KVKK Disclosure Statement
Last updated: 12 August 2026
1. Data Controller
Lunovia Records acts as the data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK"). This statement explains which personal data we process through the platform, on what legal grounds, to whom it is transferred, and what rights you have as a data subject.
| Trade name | To be added after registration. |
|---|---|
| Brand | Lunovia Records |
| MERSİS number | To be added after registration. |
| Tax office / number | To be added after registration. |
| Registered address | To be added after registration. |
| info@lunoviarecords.com | |
| Web | lunoviarecords.com |
| Contact channels | By email to the address above; you can also request a data download or deletion from Settings in the artist dashboard. |
Note: once Lunovia Records completes its company registration, the registered trade name, MERSİS number, tax details and registered address will be entered into the table above. In the meantime, all KVKK requests are handled through the email address above.
2. Personal Data We Process
What we process depends on your relationship with the platform:
- Demo submitters (no account required): name/artist name, email address, social media link, description text and the audio file you submit.
- Visitors and listeners (no account required): data is collected in two cases — (a) if you complete a release's pre-save form: your email address and the listening platform you select; (b) if you use the contact form: name, email address, subject, message content, the optional fields tied to the category you choose (organisation/company name, website, etc.), your interface language at the time of submission, and — to prevent abuse — your IP address and browser information (user agent). No other data is collected in these two flows.
- Newsletter/announcement list: Lunovia may maintain a list of names and email addresses for announcements. This list is not populated automatically by any form on the website; it is imported in bulk by an administrator only. To be removed from it, use the contact channel below.
- Artist account holders: the above plus password (stored irreversibly), phone, address/city/country, biography, profile photo, social media links, genre preferences.
- Identity data: full name only. Turkish national ID and passport numbers are NOT collected; this field has been removed from the platform and previously entered records have been deleted. The contracting party is identified by full name and billing/payment address. ⚠️ Completing these fields is mandatory in order to complete an artist profile and to submit a release; they are collected to identify the contracting party and to meet financial and legal obligations.
- Financial data: bank/IBAN details, account holder name, bank name, invoicing details. Required only at the royalty payment and payout request stage, and entering them is the user's own choice.
- Contract data: the signatory's name, the hand-drawn signature image, signature date, the IP address at the time of signing and browser details. ⚠️ The contract document itself contains the data subject's full name, identification number, phone, address, email and bank details within its text; where the document is stored in multiple languages, those details appear in every language version.
- Work and release data: audio recordings (WAV/MP3), cover artwork, lyrics, contributor details (songwriter, producer, performer), ISRC/UPC codes.
- Security data: IP address (in action and security logs), session details, active device/session list, two-factor authentication records.
- Communication history: in-platform messages and notifications sent to you.
- Optional connections: Discord username and avatar (only if you connect your account yourself), Spotify artist link.
We do not collect special categories of personal data. We never ask for health, religious, political or biometric information; we recommend you do not include such details in your free-text profile fields either.
About demos and musical works: musical works and demo content submitted through the Platform may be processed for the purposes of review and of carrying out the related service processes. This content is reviewed only by authorised team members, is not published on any public page, and is not shared with third parties for any purpose other than the review. To the extent that a recording contains an artist's voice it may itself constitute personal data, and is therefore subject to the same security and retention rules as other personal data. For submission rules see the Demo Submission Terms.
3. Purposes and Legal Grounds
Your personal data is processed for the following purposes:
- Operating the Platform's services — running the website, mobile applications and digital tools; account creation and session management.
- Managing artist processes — profile and discography management, contract processes, royalty calculation and payment, handling payout requests.
- Demo review — reviewing submitted works, notifying you of the outcome, and starting the contract process where a work is accepted.
- Content operations — preparing distribution metadata, allocating ISRC/UPC codes, delivering approved works to digital platforms, processing artwork and audio files.
- User support processes — in-platform messaging, responding to support requests, notification and information emails.
- Meeting legal obligations — identity verification, tax and accounting records, copyright legislation, responding to requests from competent authorities.
- Platform security and development — detecting unauthorised access and abuse, debugging, measuring service quality.
