KVKK Information Notice (for users in Türkiye)

This is a courtesy English translation. The Turkish version is the binding text and prevails in case of any difference.

This notice is provided under Article 10 of Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It informs hosts, venue representatives and guests who use Snapia from Türkiye.

1. Data controller

Snapia Technologies FZ-LLC, [Registered address, United Arab Emirates], snapia.co, privacy@snapia.co

[Details of the data controller representative and VERBİS registration to be added following legal review.]

Snapia is the data controller for account, payment, communication and security data. For content uploaded to albums, the controller is the host who created the album or the venue that created the event, and Snapia processes that content on their behalf as a data processor.

2. Personal data processed

• Identity and contact: name, e-mail address; for venues, business and representative details.
• Customer transaction: the package or subscription purchased, billing details, payment status and support correspondence. Card details go directly to the payment providers; Snapia does not receive or store them.
• Visual and audio recordings: photos, videos and voice recordings uploaded by guests, written guestbook messages and an optional guest name.
• Transaction security: IP address, browser and device information, logs, the device token stored in the guest's browser to manage their own uploads, and data processed for bot protection.
• Marketing: e-mail preferences, only if you give explicit consent.

Location (GPS) data is removed from stored photos when they are processed after upload. Snapia does not offer face recognition or face search and does not derive biometric data from photos. If such a feature is ever offered, you will be informed separately and explicit consent will be obtained.

3. Purposes

• Managing membership and accounts;
• Creating event albums and receiving, storing and sharing uploads with authorised people;
• Handling sales, payments, invoicing and accounting;
• Sending service notices, such as purchase confirmations and deletion reminders;
• Ensuring information security and preventing abuse and fraud;
• Automated moderation of uploads, if the host enables it;
• Handling requests and complaints;
• Complying with legal obligations and responding to competent authorities;
• Sending marketing messages, if you give explicit consent.

4. Legal grounds

We process personal data on the following grounds under Article 5 of the Law:

• Processing is directly related to the conclusion or performance of a contract (Art. 5/2-c): accounts, packages, subscriptions and album services.
• Compliance with our legal obligations (Art. 5/2-ç): invoicing, tax and requests from authorities.
• Establishing, exercising or protecting a right (Art. 5/2-e): disputes and legal claims.
• Our legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f): security, logs, bot protection and service improvement.
• Explicit consent (Art. 5/1): marketing messages.

5. Recipients

• Service providers: Cloudflare (storage, content delivery, bot protection), Stripe (payments), an e-mail delivery provider, an optional error-monitoring provider (Sentry) and, if the host enables it, an AI moderation provider.
• The album's controller: the host, or the venue that created the event, for guest uploads.
• Competent public authorities and courts: where legally required.
• Professional advisers: legal, accounting and audit service providers.

6. Transfers abroad

Snapia is based in the United Arab Emirates. Album content is stored in Cloudflare R2 under EU jurisdiction, and some service providers may process data in other countries, including the United States. Your personal data is therefore transferred abroad.

Transfers are made in line with Article 9 of the Law. Where there is no adequacy decision, we rely on one of the appropriate safeguards provided for in the Law, such as the standard contracts announced by the Personal Data Protection Board, or, where that is not possible, only on the occasional-transfer cases permitted by the Law. Explicit consent may be used only as one of those cases and subject to the conditions of the Law. The mechanism for each transfer is determined under current legislation and Board decisions, and this notice will be updated where necessary.

7. Method of collection

Personal data is collected electronically, by automated and partly automated means, through our website and apps, upload pages opened via QR code, sign-up and payment forms, e-mail and support channels, and payment providers.

8. Retention

Album content is kept from the event date for the archive period of the package and then deleted: 14 days for the free trial, 6 months for Celebration, 12 months for Wedding Standard, 24 months for Wedding Premium and Wedding Series, and 12 months for venue events. Extensions can be purchased, and e-mail reminders are sent 30, 7 and 1 day before deletion. Account data is kept for the duration of membership, and invoicing and accounting records for the periods required by law. Data that is no longer needed is deleted, destroyed or anonymised.

9. Your rights under Article 11

By applying to the data controller, you have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• request correction if data is incomplete or inaccurate;
• request deletion or destruction under the conditions of Article 7;
• request that corrections, deletions or destructions be notified to third parties who received the data;
• object to a result against you arising exclusively from automated analysis;
• claim compensation if you suffer damage from unlawful processing.

10. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:

• by e-mail to privacy@snapia.co from the e-mail address registered with us,
• through the data request form, or
• in writing to the address above.

Guests can also delete their own uploads directly from the browser they uploaded with. Applications are concluded free of charge as soon as possible and within 30 days at the latest; if the action involves an additional cost, the fee set by the Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.

Explicit Consent

This section is separate from the information notice above. The consent below is entirely optional and is collected through a separate, unticked checkbox at sign-up or checkout. Refusing it does not affect your use of the services.

Marketing messages

"I give my explicit consent to the processing of my name and e-mail address so that Snapia can send me commercial electronic messages by e-mail about its campaigns, news and announcements."

You can withdraw consent at any time via the link in each message, your account settings or by writing to privacy@snapia.co. Under Law No. 6563 on the Regulation of Electronic Commerce and its regulation, commercial message consents are registered with the Message Management System (İYS) where required, and you can also opt out through İYS.