This English version is provided for convenience only. The Turkish text is legally binding; in case of any difference, the Turkish version prevails.
Draft — pending legal approval
Personal data retention and destruction policy
Pursuant to the KVKK and the Regulation on the Erasure, Destruction or Anonymization of Personal Data.
1. Purpose
This policy sets out how long personal data processed by _BURAYA_ŞİRKET_ADI_ will be retained and how it will be destroyed at the end of that period.
2. Recording media
Data is kept electronically in a cloud database (MongoDB Atlas), object storage (Amazon S3, Frankfurt) and email infrastructure (Amazon SES). No printed records are kept.
3. Retention periods
| Data | Customer access | Server retention |
|---|---|---|
| Photo Booth photos and outputs (paid event plan) | End of event + 15 days | End of event + 12 months |
| Try it now (no-account demo) Photo Booth shots | Approximately 30 minutes (download / QR) | Approximately 30 minutes; additionally, up to 1 day in storage |
| Game / hall reports and QR controller or QR participation records (player name, score, name / email / phone entered in the registration form, AI Avatar selfie used in the game) | End of event + 15 days | While the customer account remains open; if the account is deleted, deletion date + 12 months |
| Unused AI Avatar selfie shots | — | Deleted when the game session ends |
| Designs and records deleted by the customer | Removed immediately | Deletion date + 12 months |
| Records of deleted accounts | Removed immediately | Deletion date + 12 months |
| Invoice and payment records | While the account remains open | 10 years (tax legislation) |
| Session tokens | — | Up to 24 hours |
The customer access period (15 days) and the server retention period (12 months) may be adjusted by system administration; any change will be reflected in this policy.
4. Method of destruction
By an automated job that runs every 30 minutes, expired records are permanently deleted from the database and storage. Copies in backups are deleted automatically at the end of the backup retention period.
5. Periyodik imha
In addition to automatic deletion, retention periods are reviewed at least every 6 months and the review is recorded in minutes.
6. Sorumlular
_BURAYA_SORUMLU_KISI_ is responsible for implementing this policy.