Under Article 5 of the KVKK, each processing activity rests on its own legal ground; a single ground is not applied to every activity. The grounds per activity:
| Activity | Data processed | Legal ground (KVKK Art. 5) |
|---|---|---|
| Account creation and session management | name/artist name, email, password (stored irreversibly), session records | Conclusion and performance of a contract (Art. 5/2-c) |
| Artist profile (biography, photo, social links, genre preferences) | profile data | Explicit consent (Art. 5/1) — these fields are not mandatory; filling them in is entirely your choice |
| Identification of the contracting party (full name, address, postal code) | account data | Legal obligation (Art. 5/2-ç) + performance of a contract (Art. 5/2-c) |
| Demo submission and review | name, email, country/city, social link, audio recording | Fulfilling your request prior to entering into a contract (Art. 5/2-c) + legitimate interest (Art. 5/2-f) |
| Content and release operations (metadata, ISRC/UPC, delivery to distribution) | work data, artist name, credits | Performance of a contract (Art. 5/2-c) |
| Contract processes and electronic signature | identity, signature image, signature date, IP address, browser details | Performance of a contract (Art. 5/2-c) + legitimate interest for evidentiary purposes (Art. 5/2-f) |
| Royalty payment and accounting | bank/IBAN, account holder name, invoicing details, earnings records | Performance of a contract (Art. 5/2-c) + legal obligation under financial legislation (Art. 5/2-ç) |
| Support and in-platform communication | message contents, notification records | Performance of a contract (Art. 5/2-c) |
| Security and action logs | IP address, session and administrative action records | Legitimate interest (Art. 5/2-f) + legal obligation (Art. 5/2-ç) |
| Promotional communication and optional notifications | email address, notification preferences | Explicit consent (Art. 5/1) — taken separately; not required for the account to work |
| Connecting a Discord account | Discord user ID, username, avatar | Explicit consent (Art. 5/1) — entirely optional |
Where processing relies on consent, you may withdraw it at any time; the related feature is then switched off and the core operation of your account is unaffected. For activities that do not rely on consent, your right to object remains (see section 9).
4. Recipients of Your Data
Your personal data is not transferred to anyone other than the parties below, and is never sold:
- Distribution service providers and digital music platforms: only after a release has been approved and sent to distribution, and only the data required for that release (artist name, work details, audio, artwork, contributors). The distribution channels we work with may change over time; which channel is used is determined per release.
- Hosting and infrastructure provider: our servers are located in Türkiye.
- Email (SMTP) infrastructure: for the notification emails we send you.
- Collecting societies (MÜYAP, MSG, MESAM): only to the extent a registration is filed for a work, and limited to the work/rights-holder details required for that filing.
- Accountant: for payment and tax records.
- Competent public authorities: upon a court order or statutory request.
No payment service provider is used. Royalty payments are made by us via bank transfer; your bank details are not transferred to a payment institution or any third-party payment infrastructure.
5. Cross-Border Transfers
Because some technical components of the platform run through providers established abroad, a limited amount of data is transferred outside Türkiye. For transparency, the complete list:
A) Providers your browser sends requests to directly. In these requests your IP address, browser details and the address of the page you are on reach the provider concerned. No profile is built and no cookie is set this way.
- Cloudflare (cdnjs) — icon font: the icons in the interface are loaded from this network. ⚠️ This request is made on the Platform's pages, including the page on which this document is displayed.
- jsDelivr — chart and QR components: on dashboard screens only.
- Spotify image server: only where an artist profile photo originates from Spotify, in order to display that image.
- Discord image server: only if you have connected your Discord account, in order to display your avatar. The request URL contains your Discord user ID.
- Fonts: font files are served from our own server, so loading fonts involves no transfer abroad.
B) Providers to which data is sent through our server. In these requests your IP address does not reach the provider; only the content stated below is transmitted.
- Discord (team notification): ⚠️ When a demo is submitted, the artist/project name, email address, the country and city given and the social media link are sent to this notification channel. For other event notifications, the personal data transmitted is kept to a minimum.
- AI drafting provider: used only in the admin panel when drafting a press release. The text transmitted may include the artist name, work title, genre and release date. Contact details, identity data, address and bank details are not transmitted.
- Translation service: used only to translate contract templates. Personal data fields (name, identification number, address, phone, bank details) are masked before being sent to the translation service and restored locally afterwards; therefore no personal data is transmitted to the translation service.
- Spotify Web API: queried only via the public Spotify artist link you provide, in order to refresh the profile photo. The only information transmitted is the publicly available Spotify artist ID.
- Distribution services and digital music platforms: when a work is sent to distribution, the recording, artwork and metadata (artist name, credits, ISRC/UPC) are transferred abroad so that the release can be distributed worldwide.
Service types not used: no advertising network, third-party analytics/tracking service, error-tracking service or payment service provider is used. Should such a service be added, this statement will be updated and, where required, your consent will be obtained separately.
