Last updated: 08.10.2026
This Data Protection & Privacy Policy describes how mert coskun ("we", "us", "our") collects, processes, stores, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Belgian data protection laws. By submitting our contact form, contacting us, or receiving a tattoo service, you acknowledge that you have read, understood, and accepted this policy in full.
1. Data Controller
mert coskun
Location: Brussels, Belgium
E-mail: info@mertcoart.com
Website: www.mertcoart.com
2. Scope of Application
This policy applies to all personal data processed through our website, our contact form, email communication, Instagram Direct Messages, tattoo consultations and sessions, and photo and video documentation of tattoo artwork.
3. Categories of Personal Data Processed
Identity & contact data
First and last name, phone number, email address, details of your tattoo request as submitted through the contact form, city or country where shared, and social media username where communication takes place via Instagram DM.
Tattoo & appointment information
Tattoo ideas, design references, size, placement and style, the meaning or symbolism of the tattoo, personal stories or background information voluntarily shared, and the appointment date with scheduling details.
Visual data
Photographs and videos of completed tattoo work, and photos or videos taken during or after tattoo sessions.
Technical data
IP address, browser type and device information, and website usage data (cookies and analytics).
4. Special Categories of Personal Data
Some information voluntarily shared by clients (e.g. emotional experiences, personal history, cultural or symbolic meanings) may qualify as sensitive data under GDPR. Such data is provided voluntarily by the data subject, processed only for artistic interpretation and communication, and never mandatory to receive a tattoo service. Medical or health-related data is not collected, unless explicitly required by law.
5. Purposes of Processing
Managing tattoo inquiries and appointments received via the contact form, email or Instagram DM, communication with clients, artistic design and preparation, documentation and presentation of tattoo artwork, portfolio, website and social media content, legal, accounting and administrative obligations, and security and prevention of misuse.
6. Legal Basis for Processing (Article 6 GDPR)
Performance of a contract (tattoo service agreement), legitimate interests (artistic documentation, portfolio presentation), consent where applicable, and legal obligations under Belgian law.
7. Photo & Video Documentation of Tattoo Artwork
Tattooing is a visual art form. The documentation of completed tattoo work through photography and video constitutes a legitimate artistic and professional interest under Article 6(1)(f) GDPR. By contacting us or receiving a tattoo service from mert coskun, clients acknowledge that photographs and/or videos of the tattooed artwork may be taken and used without a separate signed release.
Permitted uses include the artist portfolio, the official website and online gallery, social media platforms, and promotional, editorial, educational or artistic purposes. Visual content is intended to focus on the tattoo artwork itself. Identifying information (such as full names or contact details) is not disclosed by default. Where a client requests to be tagged, mentioned by first name in a caption, or added as a collaborator on a social media post, this is done only at the client’s own request or with their agreement, and is treated as the client’s own choice to be publicly associated with the post rather than a disclosure made on our part.
Clients who object to photography or public display of their tattoo work must inform the artist prior to booking or before the tattoo session begins. Where reasonably possible, such objections will be respected. All visual content remains the intellectual property of mert coskun. No financial compensation is owed.
8. Communication via Instagram Direct Messages
Communication via Instagram DMs is voluntary and takes place on a third-party platform subject to Instagram’s own privacy policy. Personal data shared via Instagram DMs is provided at the user’s discretion and used solely for communication, appointment handling and tattoo-related discussion.
Users are advised not to share sensitive or medical information via social media platforms. By contacting us via Instagram DM, users acknowledge the inherent privacy and security risks of third-party messaging services.
9. Data Sharing & Processors
Personal data is not sold or commercially shared. Data may be processed by trusted third parties acting as data processors, such as the website hosting provider, payment processing providers for deposit payments, booking or scheduling tools, email and communication services, and accounting or legal professionals where legally required. All processors are contractually bound to comply with GDPR.
This also includes Google Ireland Limited, which processes website analytics data (Google Analytics) on our behalf, contractually bound to comply with GDPR, but only if you accept analytics cookies (see Section 13).
