Privacy Policy

Last updated: 28 October 2026

This policy explains how personal data is processed in the QR code event photo album service offered at qrfotoalbum.com (the "Site"), in line with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Controller

Controller: qrfotoalbum.com, Kuşadası / Aydın, Türkiye.
Email: info@qrfotoalbum.com
WhatsApp: +90 534 612 17 27

2. What data we process

From event hosts (couples):

• Identity and contact: name or event name (e.g. "Emma & James"), email address, and your phone number and messages if you contact us on WhatsApp.
• Account: your password (stored only as an irreversible hash), login records.
• Event details: event date, welcome message, cover photo, album settings.

From guests who upload photos or videos:

• The photos and videos you upload and their technical details (file size, resolution, upload time).
• The name and note you choose to add (optional).
• IP address and a random guest ID stored in your browser (only to prevent abuse and to let you add a name/note to your uploads).

From all visitors:

• When you click a WhatsApp button: which button, page language, the ad source that brought you (UTM tags), referring site and time. No IP address is stored with this record.
• Short-lived IP records for security (to block repeated failed logins or upload floods; deleted within 24 hours).
• Cookies (see section 7).

Photos may show other people. They are not processed as biometric data; no face recognition or similar analysis is performed.

3. Purposes and legal bases

• Creating the album, collecting, storing, showing and downloading photos; providing the host dashboard and QR cards. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Handling orders and support requests via WhatsApp or email. Legal basis: performance of a contract and pre-contractual steps (Art. 6(1)(b)).
• Security of the service, preventing abuse and unauthorised access, reviewing reports of inappropriate content. Legal basis: legitimate interests (Art. 6(1)(f)).
• Invoices and accounting. Legal basis: legal obligation (Art. 6(1)(c)).
• Ad measurement (Meta and Google cookies). Legal basis: consent (Art. 6(1)(a)), given with the "Accept" button in the cookie notice. If you do not accept, these cookies are never loaded. You can withdraw consent at any time.

4. Who can see album photos

• The hosts can see, download and delete everything uploaded to their album.
• If the gallery is public, anyone with the album link or QR code can see approved photos and the name/note the uploader added. Hosts can close the gallery at any time.
• Albums are hidden from search engines; people without the link cannot find them.
• Guests who upload are responsible for making sure the people in their photos do not object to sharing them.

5. Recipients and international transfers

• Hosting provider: the Site and all data are stored on servers in Türkiye. For visitors in the EU/EEA this is a transfer to a third country, carried out because it is necessary to provide the service you request (Art. 49(1)(b) GDPR). The provider accesses data only to run the infrastructure.
• Meta Platforms (Instagram/Facebook) and Google: only if you consent to ad cookies.
• WhatsApp (Meta): when you click a WhatsApp button and message us, the conversation is subject to WhatsApp's own terms.
• Public authorities: only where required by law.

We never sell, rent or share your data for marketing purposes.

6. Retention

• Albums and their photos/videos: 12 months from the event date, then deleted with all content. Hosts can delete any item or the whole album earlier.
• Host account: deleted together with the album.
• WhatsApp click records: 2 years.
• Security IP records: 24 hours.
• Invoices and accounting records: as required by tax law (10 years).

Deleted data is removed from backups within 30 days.

7. Cookies

Necessary cookies (no consent required):

• qra: session cookie so hosts can log in to the dashboard. Deleted when the browser closes.
• gt: random guest ID to prevent abuse and let you add a name/note to your uploads. 1 year.
• lang: your language choice. 1 year.

Browser storage: your cookie choice, the name you typed on the guest page (so you don't retype it) and the ad source you came from are kept only in your own browser (the ad source is sent to us only if you click a WhatsApp button).

Ad cookies (only with consent): Meta Pixel and Google tags, used to measure how many people our ads bring to the Site and to WhatsApp. To change your choice, clear this site's data in your browser and the notice will appear again.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in your country of residence, or with the Turkish Personal Data Protection Authority (KVKK).

If you want a photo of yourself removed from an album, write to the hosts or directly to us and we will handle it promptly.

To exercise your rights, email info@qrfotoalbum.com with enough information to identify you and, if relevant, the album link. We reply within 30 days, free of charge.

9. Changes

We may update this policy when the service changes. The current version is always published on this page with its date.