KVKK Privacy Notice (Türkiye)

This privacy notice has been prepared for people who use the Rayomo website and mobile apps ("Rayomo"), in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (6698 sayılı Kişisel Verilerin Korunması Kanunu, "KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ).

1. Data controller

2. Categories of personal data processed

2.1. Special note on facial images (KVKK Art. 6)

Facial images in the photos and videos you upload are personal data. Biometric data within the meaning of Article 6 of KVKK arises when a person's physical characteristics are processed through specific technical means that make it possible to uniquely identify or verify that person's identity. Rayomo:

• does not perform facial recognition, identity verification or matching of a person against a database;
• does not create or store face templates (biometric templates);
• processes facial images only to create the image/video you request.

For this reason, the Company does not, as a rule, regard the processing of facial images on Rayomo as processing of special categories of personal data. However, taking into account the possibility that AI models technically analyse facial features during generation, and that images may indirectly reveal information about a person's race, ethnic origin, religious belief (e.g. clothing) or health, we additionally obtain your explicit consent, as a precaution, under the Explicit Consent Text for operations that transfer facial likeness, such as Video replace. Special-category information such as race, religion or health is not inferred from images, not classified and not used for such purposes.

2.2. Data of third parties

If the content you upload features people other than you, it is your responsibility to inform them and obtain their consent before uploading their data to Rayomo (see Section 7.2.2 of the Terms of Service). These people may apply directly to the Company to exercise their rights.

3. Purposes and legal grounds of processing

Model training: The content you upload and your outputs are not used by the Company to train AI models.

4. Transfer of personal data

4.1. Domestic transfers

4.2. Transfers abroad (KVKK Art. 9)

For Rayomo to operate, some infrastructure services are obtained from providers established outside Türkiye:

These transfers are carried out within the framework of KVKK Article 9, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik), based on one of the processing conditions in Article 5 or Article 6, and on:

1. an adequacy decision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, the "Board") regarding the destination country, where one exists;
2. where there is no adequacy decision, appropriate safeguards in the form of the standard contracts published by the Board, signed with the providers and notified to the Personal Data Protection Authority within 5 business days of signature;
3. in exceptional cases where neither of these is possible and the transfer is incidental, the cases listed in Article 9(6) (e.g. a transfer made at your request that is necessary for the performance of a contract, or your explicit consent given after being informed of the risks).

5. Method of collecting personal data

Your personal data is collected electronically, by fully or partly automated means:

• directly from you through the forms, upload areas and transactions on the Rayomo website and mobile apps;
• from Google or Apple, if you choose to sign in with them;
• through payment result notifications from the payment institution and app stores;
• through cookies and similar technologies, and server logs;
• from your correspondence with us by email and through support channels.

6. Retention periods

Data whose retention period has expired is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hâle Getirilmesi Hakkında Yönetmelik).

7. Your rights under KVKK Article 11

By applying to the Company, you have the right to:

a) learn whether your personal data is being processed, b) request information about the processing if it has been processed, c) learn the purpose of the processing and whether the data is used in line with that purpose, ç) know the third parties in Türkiye or abroad to whom the data is transferred, d) request correction if the data has been processed incompletely or inaccurately, e) request deletion or destruction under the conditions set out in KVKK Article 7, f) request that the actions taken under subparagraphs (d) and (e) be notified to third parties to whom the data has been transferred, g) object to an outcome against you that results from the analysis of the processed data exclusively through automated systems, ğ) claim compensation for any damage you suffer as a result of unlawful processing.

About automated decisions: Uploads and outputs are assessed by automated content safety systems, and content found to violate the rules may be blocked. You may object to such a decision under subparagraph (g); objections are reviewed by a human.

You can also obtain a copy of the data in your account yourself under Account → Settings → Download my data, and delete your account under Account → Settings → Delete account.

8. How to apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), you can submit requests regarding your rights:

• by a written application bearing your wet-ink signature sent to — (together with documents establishing your identity),
• by registered electronic mail (KEP) to —,
• signed with a secure electronic signature or mobile signature and sent to info@rayomo.com,
• or by email with the subject "KVKK Information Request" sent to info@rayomo.com from the email address registered to your Rayomo account.

Your application must include your full name, your Turkish ID number (for Turkish citizens) or your nationality and passport/ID number (for foreign nationals), an address or email address for notifications, and the subject of your request.

Your application will be concluded free of charge within 30 days at the latest, depending on the nature of the request. If the action requires an additional cost, a fee according to the tariff set by the Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and, in any event, within 60 days from the date of your application.