Data Protection Notice (KVKK)

Data controller

The Biranda (biranda.net) service is provided by Fuse Digital Advertising. This notice has been prepared in our capacity as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). For people in North Cyprus, the rights arising from the Personal Data Protection Law No. 89/2007 are also reserved.

• Address: [Adres — bekliyor]
• Company registration no.: [Sicil no — bekliyor]
• Email: merhaba@biranda.net
• Phone: [telefon — bekliyor]

Below we describe the data in four groups, according to whose data it is. For each group you will find which data we collect, why, on what legal basis and how.

Couples and account holders

• Data: email address; your name (optional); if you sign in with Google, the name, email, profile photo link and account ID that Google shares; event details (couple's names, event type, date, time, venue, city, map link); billing details and shipping details from any past physical product orders (full name or company, phone, address, province/district, postcode, country, optional Turkish ID or tax number); bank transfer receipt; order history (product, amount, payment status, discount code); session cookie; security logs.
• Purposes: opening your account and letting you sign in; creating the event page, QR code and invitation; taking digital orders, collecting payment and issuing invoices; managing records and requests for any past printed card orders; sending emails about orders, photos awaiting approval, invitation replies and the storage period; providing support; keeping the account and the service secure.
• Legal basis: establishing and performing the contract (Art. 5(2)(c)); legal obligation for invoices and tax records (Art. 5(2)(ç)); legitimate interest for security and the prevention of abuse (Art. 5(2)(f)); establishing, exercising or protecting a right in a possible dispute (Art. 5(2)(e)). If we ever want to send promotional messages, we will ask for your consent separately.
• Method of collection: the forms you fill in on the dashboard and the checkout page; Google, if you sign in with Google; cookies and server logs. All electronically, by automated or partly automated means.

We no longer accept new physical product or printing orders. Any records of past orders remain subject to the retention and deletion terms below; this service change does not remove your existing rights.

Guests who upload photos and videos to an album

Uploading requires no account and no app.

• Data: the name you enter; your photos and videos (images of you and of the people in the frame); your optional note; a random session ID generated on your device; a salted hash of your IP address; file type, size and upload time. Raw IP addresses and file names are not stored in our database.
• Purposes: delivering your photos to the couple's album, presenting them for the couple's approval, showing them in the gallery and the live slideshow, letting the couple download them all; preventing excessive and malicious uploads.
• Legal basis: providing the upload service you use when you press "Send" (Art. 5(2)(c)); legitimate interest for security purposes for the session ID and IP hash (Art. 5(2)(f)).
• Method of collection: the details you enter and the files you choose on the upload page opened by the QR code; technical data automatically.

Location (GPS) data in photos and videos is removed before the file leaves your device. HEIC files uploaded from a computer are converted on the server into JPEGs without location data. We do not use facial recognition or any other biometric processing.

If the couple has opened the album, photos are shown to people who know the album link and, if set, the PIN, after the couple approves them (immediately if the couple has turned approval off). The album is hidden from search engines. The couple decides which photos appear in the album and can hide or delete them.

If you would like one of your photos removed from an album, write to the couple or to us. People who appear in a photo but did not upload it can ask in the same way.

Guests who receive an online invitation

• Data: the name, group (e.g. "Bride's side"), phone and email entered by the couple; the reply, party size, menu choice and note you give; the time of your reply and of the invitation; an IP hash for security. If the couple uses an open reply link, you enter your name and phone yourself.
• Purposes: opening the invitation page personally for you, recording your reply and passing it to the couple, giving the couple the numbers and the guest list (Excel), and, if the couple has turned this on, sending reminders to guests with a registered email who have not replied.
• Legal basis: performance of our contract with the couple and the couple's instructions (Art. 5(2)(c)); legitimate interest for security logs (Art. 5(2)(f)).
• Method of collection: the couple adds the list on the dashboard by hand, by pasting or with a CSV/Excel file; you give your reply on the invitation page.

Who decides? The couple creates the guest list and decides whom to invite, what information to enter and how to use the list. For this data, it is therefore the couple who is responsible towards their guests, and informing the guests is the couple's task. We process this data only on the couple's instructions and to provide the service, and we do not use it for our own purposes; in this part we act as a data processor. For records we keep ourselves, such as security logs, we are the data controller.

Invitation messages are sent by WhatsApp or SMS from the couple's own phone; we do not send them. We do not ask for special categories of personal data (such as health or beliefs). If you write health information such as an allergy in the note field, it is passed only to the couple and relies on your explicit consent (Art. 6); you may choose not to write it.

