KVKK Information Notice

Effective date: October 28, 2026

Introduction

This notice is provided by Gloseva, as data controller, under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). It explains how we process the personal data of visitors to our website, account holders, prospective customers who contact us and persons who submit support requests.

This notice is neither a contract nor a consent form; it is sufficient that you read it. Where processing relies on your explicit consent (açık rıza), we ask for that consent separately, specifically for the processing concerned (for example, through the cookie preferences panel or a separate checkbox). Not giving consent does not prevent you from using the Service, and you may withdraw your consent at any time.

1. Data Controller

2. Personal Data We Process

  • Identity data — name and surname (account holders, prospective customers, persons submitting support requests).
  • Contact data — email address and, if you provide it, telephone number.
  • Professional data — company or organization name and your role, if you provide them.
  • Customer transaction data — plan, subscription status, billing cycle, credit and SMS usage, transaction IDs and country of billing received from Paddle. We do not receive or store full payment card numbers.
  • Transaction security data — IP address, device and browser information, session information, log records, hashed password, and the access credentials of the integrations you connect (such as channel access tokens or API keys).
  • Usage data — feature usage, Agent configurations, API calls and session activity in the dashboard.
  • Request and complaint data — the content of your support requests, emails and feedback.
  • Marketing data — your commercial electronic message consent status and, only if you allow it in the cookie preferences, the visit and measurement data collected through the Meta Pixel.
  • Legal transaction data — correspondence and records relating to disputes, refund and withdrawal requests.

Website visitors who are not signed in are mainly concerned by transaction security data and, if they consent, marketing data; prospective customers and persons submitting support requests by identity, contact, professional and request data. We do not intend to process special categories of personal data (KVKK Article 6) for our own purposes; please do not send us such data in support requests.

3. Purposes and Legal Bases

We process your personal data for the following purposes, each based on the legal basis indicated (KVKK Article 5):

  • Creating your account, authenticating you, providing the Service and managing your subscription and credits — identity, contact, customer transaction, transaction security and usage data — processing is directly related to the conclusion or performance of a contract (Article 5(2)(c)).
  • Tracking purchases and subscriptions made through Paddle and handling refund and withdrawal requests — customer transaction and legal transaction data — performance of a contract (Article 5(2)(c)) and compliance with our legal obligations (Article 5(2)(ç)).
  • Answering support requests and the enquiries of prospective customers — identity, contact, professional and request data — directly related to the conclusion or performance of a contract (Article 5(2)(c)) and our legitimate interest in answering enquiries, provided it does not harm your fundamental rights and freedoms (Article 5(2)(f)).
  • Sending necessary notices about the Service (security, billing and change notices) — contact data — performance of a contract (Article 5(2)(c)) and legal obligation (Article 5(2)(ç)).
  • Ensuring information security, preventing unauthorized access and abuse, keeping log records — transaction security data — legitimate interest (Article 5(2)(f)) and, where the legislation requires records to be kept, legal obligation (Article 5(2)(ç)).
  • Measuring and improving the performance of the Service, using aggregated or anonymized data wherever possible — usage and transaction security data — legitimate interest (Article 5(2)(f)).
  • Meeting legal obligations and responding to requests from authorized public bodies — relevant data categories — expressly provided for by law (Article 5(2)(a)) and legal obligation (Article 5(2)(ç)).
  • Establishing, exercising or defending legal claims — relevant data categories — Article 5(2)(e).
  • Non-essential cookies (analytics and personalization, including the Meta Pixel) used to measure visits and the effectiveness of our advertising — marketing and transaction security data — your explicit consent (Article 5(1)), given through the cookie preferences panel.
  • Sending marketing commercial electronic messages — contact and marketing data — your explicit consent (Article 5(1)) and your consent under Law No. 6563, obtained separately.

4. Methods of Collection

We collect personal data electronically, partly or wholly by automated means, through: the sign-up, contact and support forms on our website and dashboard; your use of the dashboard; cookies and similar technologies (non-essential ones only with your consent); email and other channels through which you contact us; Paddle, which shares limited billing data with us; and the integrations you connect.

5. Recipients

We may transfer your personal data, to the extent necessary for the purposes above and in accordance with KVKK Articles 8 and 9, to the following groups of recipients:

  • In Türkiye: authorized public institutions and bodies and judicial authorities, where required by law; professional advisers we work with, such as legal and financial advisers, where necessary; and service providers located in Türkiye, if any.
  • Abroad: Paddle (United Kingdom / United States), for payment processing as Merchant of Record; cloud hosting and infrastructure providers, for operating the Service; LLM providers (such as OpenAI, Anthropic and Google), for running the Service's AI features; email, SMS, telephony and notification infrastructure providers, for delivering messages and calls; and Meta, only if you have allowed non-essential cookies, for measuring visits and advertising.

