DATA PRIVACY
Data Protection & Privacy Policy
Last updated: 07.09.2026
This Data Protection & Privacy Policy describes how mert coskun ("we", "us", "our") collects, processes, stores, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Belgian data protection laws.
By submitting our contact form, contacting us, or receiving a tattoo service, you acknowledge that you have read, understood, and accepted this policy in full.
1. Data Controller
- mert coskun Location: Brussels, Belgium Email: info@mertcoart.com Website: www.mertcoart.com
2. Scope of Application
This policy applies to all personal data processed through:
- Our website
- Our contact form
- Email communication
I- nstagram Direct Messages (DMs)
- Tattoo consultations and sessions
- Photo and video documentation of tattoo artwork
3. Categories of Personal Data Processed
3.1 Identity & Contact Data
Collected primarily through our contact form, email, or Instagram DM:
- First and last name
- Phone number
- Email address
- Details of your tattoo request or inquiry, as submitted through the contact form
- City / country, where shared
- Social media username (e.g. Instagram), where communication takes place via Instagram DM
3.2 Tattoo & Appointment Information
- Tattoo ideas, design references, size, placement, and style
- Meaning or symbolism of the tattoo
- Personal stories or background information voluntarily shared
- Appointment date and scheduling details
3.3 Visual Data
- Photographs and videos of completed tattoo work
- Photos or videos taken during or after tattoo sessions
3.4 Technical Data
- IP address
- Browser type and device information
- Website usage data (cookies and analytics)
4. Special Categories of Personal Data
Some information voluntarily shared by clients (e.g. emotional experiences, personal history, cultural or symbolic meanings) may qualify as sensitive data under GDPR.
Such data is:
- Provided voluntarily by the data subject
- Processed only for artistic interpretation and communication
- Never mandatory to receive a tattoo service
Medical or health-related data is not collected, unless explicitly required by law.
5. Purposes of Processing
Personal data is processed for the following purposes:
- Managing tattoo inquiries and appointments received via the contact form, email, or Instagram DM
- Communication with clients
- Artistic design and preparation
- Documentation and presentation of tattoo artwork
- Portfolio, website, and social media content
- Legal, accounting, and administrative obligations
- Security and prevention of misuse
6. Legal Basis for Processing (Article 6 GDPR)
Processing is based on one or more of the following legal grounds:
- Performance of a contract (tattoo service agreement)
- Legitimate interests (artistic documentation, portfolio presentation)
- Consent, where applicable
- Legal obligations under Belgian law
7. Photo & Video Documentation of Tattoo Artwork (Legitimate Interest & Artistic Expression)
Tattooing is a visual art form. The documentation of completed tattoo work through photography and video constitutes a legitimate artistic and professional interest under Article 6(1)(f) GDPR.
By contacting us or receiving a tattoo service from mert coskun, clients acknowledge that photographs and/or videos of the tattooed artwork may be taken and used without a separate signed release.
Permitted uses include:
- Artist portfolio
- Official website and online gallery
- Social media platforms (e.g. Instagram, TikTok, Facebook)
- Promotional, editorial, educational, or artistic purposes
Visual content is intended to focus on the tattoo artwork itself. Identifying information (such as full names or contact details) is not disclosed by default.
Where a client requests to be tagged, mentioned by first name in a caption, or added as a collaborator on a social media post (e.g. Instagram's Collab feature), this is done only at the client's own request or with their agreement, and is treated as the client's own choice to be publicly associated with the post rather than a disclosure made on our part.
Clients who object to photography or public display of their tattoo work must inform the artist prior to booking or before the tattoo session begins. Where reasonably possible, such objections will be respected.
All visual content remains the intellectual property of mert coskun. No financial compensation is owed.
8. Communication via Instagram Direct Messages (DMs)
Communication via Instagram DMs is voluntary and takes place on a third-party platform subject to Instagram's own privacy policy.
Personal data shared via Instagram DMs:
- Is provided at the user's discretion
- Is used solely for communication, appointment handling, and tattoo-related discussion
Users are advised not to share sensitive or medical information via social media platforms. By contacting us via Instagram DM, users acknowledge the inherent privacy and security risks of third-party messaging services.
