Last updated: 25 September 2026
HarvArt Academy (“HarvArt”, “we”, “us”) runs this website and gives one-to-one music and art lessons in person at our academy in Istanbul, Türkiye, and live online over Zoom. This policy explains what personal data we collect, why we collect it, who we share it with and what rights you have. We process personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller is HarvArt Academy, Istanbul, Türkiye. You can reach us by email at [academy email] or by phone at [academy phone].
2. What data we collect
- Account data: first and last name, email address, phone number, password (stored only in encrypted form) and a profile photo if you choose to add one.
- Booking and lesson data: the lessons you book (course, teacher, date, time, format and status), your lesson credits, lesson notes and homework, messages between you and your teachers, files you or your teacher upload, and the reviews and ratings you leave.
- Payment records: the amount, date and method of each payment (cash or bank transfer). We do not collect or store card details on this website.
- Contact form: your name, email address, phone number and message.
- Teacher data: for our teachers, their name, email address, Zoom link and the lessons they teach.
- Technical data: IP address, browser and device type, the pages you visit and cookies (see section 7).
If a student is under 18, a parent or legal guardian creates the account and gives us the student’s details, and acts on the student’s behalf under this policy.
3. Why we use your data
- To create and manage your account, schedule your lessons, keep track of your credits and let you and your teacher communicate (needed to provide the service you asked for).
- To send you service emails, such as booking updates, new messages, lesson notes, files and credit updates.
- To answer questions you send us through the contact form, by email or by phone.
- To keep payment and accounting records (required by Turkish tax and commercial law).
- To keep the website secure, prevent misuse and improve our lessons and website (our legitimate interest).
- To send you our newsletter, only if you subscribe. You can unsubscribe at any time.
We do not sell your personal data and we do not use it for advertising profiles.
4. Who we share it with
- Your teacher(s): only what they need to teach you, such as your name, contact details, bookings, messages, notes and files.
- Service providers who run parts of our service for us: website hosting (Hostinger), Zoom for online lessons, email delivery and Google Maps on our contact page. Each of them processes data under its own privacy terms.
- Authorities, when the law requires us to.
Some of these providers may store data on servers outside Türkiye. Where that happens we rely on the safeguards or the explicit consent that KVKK and the GDPR require.
5. Online lessons
Online lessons take place on Zoom. We do not record lessons unless the teacher and the student (or the parent of a student under 18) agree to it in advance.
6. How long we keep your data
- Account, lesson and message data: while your account is active and for up to [2 years] after your last lesson, unless you ask us to delete it earlier.
- Payment records: for as long as Turkish tax and commercial law requires.
- Contact form messages: up to 1 year after we have answered you.
7. Cookies
We use cookies that the website needs to work: to keep you logged in, to run the booking form, to protect forms from misuse and to load pages faster. Google Maps on our contact page may set its own cookies when the map loads. We do not use advertising cookies. You can block or delete cookies in your browser settings, but logging in and booking may then stop working.
8. How we protect your data
The website uses an encrypted (HTTPS) connection, passwords are stored encrypted, and only people who need your data to run the academy can access it. No online system is completely secure, so please use a strong password and keep it private.
9. Your rights
Under KVKK (Article 11) and, where it applies, the GDPR, you can:
- find out whether we process your personal data and get a copy of it;
- learn why we process it and whether it is used for that purpose;
- know who we share it with, in Türkiye or abroad;
- ask us to correct data that is incomplete or wrong;
- ask us to delete your data or close your account;
- object to processing and withdraw your consent at any time;
- claim compensation if you suffer damage from unlawful processing.
To use any of these rights, email us at [academy email]. We will reply within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, if you live in the EU, to your local data protection authority.
10. Changes to this policy
We may update this policy when our service changes. The date at the top of this page shows the latest version.
11. Contact us
HarvArt Academy, Istanbul, Türkiye
Email: [academy email]
Phone: [academy phone]
Or use our contact form.
