KVKK Privacy Notice
Last updated: 28 September 2026 · Version 3.17
This is a courtesy translation; in case of conflict the Turkish version prevails. Turkish version: KVKK Aydınlatma Metni.
This privacy notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform you about the personal data processed by Sistemiya.
The Data Controller and Our Roles
Sistemiya processes personal data in two separate capacities:
- As data controller: Sistemiya is the data controller for the account, subscription and billing information of business representatives who sign up to Sistemiya and for the technical data of visitors to our website. This notice primarily informs these persons.
- As data processor: For the data of the own customers of businesses using the platform (clinics, accounting firms, law offices, etc.), the business concerned is the data controller; for this data Sistemiya is only a data processor acting on the business's instructions. Informing end users (for example, a clinic's patient) is the responsibility of the business concerned.
Identity of the Data Controller (KVKK Art. 10/1-a)
Sistemiya's legal identity details in its capacity as data controller are set out below:
Sistemiya's registered legal name and address are being updated; until they are published, please use destek@sistemiya.com for all requests, notices and service of documents.
| Item | Value |
|---|---|
| destek@sistemiya.com |
Contact: Sistemiya · destek@sistemiya.com · Türkiye
Personal Data We Process
The following data categories may be processed in connection with the business account and the provision of the service:
- Identity and contact: first name, last name, e-mail, telephone; tax/identity information where required for invoicing.
- Account and usage: user role, session records, panel preferences.
- Appointments and customer interaction: appointment date and service information, messaging content (WhatsApp, Instagram DM, Facebook Messenger / e-mail) and your page-scoped user ID on those channels.
- Payment: subscription amount and billing information. Card numbers never enter Sistemiya's servers; they are processed in the secure environment of the payment infrastructure provider.
- Technical data: IP address, session cookie, device/browser information, error and security logs.
- Partner program: the applicant partner's first name, last name, e-mail, telephone, company name; the approved partner's IBAN, tax office and tax/Turkish ID number (stored encrypted), commission and payment records.
Purposes of Processing and Legal Grounds
| Purpose | Legal ground (KVKK Art. 5) | Method of collection |
|---|---|---|
| Opening the account, appointment management, providing the service and the subscription | Necessity for the performance of a contract (Art. 5/2-c) | Sign-up and onboarding forms, use of the panel — by automated and partly automated means |
| Invoicing, tax and statutory record-keeping obligations | Legal obligation (Art. 5/2-ç) | Subscription and payment flow — by automated means |
| Service security, prevention of abuse and fraud | Legitimate interest (Art. 5/2-f) | Server and security logs — by automated means |
| Improving service quality through anonymous measurements | Legitimate interest (Art. 5/2-f) | Cookieless page counter on our own servers (no IP address stored) — by automated means |
| Optional promotional and informational messages | Explicit consent (Art. 5/1) | The promotional permission toggle under Ayarlar → KVKK (Settings → KVKK) in the panel, the opt-out link in messages — by partly automated means |
| Partner program: assessing the application, calculating and paying commission, invoice/expense voucher | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) | Partner application form and partner panel — by partly automated means |
| Informing the referring partner so that the commission of a business that signed up with a partner link or code can be calculated | Legitimate interest (Art. 5/2-f) | Sign-up form — by automated means |
| Building a list of potential customers from publicly available business listings to promote our service | Legitimate interest (Art. 5/2-f) | Google Maps listings (Google Places API) — by automated means; call notes — manually |
Processing based on explicit consent is optional and can be withdrawn at any time; for details see the Explicit Consent Text (in Turkish). For a plain-language summary of this notice and the security measures we take, see the Privacy and Security Policy.
