For the collection and sharing of the photos, videos and notes uploaded to your event you are the data controller within the meaning of KVKK (and the GDPR); Photonza is the processor that stores and displays this content on your behalf. This section serves as the processor agreement under Article 12 of KVKK and Article 28 of the GDPR.
- Photonza processes event content only to provide the service (storage, resizing, display in the feed, downloads) and on your instructions; it uses it for no other purpose. Processing for face matching is governed separately below.
- Photonza uses the sub-processors listed in the Privacy Policy (Supabase, Cloudflare, Vercel), notifies account holders at least 30 days before a new sub-processor is added and gives them the opportunity to object. These sub-processors are established abroad or provide their services on infrastructure abroad; the organizer instructs that event content be stored on this infrastructure. For these transfers Photonza relies on the Board's standard contract (processor to processor) under Article 9 of KVKK; completing the contracts and notifying them to the Board is in progress.
- Photonza applies the technical and organisational measures in Section 8 of the Privacy Policy and informs you without undue delay when it becomes aware of a data breach.
- Event content is deleted automatically 30 days after the event ends. You may delete or download content at any time within that period.
- We answer guests' requests regarding event content (deletion, access) in cooperation with you and within the statutory period.
- Your obligations: (a) inform attendees that photos and videos are taken at the event, that they are shared in the Photonza feed and, if face recognition is on, that the faces in photos are scanned for matching with consenting guests; to do so, display the notice at photonza.com/organizer-notice, or a notice containing the same information, at the event entrance where attendees can see it; (b) upload to the event only photos and videos you have the right to upload and share; (c) obtain the required parental consent for photos of children (Photonza may ask the organizer for an explanation or documents regarding parental consent following a complaint or where it finds that children feature heavily in the event; if they are not provided within a reasonable time, it may remove the content concerned and turn face recognition off for the event); (d) share the invite code only with invitees; (e) turn face recognition off in the event settings at events where most participants are children, and at any other event where you consider it unsuitable for your participants; (f) forward to Photonza without delay any objection or deletion request concerning face signatures that reaches you. When creating each event you additionally confirm the obligations in (a) and (b) with a separate, mandatory commitment checkbox ("Organizer commitment"); your confirmation is recorded together with the event, the date and the version of the commitment text. In the same step you also accept the current version of these Terms with a separate, mandatory checkbox; that acceptance is likewise recorded with the event and the version.
The photographer assumes in their own name, for the content they upload, the obligations in (b) and (c) of this section and the indemnity clause below; the organizer informs the photographer they invite about these Terms.
Indemnity and recourse: the organizer holds Photonza harmless against any claim, administrative fine, compensation and litigation costs, including reasonable attorney's fees, brought against Photonza because of the organizer's breach of its obligations in this section (informing attendees, rights in uploaded content, parental consent for children); Photonza has recourse against the organizer for amounts it is obliged to pay. Photonza notifies the organizer of the claim within a reasonable time. If the organizer is a consumer, this clause applies only in proportion to their fault.
Allocation of roles: Photonza determines the purpose and means of the "Find Me" face-matching processing (face signatures generated from guests' selfies, detection of faces in event photos and videos, momentary computation and comparison of signatures, and storage of matching signatures); Photonza is therefore the data controller for that processing, and it is not subject to the processor terms above. The organizer can turn face recognition off for their event and has no access to face signatures.