Data Protection Notice
1. Data Controller
Under the Personal Data Protection Law No. 6698 ("KVKK"), Bitparo Teknoloji A.Ş. ("Zanthex") is the data controller.
Email: [email protected]
2. Personal Data Processed
| Data Category | Data Types |
|---|---|
| Identity Information | Name, surname, title |
| Contact Information | Email, phone number |
| Company Information | Company name, industry |
| Transaction Information | Call recordings, call transcripts, chatbot messages, credit loading records |
| Financial Information | Payment method (last 4 digits of card), invoice details |
| Technical Data | IP address, browser info, device type, session logs |
| Voice Data | Real-time processed voice data in voice services (temporary) |
3. Purposes of Processing
- Contract performance and service delivery (KVKK Art. 5/2-c)
- Fulfilling legal obligations (KVKK Art. 5/2-ç)
- Conducting billing and accounting operations
- Customer relationship management and support
- Ensuring platform security and fraud prevention
- Measuring and improving service quality (legitimate interest, KVKK Art. 5/2-f)
4. Data Storage Location
All personal data is stored on servers located in Turkey. This includes account information, call recordings, audio recordings, call transcripts, chatbot messages, call data, knowledge base content, invoice records, and technical logs. No user data is permanently stored outside of Turkey.
5. Transfer of Personal Data
5.1 Domestic Transfer
Your personal data may be transferred to authorized public institutions and our service providers (hosting infrastructure, payment processor) within the framework of legal requirements.
5.2 International Transfer – Voice Services Processing
In our voice services, real-time voice processing is performed by AI models. In this context, voice data is temporarily processed through Google Cloud infrastructure (European region).
- This transfer is legally secured under Article 9 of KVKK through Standard Contractual Clauses.
- We have an Enterprise Agreement with Google Cloud. Under this agreement, transferred data cannot be used by Google for model training, advertising, or any other purpose.
- Voice data is not stored on Google Cloud servers after processing is completed.
- Transcript and analysis data generated from processing are stored on our servers in Turkey.
6. Data Retention Periods
| Data Type | Retention Period |
|---|---|
| Account information | As long as account is active + 30 days after closure |
| Call recordings and transcripts | 1 year (can be deleted earlier by user) |
| Invoice and payment records | 10 years (as required by tax legislation) |
| Access logs | 2 years (as required by Law No. 5651) |
| Temporary voice data (AI processing) | During processing (seconds to minutes) |
7. Data Security Measures
- Data storage with AES-256 encryption
- Transmission security with TLS 1.3
- Role-based access control
- Regular security audits and penetration tests
- Data breach response plan
8. Your Rights Under KVKK
Under Article 11 of KVKK, you have the following rights:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom data is transferred domestically or abroad
- Request correction if data is incomplete or incorrectly processed
- Request deletion or destruction under the conditions set forth in Article 7 of KVKK
- Request notification of correction, deletion, or destruction to third parties
- Object to any result arising from the analysis of processed data exclusively through automated systems that is against you
- Request compensation for damages caused by unlawful processing
9. Application Method
To exercise your rights above, you may submit a written application to [email protected]. Your application will be concluded free of charge within 30 days at the latest. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.