Transfer of Data
To provide the service, personal data is transferred only to the extent necessary, and limited to the purposes below, to a limited number of data processors:
| Purpose | Recipient | Location |
|---|---|---|
| Server, database and file hosting | Hostinger | Germany (EU) |
| AI message processing and knowledge base | Primary AI provider: Anthropic (OpenAI if the main model is moved to OpenAI; OpenAI or Google through OpenRouter if it is moved to OpenRouter) | USA |
| Classifying the intent of a message (optional; only once activated — whether a reply is needed, request for a human, sensitive topic; it does not generate text, pseudonymised text is sent) | TypeSafe (through OpenRouter) | USA |
| Messaging infrastructure | Meta (WhatsApp, Instagram, Messenger) | EU |
| E-mail sending and receiving | Resend | USA |
| File hosting, bot verification and network gateway (traffic routing, TLS, DDoS protection) | Cloudflare | EU / global edge locations |
| Error and security monitoring | Sentry | EU |
| Voice assistant (optional; only if the business has enabled it): carrying the call, transcribing the conversation, voicing the reply | Twilio, Deepgram, Microsoft (Azure; ElevenLabs if selected) | USA / EU |
| iOS app push notifications (optional; only when notifications are turned on) | Apple (APNs) | USA |
| Payment | PayTR | Türkiye |
| Enterprise single sign-on (optional) | Google, Microsoft | USA / EU |
| Writing appointments to the staff calendar (optional; if the business has connected its calendar — service, customer name, branch, customer e-mail if any) | Google, Microsoft | USA / EU |
| Reading and replying from the connected mailbox (optional) | Google (Gmail API), Microsoft (Graph) | USA / EU |
| Partner program commission calculation (only if you signed up with a partner link or code: business name, whether you subscribed, commission amount; your contact, payment and customer data are not given) | The partner who referred you | Türkiye |
For the full list of recipients, processing purposes and legal safeguards, see the Sub-processor List.
Use of Artificial Intelligence
Sistemiya's core function is to have customer messages sent to businesses answered by an AI-powered assistant. This section explains how that processing works.
You are told that you are interacting with AI. When you write via WhatsApp, Instagram DM or Messenger, at the first contact and in the first reply after a gap of more than 30 days, it is stated clearly that you are talking to an AI assistant. This notice is added by the software independently of the instructions that steer the assistant's behaviour; it cannot be turned off by the business.
You can ask to be handed over to a human. If you say during the conversation that you want to speak to a representative, your request is passed to the business and the assistant stops replying in that conversation. You are not obliged to communicate with AI.
Data processed and purpose:
| Topic | Explanation |
|---|---|
| Data transferred | The content of conversation messages, appointment information (date, service) and the knowledge base content uploaded by the business |
| Purpose of transfer | Understanding the message, creating/changing/cancelling appointments and answering customer questions |
| Service provider | Primary AI provider — Anthropic (USA); OpenAI (USA) if the main model is moved to OpenAI; OpenAI or Google (USA) through OpenRouter (USA) if it is moved to OpenRouter. Language model; knowledge base search is performed on our own servers |
| Legal ground | Necessity for the performance of a contract (Art. 5/2-c); in the relationship between the business and its customer, determining the legal ground is the responsibility of the business concerned |
| Transfer abroad | Yes — subject to the "Transfers Abroad" section below |
AI output is not a final decision. The assistant creates, changes and cancels appointments within the working hours and service definitions set by the business. No assessment, profiling or scoring is carried out that has legal effects on you or significantly affects you. If you believe a result against you has arisen from analysis carried out exclusively by automated systems, your right to object under KVKK Article 11 is reserved.
Model training. Conversation content is sent to the language model provider in order to provide the service. Sistemiya does not use this data to train its own AI models.
Pseudonymisation. In the text sent to the language model provider, your name, telephone number, e-mail address, Turkish ID number and IBAN/card number are replaced with placeholders; the mapping that makes re-identification possible stays only in our own database (Frankfurt, Germany) and is not given to the provider. The provider therefore cannot link the content it receives to you. This is not anonymisation: because we hold the mapping, the data remains personal data and this transfer falls under KVKK Article 9 — the procedure in the "Transfers Abroad" section below applies in full. In free text you write, names of third parties or numbers written out in words may not be converted into placeholders.
Human takeover. A business employee can take over a conversation from the assistant and write to you directly; during that time the assistant temporarily does not reply.
Retention. Message content is deleted at the end of the period given in the "Retention Periods" table below; your contact record (name, number) is kept for the duration of the relationship and de-identified 24 months after the last contact.
Where Data Is Hosted
Sistemiya's application servers, database and file storage are hosted in the European Union (Frankfurt, Germany). Payments are processed on the infrastructure of a payment institution in Türkiye.
This means that the data is kept abroad, not in Türkiye, and is subject to the transfer-abroad regime below. This is stated expressly to avoid any misleading statement about location.
Transfers Abroad
Article 9 of Law No. 6698, as amended by Law No. 7499, sets out a three-step order for transferring personal data abroad:
- Adequacy decision (Art. 9/1) — transfer to a country, sector or international organisation that the Board has declared to have adequate protection.
- Appropriate safeguards (Art. 9/2) — where there is no adequacy decision; a standard contract between the parties, binding corporate rules, a Board-approved written undertaking or an agreement in the nature of an international agreement.
- Incidental cases (Art. 9/6) — only one-off situations that are not recurring.
