Privacy Policy

This policy explains how we handle personal data when you use Kukuva as a host, add photos or messages to an event as a guest, or visit kukuva.cy. It is written to meet the EU General Data Protection Regulation (GDPR) and the Cyprus law that applies it (Law 125(I)/2018).

1. Who we are

Kukuva is run by TKOCY LTD, company number HE399700, registered office Panagias Evaggelistrias 89B, 4156 Limassol, Cyprus, Cyprus.

• E-mail: [email protected]
• Phone: +357 25 253190

We have not appointed a Data Protection Officer, because the law does not require one for us. Every privacy question goes to [email protected] and is handled by a person responsible for data protection.

2. Our two roles

• We are the controller for the data of hosts and their accounts, payments and invoices, visitors of kukuva.cy, anyone who contacts us, and the technical data we need to keep Kukuva secure.
• We are a processor for the content guests add to an event: photos, videos, text and voice messages, the name a guest types, answers to the host's questions and likes. The host decides to create the event, who is invited and how the album is used, so the host is the controller of that content and we handle it only on the host's behalf (see section 14 of our Terms).

Many events are private celebrations. Where a host uses Kukuva only for a personal or family event, data protection law may treat the album as a household activity of the host. Either way, we handle guests' content only as this policy describes.

3. What we collect

Hosts

• account details: name, e-mail address, password (stored only as a secure hash), language, phone number if you give it, two-step sign-in settings, and your Google account id and e-mail if you sign in with Google
• event details: name, date, type, design choices, images and logos you upload, link name, questions for guests, settings, and the e-mail addresses of co-hosts you invite
• orders and payments: package, amounts, VAT, billing details you give for the invoice, payment status and the reference the payment provider gives us, and bank transfer receipts you upload. We never receive your full card number
• messages you send us by e-mail, phone or live chat
• technical data: IP address and country of your last sign-in, browser and device type, and service logs

Guests

• the photos, videos, text and voice messages you add, and file details such as type, size and the time a photo was taken
• the name you type, if the host asks for it and you choose to give it
• your answers to the host's questions, if the event has a guest form
• likes and which photo challenges you took part in
• a random guest code stored on your phone, which lets you see and delete your own uploads. It does not contain your name
• your language choice, and your IP address and device data, used for a short time to deliver the service and to protect it against abuse

Visitors of kukuva.cy

• technical data needed to show the site (IP address, browser, pages requested)
• your cookie choices
• analytics and advertising data only if you agree in the cookie banner (see our Cookie Policy)
• what you send us through the contact options or live chat

4. Why we use it and our legal bases

We do not use automated decision-making that has legal or similarly significant effects on you, and we do not sell personal data.

5. Guests' content: who can see it

• Everyone who has the event's link or QR code can see the album, unless the host has set a password or made the album upload-only. The host can require approval before anything is shown.
• Photos may appear on the live photo wall at the venue.
• Hosts and co-hosts can see, download, hide and delete everything in their event. Depending on the host's settings, guests can download photos too.
• Photo files are delivered from long, random addresses that cannot be guessed. Someone who has been given such an address can open that file.
• You can delete what you added from the phone you used. For anything else, ask the host, or write to us and we will pass your request to the host and help them act on it.

6. Location data in photos

Phones often store the GPS location in a photo. We remove location data from every copy of a photo that guests, the album and the wall see. The original file, exactly as your phone made it, is kept privately and only the event's hosts can download it (on packages with original quality). If your phone recorded a location, that original still contains it. If you prefer it never to be stored, turn off location for your camera before the event.

7. Who we share data with

• Our service providers (sub-processors), who host, deliver, e-mail and secure the service for us under contracts that protect your data. They are listed on our Sub-processors page.
• Payment providers. Stripe and PayPal process your payment. For their own legal duties, such as fraud prevention and anti-money-laundering checks, they act as independent controllers under their own privacy policies.
• The hosts of an event, for the content guests add to it.
• Professional advisers such as our accountants, auditors and lawyers, under confidentiality.
• Authorities and courts when the law requires it, or to protect someone's life or safety.
• A buyer or successor of our business, who must keep this policy's protections.

8. Transfers outside the EU

We keep our servers and stored files in the European Union (Contabo in Germany, Cloudflare R2 with EU storage). Some providers, such as Stripe, PayPal, Google, Meta, Cloudflare's delivery network and tawk.to, may process data outside the European Economic Area. When they do, the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for certified companies) or by the Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards at [email protected].

9. How long we keep data

10. Your rights

You have the right to:

• access the personal data we hold about you and get a copy
• have it corrected if it is wrong or incomplete
• have it erased where there is no longer a good reason to keep it
• restrict how we use it in some cases
• data portability: receive data you gave us in a common machine-readable format, or have it sent to someone else
• object to use based on our legitimate interests, and at any time to direct marketing
• withdraw consent at any time, without affecting what was done before

Write to [email protected]. We answer within one month. For complex or many requests we can extend this by two more months and will tell you why. We may ask you to confirm who you are. Using your rights is free unless a request is clearly unfounded or excessive.

For content in an event album, the host decides, so we pass your request to the host and help them act on it. A guest can always delete their own uploads from the phone they used.

Complaints. You can complain to the Commissioner for Personal Data Protection of Cyprus (Kypranoros 15, 1061 Nicosia, postal address P.O. Box 23378, 1682 Nicosia, phone +357 22 818456, e-mail [email protected], www.dataprotection.gov.cy), or to the authority of the EU country where you live or work. We would be glad to try to solve the issue with you first.

11. Children

Kukuva accounts are only for people aged 18 or over. Children often appear in event photos, for example at christenings and birthday parties, and hosts are responsible for sharing such photos with care (see our Terms). In Cyprus, children under 14 need a parent's or guardian's agreement for online services based on consent, so a younger child should add content only with a parent's agreement. A parent or guardian can ask the host, or us at [email protected], to remove a photo of their child.

12. Security

We protect personal data with measures that include encrypted connections (HTTPS), servers and storage in the EU, hashed passwords, optional two-step sign-in (required for our own staff accounts), strict separation of each event's data, unguessable links and file addresses, regular updates, limited staff access on a need-to-know basis, and error monitoring that leaves out personal content. No system is completely secure. If a personal data breach puts your rights at risk, we will tell the Commissioner within 72 hours and, where the law requires, we will tell you too.

13. Cookies

The app and the guest pages use only the cookies and local storage that are needed to make them work. On kukuva.cy, analytics and marketing cookies are used only after you agree in the cookie banner. Details are in our Cookie Policy.

14. Changes to this policy

We will update this policy when our service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell account holders by e-mail.

15. Contact

• TKOCY LTD, Panagias Evaggelistrias 89B, 4156 Limassol, Cyprus
• E-mail: [email protected]
• Phone: +357 25 253190