1. Data Controller
The company operating this platform (the "Company") processes your personal data described below as the data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK").
2. Personal Data Processed
- Identity and contact details: full name, e-mail address, phone number
- Account security data: password (stored hashed), IP address
- Visual and biometric data: the selfie/profile photo you upload and the face recognition data derived from it (special category personal data)
- Payment and delivery data: purchase amount, transaction record, and in case of a physical print request, the delivery address and phone number
3. Purposes of Processing
- Account creation, authentication and session management
- Carrying out purchases and billing via the payment infrastructure (iyzico)
- Forwarding physical print requests to the relevant photographer and running shipping/delivery processes
- Automatically matching the selfie you upload against the photos in the collection of the event you attended so that only your own photos are shown to you (face recognition/matching)
- Fulfilling legal obligations and resolving possible disputes
4. Legal Basis
Your personal data is processed on the legal grounds of being directly related to the conclusion or performance of a contract, the fulfilment of a legal obligation, and your explicit consent. Special category data such as selfie/face data is processed solely on the basis of your explicit consent.
5. Retention Period
Your personal data is retained for as long as the purpose of processing requires, subject to the limitation periods set out in the applicable legislation; if you delete your account or withdraw your consent, it is erased or anonymised within a reasonable period.
6. Your Rights (KVKK Art. 11)
- Learning whether your personal data is being processed
- Requesting information about it if it has been processed
- Learning the purpose of processing and whether it is used in line with that purpose
- Knowing the third parties to whom it is transferred at home or abroad
- Requesting correction if it has been processed incompletely or incorrectly
- Requesting erasure or destruction within the conditions of Article 7 of the KVKK
- Requesting that these actions be notified to third parties to whom the data was transferred
- Objecting to an adverse outcome arising from analysis by automated systems
- Claiming compensation if you suffer damage
You may apply to our company in writing to exercise these rights.