6. Cross-Border Transfers

Because several of our service providers are located abroad, your personal data may be transferred outside Türkiye. Under KVKK Article 9 as amended by Law No. 7499 (in force since 1 June 2024), such transfers are carried out on the basis of one of the following conditions:

  • an adequacy decision of the Personal Data Protection Board ("Board") for the country, sector or international organization concerned, together with one of the processing conditions in Articles 5 and 6;
  • where there is no adequacy decision, appropriate safeguards such as a standard contract announced by the Board, binding corporate rules or a written undertaking authorized by the Board, provided that you can exercise your rights and have access to effective legal remedies in the country of destination;
  • where neither of the above is available, and only incidentally (not regularly), one of the cases listed in Article 9, such as your explicit consent given after being informed of the possible risks, or where the transfer is necessary for the performance of a contract between you and us.

You may contact us to ask which of these mechanisms applies to a particular transfer.

7. Retention and Destruction

We keep personal data only for as long as required by the relevant legislation or necessary for the purpose of processing:

  • Account data — while your account is active, plus 30 days after closure or a deletion request for technical processing.
  • Customer transaction and billing records — for the periods required by tax and commercial legislation (up to 10 years under Turkish Commercial Code Article 82 and Tax Procedure Law Article 253).
  • Usage, technical data and log records — up to 24 months, unless the legislation requires a longer period.
  • Support and communication data — 3 years.
  • Cookie data — for the periods stated in our Cookie Policy.
  • Commercial electronic message consents — until withdrawn, and thereafter for the period required by the legislation.
  • Data relating to disputes — until the dispute is concluded and the applicable limitation periods expire.

When the reasons for processing cease to exist, we delete, destroy or anonymize the data in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data, in the first periodic destruction following that date. Periodic destruction is carried out at intervals not exceeding six months.

8. Security and Data Breaches

Under KVKK Article 12, we take the technical and administrative measures needed to prevent unlawful processing of and access to personal data and to safeguard it. These include access authorization and access controls, encryption in transit (TLS), storing passwords in hashed form, log records, confidentiality obligations for persons with access to the data, and contractual obligations for our service providers.

If personal data are obtained by others unlawfully, we notify the Board without delay and within 72 hours at the latest of becoming aware of it, in line with the Board's decision on the procedures for data breach notification, and notify the affected persons as soon as reasonably possible after identifying them.

9. Your Rights under KVKK Article 11

By applying to us, you have the right to:

  • (a) learn whether your personal data are processed;
  • (b) request information about the processing if your personal data have been processed;
  • (c) learn the purpose of processing and whether the data are used in line with that purpose;
  • (ç) know the third parties in Türkiye or abroad to whom your personal data are transferred;
  • (d) request correction of your personal data if they are incomplete or inaccurately processed;
  • (e) request deletion or destruction of your personal data under the conditions set out in KVKK Article 7;
  • (f) request that the actions taken under (d) and (e) be notified to the third parties to whom your personal data have been transferred;
  • (g) object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems;
  • (ğ) claim compensation for damage you suffer due to unlawful processing of your personal data.

10. How to Apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application in Turkish:

  • in writing, with a signed petition, delivered by hand or by post to our address above;
  • by registered electronic mail (KEP), or signed with a secure electronic signature or mobile signature, sent to info@gloseva.com;
  • from the email address you previously notified to us and that is registered in our system, sent to info@gloseva.com.

Your application must include: your name and surname and, if the application is in writing, your signature; for citizens of the Republic of Türkiye, your T.R. identity number, and for foreigners, your nationality and passport number or identity number, if any; your residential or business address for notifications; your email address, telephone or fax number for notifications, if any; and the subject of your request. Please attach any relevant information and documents.

We will answer your request as soon as possible and within 30 days at the latest, depending on the nature of the request (KVKK Article 13). The answer is free of charge; however, if responding requires an additional cost, we may charge the fee set out in the tariff determined by the Board.

11. Complaint to the Board

If your application is rejected, you find our answer insufficient, or we do not answer in time, you may lodge a complaint with the Board within 30 days of learning of our answer and in any case within 60 days of the date of your application (KVKK Article 14). A complaint cannot be lodged before the application route to the data controller has been exhausted.

12. Where Gloseva Acts as Data Processor

Our customers use Gloseva to communicate with their own customers. For the data of those end users (calls and call recordings, transcripts, messages, contacts and appointment details), the business using Gloseva is the data controller and Gloseva processes the data on its behalf as data processor. This notice does not cover that processing. If you have contacted a business through a Gloseva-powered assistant, please address your requests to that business. If you contact us, we will forward your request to the business concerned.

13. Persons Under 18

The Service is not directed at persons under 18. We do not knowingly collect personal data from persons under 18; if we become aware of such data, we delete it.

14. Updates

We may update this notice when our processing activities or the legislation change. The current version is always published on this page together with its effective date.

15. Language

This notice is provided in Turkish and English. If the two versions conflict or differ in interpretation, the Turkish version prevails.

    KVKK Information Notice — GLOSEVA