Data controller and scope
This Privacy Policy applies to the Art Lastik website at https://www.artlastik.com. The website is operated by ARTVİN OTOMOTİV İNŞAAT VE TURİZM SANAYİ TİCARET LİMİTED ŞİRKETİ.
The same company, ARTVİN OTOMOTİV İNŞAAT VE TURİZM SANAYİ TİCARET LİMİTED ŞİRKETİ, is the data controller for the personal data processed through this website.
Its registered office is Gülbahar Mahallesi, Galata Deresi Caddesi No: 51/A, Şişli/İstanbul, Türkiye.
General privacy questions can be sent to [email protected].
YouTube API Services
The optional YouTube section on the Social Media page uses YouTube API Services (YouTube Data API v3). How Google processes data is described in the Google Privacy Policy.
Our server makes only two public list requests: the channel’s uploads playlist identifier for the configured channel ID, and then the six newest videos in that playlist. The only fields retrieved are: the uploads playlist identifier, the video identifier, the video title, and the thumbnail addresses and sizes supplied by YouTube. No other field is requested.
Thumbnails are not stored or copied on Art Lastik servers; your browser loads them directly from YouTube’s image host (i.ytimg.com).
The retrieved public information is cached temporarily on the server only: the channel’s uploads playlist identifier for 86,400 seconds (24 hours) and the video list for 900 seconds (15 minutes). After those periods the information is fetched again. This data is not stored in our database.
This information is used solely to display the videos to site visitors. Apart from the requests made to Google/YouTube themselves, this YouTube-sourced data is not shared with, sold to, or used for advertising by any other party.
No YouTube login credentials, passwords, OAuth access or refresh tokens, or private channel information are requested or stored for this feature. Google Sign-In is not used and no authorization is obtained for any YouTube channel. The API key used is server-side only and is not intentionally exposed to visitors.
Embedded YouTube player
The YouTube player is not loaded when the page opens. An embedded player is created — through the privacy-enhanced address (youtube-nocookie.com) — only for the card whose play button you explicitly click.
Thumbnails, channel links and the embedded player are third-party resources. Interacting with them, and in particular starting the player, may allow Google/YouTube to process your device, cookie, browser-storage, network and usage information under their own policies.
YouTube may serve third-party content, including advertisements, through its player. Art Lastik neither selects nor controls that content.
Using the privacy-enhanced address does not mean that no processing, cookies or device access occur on Google/YouTube’s side. Art Lastik’s temporary server cache described above is distinct from the processing Google/YouTube performs independently, which is governed by Google’s own policies.
Other third-party content
The Contact page uses embedded Google Maps maps to show branch locations. Those maps DO NOT load automatically when the page opens: they load only if you grant the external content consent described below, and only then can they process information under Google’s own policies.
External content consent and the preference cookie
Optional content provided by Google (the embedded Google Maps map on the Contact page and the YouTube section on the Social Media page) is not loaded until you allow it. While permission has not been granted, no frame (iframe) is created for that content, no YouTube thumbnail is requested and no YouTube API request is made.
To remember your choice, exactly one first-party preference cookie is used: alastik_media_consent. It stores only three values — the preference version, your decision (allowed or rejected) and the timestamp of that decision. No user identifier, session identifier, fingerprint, IP address, browsing history or advertising identifier is stored. The cookie lasts at most 180 days and is written with Path=/, SameSite=Lax and, over a secure connection, Secure.
Selecting “Allow” means that you agree to this Privacy Policy; that agreement is recorded in the same preference record and no separate field is stored for it. Rejecting does not mean that you accept this policy.
A rejection is remembered in the same way, so you are not asked again on every page. If the wording or the preference schema version changes, your previous decision is treated as invalid and you are asked to choose again.
You can change your decision at any time: the “Privacy Preferences” link in the footer reopens the same consent surface and makes withdrawing permission exactly as easy as granting it. When you withdraw permission, any open Google Maps and YouTube frames and any YouTube thumbnails are removed immediately and no further YouTube API work is performed. Withdrawing permission does not, however, undo third-party processing that has already taken place.