Sistemiya's transfers (hosting, AI processing, messaging infrastructure, e-mail sending, error monitoring and optional enterprise SSO) are regular and continuous; therefore the incidental-case exception is not relied on. These transfers will be based on the appropriate safeguards under KVKK Art. 9/2; the signing process for the standard contracts published by the Board is under way.
Under the fifth paragraph of Article 9 of the Law, each signed standard contract is notified to the Personal Data Protection Authority within the period set by the legislation from the date of signature.
Payment data is processed in Türkiye; no transfer abroad takes place in this respect.
Retention Periods
| Data | Retention period |
|---|---|
| Account records | For the duration of the relationship; when the account is deleted, destroyed irreversibly at the end of the waiting period |
| Appointment records | At most 2 years from the appointment date; deleted afterwards |
| Messaging content | The period chosen by the business, at most 12 months (default 12 months); afterwards the message content is deleted and the contact record is kept for the duration of the relationship |
| Photos and documents sent | The same period as messaging content, at most 12 months; the file is deleted afterwards |
| AI conversation memory | The period chosen by the business (30–365 days, default 90 days); does not exceed the messaging content period, deleted afterwards |
| Copy of messages in a connected e-mail mailbox | The period chosen by the business for the mailbox, at most 12 months (default 12 months); afterwards the copy in Sistemiya and its attachments are deleted, the original message remains with the business's e-mail provider |
| Contact record (name, number, channel ID) | For the duration of the relationship; de-identified 24 months after the last contact |
| Demo request and resource centre form records | 2 years; deleted afterwards |
| Switchboard call records (caller number, duration; no audio recording is kept) | 6 months; deleted afterwards |
| Approval queue drafts (replies left for the business's approval) | Deleted 90 days after being handled |
| Win-back message log (to whom, for which service, when) | 24 months; deleted afterwards |
| Potential customer business record | Name, address, telephone and website obtained from Google for at most 30 days; call notes 12 months; deleted immediately on objection |
| Server access logs (IP address, time, requested address without query parameters, response code, browser information) | Kept in the web and application server log; when the log file reaches 30 MB per service the oldest entries are deleted, it is not archived separately |
| Destruction and audit records | At least 3 years as required by the Regulation; not destroyed automatically |
| Application error logs | At most 90 days |
| Invoices and financial records | The period required by tax legislation |
Except for destruction and audit records, data is deleted, destroyed or anonymised when its period expires; destruction and audit records are kept for at least 3 years as required by the Regulation.
Potential Customer Businesses
To promote its service, Sistemiya uses business listings published publicly on Google Maps (business name, address, telephone number, website). For sole proprietorships this information may count as the owner's personal data; this section informs them.
- Purpose and legal ground: presenting our service to the business representative and arranging a first call; legitimate interest (Art. 5/2-f).
- Method of collection: by automated means through the Google Places API; call notes manually by the sales team.
- Transfer: the data is used only by Sistemiya's sales team; the data is obtained from Google (USA) and is not shared with anyone else.
- Retention: information obtained from Google is kept for at most 30 days and deleted automatically when the period expires; call notes are deleted after 12 months.
- Objection: at the first contact you are directed to this notice. If you object at destek@sistemiya.com or during the call, your contact details and call notes are deleted; so that you are not called again, only the Google place ID is kept with a "do not call" flag.
Your Rights (KVKK Article 11)
As a data subject you have the following rights:
- To learn whether your personal data is processed and to request information about it.
- To learn the purpose of processing and whether it is used in line with that purpose.
- To know the third parties to whom the data is transferred in Türkiye or abroad.
- To request correction of incomplete or incorrectly processed data.
- To request deletion or destruction of the data within the framework of the statutory conditions.
- To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred.
- To object to a result against you arising from analysis of the processed data exclusively by automated systems.
- To claim compensation for damage you suffer due to unlawful processing of the data.
Self-service: You can manage the data of your business account yourself from Ayarlar → KVKK (Settings → KVKK) in the panel. With "Verilerimi indir" ("Download my data") you can obtain all your data in machine-readable form, and with "Verilerimi sil" ("Delete my data") you can start a deletion request; the deletion completes irreversibly at the end of the waiting period.
Applications and Contact
You can send your requests to destek@sistemiya.com. Applications are concluded within 30 days at the latest. Your application must include information that proves your identity.
For the full list of application channels, the mandatory information your application must contain and a printable application form, see the Data Subject Request page.
If your application is rejected, found insufficient or not answered in time, you may lodge a complaint with the Board within 30 days of learning of this and in any case within 60 days of the application date. Applying to the data controller is mandatory before complaining to the Board.