Messages sent through the contact form reach me by e-mail through Resend, an e-mail delivery service. The message contains what you typed in the form together with the IP address it was sent from, which is used only to limit spam and is kept as described in Section 11.
Lines you send and customer logins created through Linea (see Section 18) are stored in a managed database provided by Upstash, hosted in the European Union, which acts as a data processor on our behalf. The details are in the Linea GDPR notice.
10. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), for example through our website hosting, payment, or communication providers, appropriate safeguards are applied, including GDPR-compliant service providers and standard contractual clauses.
11. Data Retention
Personal data is retained only for as long as necessary. Financial and administrative records (invoices, deposit payment records) are retained for the period required under applicable Belgian accounting and tax law. Contact form inquiries that do not result in a confirmed appointment are retained for up to 12 months, then deleted or anonymized, unless the client re-initiates contact. Contact and appointment records tied to a confirmed tattoo service are retained for the duration of the professional relationship, including any retouch follow-up, and thereafter for the accounting retention period stated above. Photographic and video documentation of completed tattoo work is retained indefinitely as part of the artist’s professional portfolio and artistic archive, unless the client has objected under Section 7. Data subjects may request deletion of personal data that is not subject to a legal retention requirement.
12. Data Subject Rights (Articles 12–22 GDPR)
You have the right to access your personal data, to request rectification or erasure, to restrict or object to processing, to withdraw consent where applicable, and to data portability. Requests can be submitted via email to info@mertcoart.com.
As a sole practitioner, mert coskun is not required to appoint a Data Protection Officer under Article 37 GDPR, since this business does not carry out large-scale systematic monitoring or large-scale processing of special category data. All data protection requests should be addressed directly using the contact details above. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD): www.gegevensbeschermingsautoriteit.be
13. Cookies & Analytics
This site sets one essential first-party cookie, “mertcoart-consent”, which stores whether you accepted or declined so that the banner does not appear again. It contains no identifier, cannot be read by any other site, and expires after six months. There are no advertising, remarketing or personalisation cookies, and no third-party media is embedded: the gallery photographs and videos are served from this domain. Analytics cookies, such as those from Google Analytics described below, are optional and are only set once you provide your consent. If you choose “Essential only”, nothing about your visit is measured.
This website uses Google Analytics (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors interact with the site, such as pages visited, session duration and traffic source. Google Analytics uses cookies and similar technologies for this purpose. The data collected is limited to technical and usage information (for example an anonymized IP address, device and browser type, pages viewed and referring website) and does not include your name, email address or other directly identifying information. This data is only collected after you have given your consent through the cookie consent banner. Data is retained as follows: event data (individual interactions, such as page views) for 2 months, and user-level identifiers for up to 14 months. This data may be transferred to Google’s servers, which may be located outside the European Economic Area, including the United States; where this occurs, Google relies on the European Commission’s Standard Contractual Clauses as a safeguard. You can withdraw your consent at any time.
14. Data Security
Appropriate technical and organizational measures are implemented to protect personal data, including secure hosting environments, limited access to personal data, and password-protected systems. Despite all measures, absolute security cannot be guaranteed.
15. Age Requirement
Tattoo services are provided only to individuals 18 years of age or older, in accordance with Belgian law. If we become aware that personal data has been submitted by or on behalf of a person under 18, that data will be deleted without delay, and no service will be provided.
16. Data Breach Notification
In the event of a personal data breach that poses a risk to data subjects, notification will be made to the Belgian Data Protection Authority and affected individuals as required by GDPR.
17. Policy Updates
This policy may be updated periodically. The latest version will always be available on our website.
18. Linea, the tattoo concept generator
Linea is our web tool that turns the places of a journey into a line for a tattoo design. How it handles personal data (what stays on your device, what is sent if you press “Send to mertcoart”, the optional services you can switch on, retention, processors and your rights, including how to withdraw a line you sent) is set out in the Linea GDPR notice. That notice applies first to everything you do in Linea. This policy applies to it for everything the notice does not cover, and the rights and the supervisory authority in Section 12 are the same.
19. Contact
For privacy-related questions or requests: info@mertcoart.com