Biometric Data Notice and Explicit Consent

This notice is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It also serves as the transparency information required by the GDPR where applicable.

The data controller for your face signature is Ali Mert Güleç, who operates the Photonza platform. Email: info@alimertgulec.com.

Face signature: A numeric vector generated from your selfie by a model running in your browser. This vector is special-category personal data (biometric data) under Article 6 of KVKK and Article 9 of the GDPR.

The selfie image itself never leaves your device; it is not uploaded to or stored on the server. Only the numeric signature is sent. A face image cannot be reconstructed from the signature.

Match results: Similarity scores indicating which photos may show you. These are deleted together with your face signature.

The sole purpose is to compare your face signature with the face signatures in the photos uploaded to the event you joined, in order to find the photos you appear in. Your face signature is not matched across events and is not used for profiling, identity verification, advertising or any other purpose.

The legal basis is your explicit consent under Article 6/2 of KVKK (and Article 9/2(a) of the GDPR). Consent is not mandatory: if you do not consent, you continue to view the event feed and upload and download photos; you only cannot use "Find Me". The face signature is generated electronically on your device while you take a selfie in the "Find Me" flow and is transmitted to the server.

Your face signature is not shared with or sold to any third party and is not shown to the organizer. The organizer only sees how many guests used the feature.

Face signatures are stored on Supabase (database, European Union region), the infrastructure provider of the service, with access limited by row-level security rules. This is a transfer abroad from Türkiye; Photonza carries it out in line with its obligations under Article 9 of KVKK.

Your face signature is deleted at the first of the following:

• When you press "Delete my face data" on the Profile page (immediately).
• When you leave the event (immediately).
• 30 days after the event ends, together with all event content (automatically).
• When you write to us at info@alimertgulec.com (within 30 days at the latest).

Under Article 11 of KVKK you have the right to learn whether your data is processed, to request information if it is, to learn whether it is used for its purpose, to know the parties it is transferred to, to request correction and deletion, to object to a result against you produced by automated analysis, and to claim compensation if you suffer damage. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

The application procedure is described in the "Requests" section of the Privacy Policy.

When you first want to use "Find Me", the statement below is presented to you with a separate checkbox. The box is unticked by default; you cannot continue without ticking it. When you tick it, your user ID, the event, the date and the version of this text are recorded.

"Having read the Biometric Data Notice, I give my explicit consent for Photonza to store the face signature (my biometric data) generated on my device from my selfie for the "Find Me" feature, for the duration of this event and 30 days after it ends, and to process it solely to match it against this event's photos."

An age declaration is also required: "I confirm that I am at least 18 years old."

To withdraw your consent, simply use "Delete my face data" on the Profile page; it is as easy as giving consent and no reason is asked.