Partner applications and the contact form

• Data: name, email, phone, company, city and your message. If you become a partner: your partner code, commission rate, orders placed with your code and the details needed to pay your commission.
• Purposes: assessing your application and getting back to you; if you become a partner, setting up your code and calculating and paying the commission.
• Legal basis: establishing and performing the contract (Art. 5(2)(c)); legal obligation relating to commission payments (Art. 5(2)(ç)); legitimate interest in answering general questions (Art. 5(2)(f)).
• Method of collection: the forms on the website and email.

Who we share data with

To run the service we share only the data that is needed with the providers below. Otherwise we share data with the competent authorities only when there is a legal request.

By the nature of the service, the photos uploaded by guests and the replies of invited guests are passed to the couple who owns the event.

Anonymous page-view counts

On public marketing pages we keep only daily aggregate view counts on our own server. Each counter contains the Europe/Nicosia calendar day, a predefined page group, coarse source and campaign-medium categories, and a mobile/tablet/desktop category. Opening a page again may increase the count; it is not a unique-visitor count and is not matched to accounts that register or pay. Aggregate counts are retained; historical visits are not reconstructed.

This measurement creates no cookie, browser storage, persistent visitor ID or fingerprint. Counters contain no raw IP address, full page URL or query string, full referring URL or domain, arbitrary campaign name, location, email, account or event ID. The browser reduces the source to a controlled category. The existing abuse-prevention mechanism uses a separate IP-hash rate counter; that hash is not joined to aggregate measurement. Browsers with DNT or Global Privacy Control, the store app, private customer/admin, sign-in and guest pages are excluded. Advertising consent and Meta Pixel preferences remain separate.

Transfers abroad

The servers of our hosting, database and storage providers are in the European Union or the US; our email and Google sign-in providers are based in the US. Your data is therefore transferred abroad.

Under Article 9 of the KVKK as amended in 2024, regular transfers are made with appropriate safeguards such as the standard contracts announced by the Board; standard contracts are notified to the Board after signing. The safeguard we rely on for these transfers is standard contracts. In one-off, non-regular cases where no safeguard can be applied, your explicit consent may be requested, provided you have been informed of the possible risks.

How long we keep data

• Album files (photos, videos, guest names, notes): for the purchased storage period, that is 1 year from the event date (or from the purchase date if the event has passed); the couple can extend it. The couple is emailed 30 and 7 days before the period ends. When it ends, the album is frozen for 30 days: it can be downloaded but no new uploads are possible. The files are then permanently deleted, and guest names, notes and guest details are anonymised.
• "Delete all data": if the couple makes this request from the dashboard, the album closes immediately, the files are deleted after 7 days and the personal fields of the event are anonymised. The couple can withdraw the request within 7 days.
• Guest list: together with the album, for the periods above; for events without an album, until the couple deletes the list or asks for their account to be deleted.
• Account details: as long as your account is open. If you want your account deleted, simply write to us.
• Order and invoice records: 10 years, as required by tax and commercial law.
• Partner applications and contact messages: as long as needed after the request is settled; then deleted.
• Security logs (action, user and event ID, IP hash): for a reasonable period, to keep the service secure and resolve possible disputes.
• Rate-limit records: short-lived; deleted at the latest one hour after the counter expires.

IP addresses may briefly appear in the hosting provider's technical access logs; we do not keep these logs separately.

Your rights

Under Article 11 of the KVKK, you may apply to us to:

• find out whether your personal data is processed and, if so, request information about it;
• find out the purpose of processing and whether the data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom the data is transferred;
• ask for incomplete or incorrect data to be corrected;
• ask for the data to be deleted or destroyed under the conditions in Article 7 of the KVKK;
• ask for corrections and deletions to be notified to the parties the data was transferred to;
• object to a result against you arising solely from analysis by automated systems;
• claim compensation for damage caused by unlawful processing of your data.

How to apply

• In writing: [Adres — bekliyor]
• By email: merhaba@biranda.net (from the email address you gave us before or that is registered in our system)

In your application, state your first name, surname, contact address and request clearly; we may ask for more information to verify your identity. We answer your application free of charge within 30 days at the latest. If you find our answer insufficient or do not receive one in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer, and in any case within 60 days of your application.

For cookies and browser storage see Privacy and Cookies; for purchase terms see the Distance Sales Agreement. We update this notice as the service changes; the date of the last update is at the top of the page.