The personal data controller is:

BULTİŞAD (the full legal name, legal form, registered address, and contact details are published on the Platform).

The controller determines the purposes and means of processing personal data within the scope of the Platform’s activities.

This Policy applies to:

• visitors to the Platform;

• registered users;

• applicants for participation in competitions and open calls;

• participants, finalists, and artists;

• buyers and collectors participating in auctions;

• partners and counterparties.

The Platform may process the following categories of personal data:

• identification data (first name, last name, pseudonym);

• contact details (email address, phone number);

• professional information (biography, portfolio, artistic profile);

• images of artworks and authors;

• data related to participation in competitions, exhibitions, and auctions;

• technical data (IP address, logs, cookies).

Special categories of personal data are not collected unless expressly required by law or voluntarily provided by the data subject.

Personal data are processed for the following purposes:

• administration of the Platform;

• organization and implementation of competitions, selections, exhibitions, and auctions;

• communication with participants, applicants, and partners;

• performance of contractual and pre-contractual relationships;

• compliance with legal obligations;

• statistical and analytical purposes;

• improving the functionality and security of the Platform.

Personal data are processed on the following legal grounds:

• the explicit consent of the data subject;

• the necessity for the performance of a contract or for taking steps at the request of the data subject;

• a legal obligation of the Controller;

• the legitimate interests of the Controller, insofar as they do not override the rights and freedoms of the data subject.

Personal data are stored for no longer than is necessary to achieve the purposes for which they were collected, unless a longer retention period is required by applicable law.

Personal data may be disclosed to:

• partners and subcontractors involved in the organization of the project;

• auction operators and exhibition institutions;

• public authorities and supervisory bodies, where required by law;

• providers of hosting, IT, and communication services.

All recipients are required to comply with the applicable personal data protection requirements.

Where the transfer of personal data outside the European Union is required, including to the Republic of Turkey, the Controller applies appropriate safeguards in accordance with the GDPR and the applicable national legislation.

Data subjects have the right to:

• access their personal data;

• rectification;

• erasure (“the right to be forgotten”);

• restriction of processing;

• data portability;

• object to processing;

• withdraw consent at any time.

Requests may be submitted via the contact details provided on the Platform.

The Controller applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or unlawful processing.

The Controller reserves the right to update this Policy. All changes are published on the Platform and take effect as of the date of publication.

For questions related to the processing of personal data, users may contact the Controller via the contact details published on the Platform.