessary to answer you and to carry out the contract, which is the derogation in Article 49(1)(b) GDPR. We transfer data nowhere else.
8. Your rights
Wherever you are, you can ask us what we hold about you, have it corrected, have it deleted, restrict what we do with it, receive it in a portable form, or object to us holding it at all. Write to [email protected] and we will answer within thirty days. There is no charge.
If you are in the EEA or the UK you may also complain to your national data protection authority. If you are in Türkiye you apply to us first, then to the Kişisel Verileri Koruma Kurumu.
9. Under Turkish law
The same applies under Law No. 6698 on the Protection of Personal Data. YUNART is the veri sorumlusu. Data is collected by electronic means for the purposes set out above, and your rights under Article 11 are the ones listed in section 7.
10. Children
This site is not aimed at children and we do not knowingly collect data from anyone under 16.
11. Changes
If this notice changes we update the date at the top. The current text is always the whole text.