This English version is provided for convenience only. The Turkish text is legally binding; in case of any difference, the Turkish version prevails.

Draft — pending legal approval

Customer privacy notice

For customers who open a Work'n Work account, buy an event plan and use the panel, and for visitors who reach us through the Tailormade showcase (custom.worknwork.com).

Effective date: _BURAYA_YURURLUK_TARIHI_

1. Veri sorumlusu

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the company whose details are given below, acting as data controller.

• Company name: _BURAYA_ŞİRKET_ADI_
• MERSİS no.: _BURAYA_MERSIS_NO_
• Address: _BURAYA_ADRES_
• KEP: _BURAYA_KEP_ADRESI_
• Email: _BURAYA_E_POSTA_
• VERBİS (Data Controllers' Registry) registration no.: _BURAYA_VERBIS_NO_

2. Personal data processed

• Identity and contact: first name, last name, email address and, where applicable, phone number and company details.
• Account security: an irreversible hash of your password (the password itself is not stored), session logs, IP address, browser and device information.
• Customer transactions: event plans, dates, selected apps, amounts and billing information.
• Event content: logos, images, designs and texts you upload.
• Usage logs: records of actions performed in the panel (e.g. creating a plan, updating a design).
• Tailormade inquiries: the name, company, e-mail, phone, project type, timeline, budget and message you enter in the contact form.
• Demo usage: start and end time of the showcase demos, the player name you enter, score, IP address, browser, device and screen information.

3. Purposes of processing and legal grounds

• Opening the account, providing the service and setting up event plans: establishment and performance of a contract (KVKK Art. 5(2)(c)).
• Invoicing, accounting and statutory retention: legal obligation (Art. 5(2)(ç)).
• Account security, prevention of misuse and measurement of service quality: legitimate interest (Art. 5(2)(f)).
• Protection of rights in disputes: establishment, exercise or protection of a right (Art. 5(2)(e)).
• Replying to your Tailormade inquiry and preparing a quote: necessary for entering into a contract (Art. 5/2-c).
• Measuring how the showcase demos are used: legitimate interest (Art. 5/2-f). This measurement does not use cookies.
• Sending campaigns and newsletters: only with your separate explicit consent (Art. 5(1)).

4. Method of collection

Data is collected electronically through the website, the account panel, email and support channels, either as entered by you or automatically while the service is used.

5. Transfer

Your personal data may be transferred, strictly limited to the purposes above, to our service providers supplying hosting, database and email infrastructure (Amazon Web Services — Germany/Frankfurt region, MongoDB Atlas — _BURAYA_VERITABANI_BOLGESI_), to payment institutions, to our accounting and legal advisers and, upon request, to competent public authorities. Transfers abroad are carried out in accordance with the safeguards set out in Article 9 of the KVKK.

6. Retention periods

• Photos, outputs, game reports and participation records of a paid event plan are visible in the customer account for 15 days from the end of the event and can be downloaded during this period.
• Photo Booth shots taken in the Try it now demo are deleted after approximately 30 minutes; the customer access window (15 days) does not apply to them.
• When this period expires, when the plan is cancelled or when the customer deletes a record, the records are immediately removed from the customer's access.
• For the purposes of legal obligations, potential disputes and requests from competent authorities, records are retained on the servers for 12 months from the end of the event and are automatically deleted at the end of this period.
• Exception: game and QR controller records (player name, score, name / email / phone entered in the registration form and the AI Avatar selfie used in the game) are retained for as long as the customer account remains open; if the account is deleted, they are automatically deleted 12 months later.
• Even if you delete your account, records are retained for 12 months due to legal obligations and are then deleted.
• Invoice and payment records are retained for the period required by tax legislation (10 years).
• Tailormade inquiries and demo usage records are deleted automatically after 365 days.

7. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your data is processed, to request information, to learn whether it is used in line with its purpose, to know the third parties to whom it is transferred, to request its rectification, erasure or destruction, to object to a result against you arising from automated analysis, and to claim compensation for damages. You may submit your applications using the application form .