This preference cookie belongs to Art Lastik and carries only your choice. Any cookies, browser storage or similar technologies that Google/YouTube may use after you allow external content are separate and are governed by Google’s own policies.
Apart from that preference cookie, Art Lastik does not set its own cookies on this website and does not write to browser local storage or session storage. The site contains no analytics, tag manager or advertising tracking code.
Forms and information you submit
The job application form on the Career pages collects and stores your full name, email address, phone number, an optional message and the CV file you upload, so that your application can be assessed. This information is submitted only when you accept the explicit consent statement shown in the form; the current wording of that statement appears in the form itself.
The contact form on the Contact page collects and stores your full name, phone number, email address and message, so that your request can be assessed and so that we can contact you about it. This information is submitted only when you tick the consent box shown in the form. The record is kept for a maximum of 12 months, a maximum set by the data controller rather than a statutory one; deleting the record at the end of that period is an operational duty, not an automatic technical behaviour.
Contact form messages are stored as a separate record from job applications and are viewed only by authorised administrators in the management panel. No email, SMS or other third-party delivery service is used for these messages.
To limit abuse, submissions of both forms record browser information and an irreversibly hashed client key rather than a raw IP address. Your raw IP address is never stored in any record.
Assessment for the position you applied to
The information and the CV you submit with a job application are processed first of all to assess your application for the vacancy you applied to, to carry out the recruitment process and to contact you about that application.
Assessment and processing for the vacancy originally applied to continue for a maximum of 12 months from the application date. Granting future-position permission does not extend the period during which the application is evaluated for that original vacancy; after those 12 months your application is not used for the original-vacancy purpose merely because future-position permission exists.
If you do not grant the optional future-position permission, the operational retention deadline for the complete application record is likewise 12 months. If you do grant it, the record's actual retention is described in the section below.
The 12-month period is the data controller's own maximum, not a statutory maximum. Processing for that purpose continues only for as long as it is necessary for that purpose and for as long as the retention obligations arising from the applicable legislation continue. The same information is also stated in the information and consent text shown in the application form itself.
Optional consideration for future positions
The “also consider me for suitable future positions” permission in the application form is SEPARATE from the assessment for the vacancy you applied to, and it is optional. The box is not pre-selected and the two decisions are never combined.
If you grant the separate optional permission, the CV and the application and contact information reasonably required for suitable future positions may be retained and processed solely for that separate purpose for a maximum of 24 months from the application/consent date.
Because your application is stored as a single record, granting that permission means this information stays together in that same record for the 24 months; no field-level deletion, extraction or anonymisation at the end of month 12 is claimed. What changes after 12 months is that the information may then be used only for the future-position purpose.
That 24-month maximum applies only to this separate purpose within a career application; it does not apply to customer reviews, contact-form submissions, marketing data or any unrelated category of data. It is likewise the data controller's own maximum period, not a statutory one.
Refusing this permission does not prevent you from applying for the current vacancy; your application is assessed either way.
You can withdraw the permission at any time by writing to [email protected]. Withdrawal ends the consideration for future positions before the 24-month maximum is reached. Withdrawal does not mean the erasure of records that are still needed for your ongoing application or that must be kept because of a separate legal obligation.
No information is kept indefinitely merely because it might be useful later.
Contact and data-protection requests
General questions about this policy or about your personal data can be sent to [email protected].
Requests concerning your rights under the Turkish Personal Data Protection Law No. 6698 (KVKK) may be submitted in writing to the data controller’s registered office (Gülbahar Mahallesi, Galata Deresi Caddesi No: 51/A, Şişli/İstanbul, Türkiye) or by any other method permitted by the applicable legislation.
You may also send such a request to [email protected] when you use an email address that you have previously notified to the data controller and that is registered in its systems.
[email protected] is an ordinary email address; it is not a registered electronic mail (KEP) address, and no KEP address is published in this policy.
You can also continue to use the channels listed on the Contact page.
Terms of Use
The terms that apply to using this site are published on a separate page.