These transfers are carried out under Article 9 of the KVKK, limited to what is necessary to perform the contract and provide the service. The legal mechanisms relied on for these transfers are reviewed in line with developments in legislation.
6. Retention Periods
| Data type | Retention period |
|---|---|
| Account data (name, email, profile, preferences) | For as long as the account is active; after a deletion request, data not subject to a statutory retention obligation is deleted. |
| Demo data (audio file, submission details) | For the review process and the period needed for it. Submissions that are not accepted are deleted within a reasonable period after the review is complete. |
| Released work data (master, metadata, ISRC/UPC) | For as long as the release remains live and for the period set out in the contract. |
| Identity verification data (national ID / passport) | No longer stored. This data is no longer collected; previously entered records have been deleted. |
| Legal and financial records (invoices, payments, earnings statements, contracts, signature records) | For the periods set out in legislation (10 years for tax purposes); for contracts, plus the applicable limitation periods. |
| Security and action logs (sessions, login attempts, admin action logs — these include IP addresses) | Retained for the period prescribed by legislation and necessary for that purpose, in order to maintain security, prevent abuse and preserve evidence. |
| Pre-save registrations (email address, platform preference) | 30 days after the release is published; the record is then deleted automatically. If the release is not out yet the record is kept — otherwise the notification you were promised could not be sent. You may request earlier deletion at any time. |
| Contact form submissions (name, email, message, IP address, browser information) | 90 days; the submission is then deleted automatically. Correspondence that turns into a commercial or legal relationship (contract, support request) is kept in its own records under its own retention period. |
| Share-link traffic | Retained for statistics; the raw IP address is not stored, only a digest that changes daily. |
| Backups | Regular backups are taken for service continuity and a fixed number of backups is kept on rotation. Deleting a record does not mean it disappears from existing backups immediately; backups are renewed within their own rotation period. |
If you want your account deleted, you can use the deletion request flow in your account settings. Your request is recorded and reviewed, and you will be informed of the outcome. You may also send your request directly to info@lunoviarecords.com.
Records we are legally required to keep (in particular financial records, contracts and signature records) are retained with restricted access until that obligation expires.
7. Data Security
As data controller, we apply technical and organisational measures proportionate to the nature of the personal data and the risks that processing may give rise to. These measures are reviewed and updated in line with technological developments and the risks encountered.
- Passwords are stored irreversibly; no member of staff can see your password.
- All traffic to the Platform is served over an encrypted connection.
- Session information is protected against being read by the browser, and sessions expire on their own after a reasonable period.
- Secrets relating to two-factor authentication are stored encrypted.
- Uploaded files are stored so as to be protected against unauthorised access; audio recordings are reachable only through time-limited, authorised links.
- Access to the administrative interface is separated into authorisation levels according to each staff member's role; not every staff member can access every piece of data.
- Access-restriction measures are applied against unauthorised access attempts.
The technical implementation details of these security measures are not published, in order to prevent that information from being misused. Where a data subject applies or a competent authority requests it, the necessary information is provided directly to that party.
8. Cookies
The platform uses strictly necessary first-party cookies only: session management, "remember me", language preference, preventing repeated form submissions, and showing the cookie notice once. No advertising or tracking cookies are used.
The name, purpose, lifetime and technical properties of every cookie are listed in a table on a separate page: Cookie Policy.
9. Your Rights as a Data Subject
Under Article 11 of the KVKK you have the right to:
- Learn whether your personal data is being processed,
- Request information about it if it is,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties, in Türkiye or abroad, to whom the data is transferred,
- Request correction of incomplete or inaccurate data,
- Request erasure or destruction of the data,
- Request that corrections/erasures be notified to third parties the data was transferred to,
- Object to outcomes against you produced solely by automated analysis,
- Claim compensation if you suffer damage due to unlawful processing.
Send your requests to info@lunoviarecords.com. We respond within 30 days at the latest. You can also download a copy of your data yourself and raise a deletion request from your account settings. If you are not satisfied with the outcome, you may lodge a complaint with the Turkish Personal Data Protection Authority.
10. Changes
This statement may be updated in line with changes to legislation or to how the platform works. The current version is always published on this page; on each material revision the version number, effective date and last updated date shown at the top of the page are updated together. Registered users are notified separately in the event of a material change.
This is a disclosure statement, not a declaration of explicit consent. No consent is collected on this page, and viewing it does not mean you have consented to any processing. Where processing requires explicit consent (those marked "explicit consent" in section 3 above), consent is obtained separately and independently on the screen of the feature concerned; if it is not given, only that feature is unavailable.