Explicit Consent Statement — Biometric Data

This statement is presented to event attendees who wish to use the vioFind face-matching feature on the Vioworks platform (vio.works). It explains, before you take a selfie, exactly what biometric data will be processed, how, by whom, and for how long — so that the consent you give is informed, specific, and freely given, as required by Article 9 of the GDPR and Article 6 of the Turkish Personal Data Protection Law (KVKK).

This statement should be read together with our Privacy Policy.

The party responsible for the selfie-matching operation described here is Vioworks, operated by Emre Topdemir, Zühtüpaşa Mahallesi, Hasan Amir Sokak 15/1C, Kadıköy, İstanbul, Türkiye. Contact: hello@vio.works.

ℹ️ The event photos you will be searched against are uploaded by the event's photographer or organizer (the "Account Holder"). For the indexing of those photos, the Account Holder acts as the data controller and Vioworks acts as a data processor on their behalf.

No name, ID, or contact information is linked to your selfie. The matching result is simply the set of event photos in which your face appears.

Your biometric data is processed for one purpose only: to find, among the photos of the specific event you are attending, the photos in which you appear. Technically:

• Your selfie is converted into a temporary facial feature vector by Amazon Rekognition.
• That vector is compared against the facial vectors of the event's photo collection.
• Matching photos are shown to you; the selfie and its temporary vector are then immediately discarded.

Your biometric data is never used for advertising, profiling, identification across events, training artificial intelligence models, or any other purpose.

The matching operation runs on Amazon Web Services (Amazon Rekognition) infrastructure, under a Data Processing Agreement with AWS. Data may be processed in the EU (Frankfurt) and US East regions; transfers outside your jurisdiction are safeguarded by Standard Contractual Clauses and the AWS Data Processing Addendum. Your biometric data is not shared with any other third party.

• Selfie image: never stored — discarded immediately after the match.
• Temporary facial vector from your selfie: discarded immediately after the match.
• Event photo embeddings: deleted when the Account Holder deletes the event or the event's storage period expires.

Giving consent is entirely voluntary. If you do not consent, simply do not take a selfie — no biometric data of yours will be processed by the search feature. You can still ask the event's photographer or organizer to share your photos with you through other means (for example, a full gallery link). Declining consent has no other consequence.

If you believe you appear in the event photos and want your facial vectors removed from the event's collection, contact the Account Holder or email us at hello@vio.works.

You may withdraw your consent at any time, free of charge, by emailing hello@vio.works. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because your selfie and its vector are already deleted immediately after each search, withdrawal primarily means you will not use the feature again and, on request, that facial vectors matching you in an event collection are removed.

Under KVKK Article 11 and GDPR Articles 15–22, you may at any time request information about whether your data is processed, request access, correction, or deletion, object to processing, and lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or your local EU/EEA supervisory authority. See Section 8 of our Privacy Policy for details.

You give this consent by tapping the scan / selfie button after this statement has been made available to you. If you do not consent, do not proceed with the selfie.