9. Data Sharing & Processors
Personal data is not sold or commercially shared.
Data may be processed by trusted third parties acting as data processors, such as:
- Website hosting provider (Wix)
- Payment processing providers, for deposit payments
- Booking or scheduling tools (e.g. calendar software)
- Email and communication services
- Accounting or legal professionals, where legally required
All processors are contractually bound to comply with GDPR.
This also includes Google Ireland Limited, which processes website analytics data (Google Analytics) on our behalf, contractually bound to comply with GDPR.
10. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA) — for example, through our website hosting, payment, or communication providers — appropriate safeguards are applied, including GDPR-compliant service providers and standard contractual clauses.
11. Data Retention
Personal data is retained only for as long as necessary, and in accordance with the following defaults:
- Financial and administrative records (invoices, deposit payment records): retained for the period required under applicable Belgian accounting and tax law.
- Contact form inquiries that do not result in a confirmed appointment: retained for up to 12 months, then deleted or anonymized, unless the client re-initiates contact.
- Contact and appointment records tied to a confirmed tattoo service: retained for the duration of the professional relationship (including any retouch follow-up) and thereafter for the accounting retention period stated above.
- Photographic and video documentation of completed tattoo work: retained indefinitely as part of the artist's professional portfolio and artistic archive, unless the client has objected under Section 7.
- Data subjects may request deletion of personal data that is not subject to a legal retention requirement.
12. Data Subject Rights (Articles 12–22 GDPR)
You have the right to:
- Access your personal data
- Request rectification or erasure
- Restrict or object to processing
- Withdraw consent where applicable
- Data portability
Requests can be submitted via email to info@mertcoart.com.
As a sole practitioner, mert coskun is not required to appoint a Data Protection Officer under Article 37 GDPR, since this business does not carry out large-scale systematic monitoring or large-scale processing of special category data. All data protection requests should be addressed directly using the contact details above.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD): www.gegevensbeschermingsautoriteit.be
13. Cookies & Analytics
Our website is built on the Wix platform. Certain cookies are set automatically by Wix for essential website functionality (such as site security and load balancing) and, where enabled, for analytics purposes. You can manage cookie preferences via your browser settings, and further details are available in Wix's own cookie policy.
This site uses two categories of cookies. Essential cookies are required for the website to function properly (for example, remembering your cookie consent choice) and are set automatically by Wix; these cannot be disabled. Analytics cookies, such as those from Google Analytics described below, are optional and are only set once you provide your consent.
This website uses Google Analytics (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors interact with the site, such as pages visited, session duration and traffic source. Google Analytics uses cookies and similar technologies for this purpose. The data collected is limited to technical and usage information (for example an anonymized IP address, device and browser type, pages viewed and referring website) and does not include your name, email address or other directly identifying information. This data is only collected after you have given your consent through the cookie consent banner. Data is retained as follows: event data (individual interactions, such as page views) for 2 months, and user-level identifiers for up to 14 months. This data may be transferred to Google's servers, which may be located outside the European Economic Area, including the United States; where this occurs, Google relies on the European Commission's Standard Contractual Clauses as a safeguard. You can withdraw your consent at any time through the cookie consent banner.
You can review or change your cookie preferences at any time by clicking the cookie icon in the corner of the page.
For more general information about how cookies work, see allaboutcookies.org.
14. Data Security
Appropriate technical and organizational measures are implemented to protect personal data, including:
- Secure hosting environments
- Limited access to personal data
- Password-protected systems
Despite all measures, absolute security cannot be guaranteed.
15. Age Requirement
Tattoo services are provided only to individuals 18 years of age or older, in accordance with Belgian law. If we become aware that personal data has been submitted by or on behalf of a person under 18, that data will be deleted without delay, and no service will be provided.
16. Data Breach Notification
In the event of a personal data breach that poses a risk to data subjects, notification will be made to the Belgian Data Protection Authority and affected individuals as required by GDPR.
17. Policy Updates
This policy may be updated periodically. The latest version will always be available on our website.
18. Contact
For privacy-related questions or requests: Email: info@mertcoart.com