KVKK Privacy Notice

This Privacy Notice has been prepared to fulfill the disclosure obligation under Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK"). BotFront ("BotFront" or the "Platform") is a third-party integration and SaaS (Software as a Service) solution that integrates companies' e-commerce stores (Shopify or PlatinMarket) and Meta WhatsApp Business numbers to provide end users/customers with stock and order assistance over WhatsApp. The first module offered is "Stokçu".

BotFront assumes two distinct roles in its personal data processing activities. Understanding the capacity in which BotFront acts within each data flow is of great importance in determining which party you should exercise your rights against:

Flow 1 — Customer-Company Data (BotFront = Data Controller)

With respect to data belonging to the company (customer) that purchases the service (administrator login email, subscription and billing information, integration credentials), BotFront acts in the capacity of "data controller" and is itself responsible for the disclosure obligation relating to this flow.

Flow 2 — End-Customer Data (Company = Data Controller, BotFront = Data Processor)

With respect to personal data of end customers that the company transfers into the system (WhatsApp phone number, message content, full name, order information, product and stock data), the data controller is the relevant company; BotFront acts solely in the capacity of "data processor" in accordance with the company's written/documented instructions.

The disclosure obligation within the scope of Flow 2 (end-customer data) belongs directly to the relevant company in its capacity as data controller. In this flow, BotFront merely provides the company with the technical details regarding data transfer and storage processes; the obligation to inform end customers rests entirely with the company.

Within the scope of Flow 1, the data controller is the party operating the BotFront Platform whose details are set out below (KVKK Art. 10/1-a):

Operator

Lumio Studio (BotFront)

Website

https://botfront.com.tr

Email

contact@lumiostudio.co

Flow 1 — Customer and Company Data (data processed by BotFront in its capacity as data controller):

• Identity and Contact Data: The full name of the company representative, login and contact email addresses.
• Customer Transaction and Financial Data: Subscription status, purchased modules, billing and payment information (via Polar).
• Integration and Access Information: Shopify/PlatinMarket store address, API access keys, Meta WhatsApp Business number and phoneNumberId (sensitive authentication information is stored only server-side, in secure environment variables).
• Transaction Security Data: Session cookies, IP address, system access and transaction records (logs).

Flow 2 — End-Customer Data (data stored by BotFront in PostgreSQL in its capacity as data processor in accordance with the company's instructions):

• Identity and Contact Data: The end customer's WhatsApp phone number and full name.
• Customer Transaction Data: Order information, product and stock data, and the append-only stock movement history.
• Transaction Content Data: WhatsApp chat history, message content, processed message records, and derived tenant configuration snapshots.

Every data query is isolated on a tenant (tenant/company) basis, and companies are technically prevented from accessing each other's data. The stock movement history is append-only in nature; no UPDATE operation is performed on existing records.

• Establishing the service agreement, conducting subscription processes, bot assignment, and managing user accounts (Flow 1).
• Setting up, configuring, and synchronizing e-commerce store and WhatsApp integrations (Flow 1).
• Tracking and conducting billing, subscription, and payment processes (Flow 1).
• Responding to stock and order questions submitted by end customers over WhatsApp by performing intent classification (Flow 2 — in accordance with the company's instructions).
• Recording, verifying, and storing stock movements in a reversible (CORRECTION) manner (Flow 2).
• Ensuring service security and information security, preventing misuse, and fulfilling legal obligations (both flows).

Your personal data is processed based on the legal grounds set out in KVKK Art. 5/2 and listed below; where these grounds do not exist, your explicit consent is sought pursuant to KVKK Art. 5/1:

• Being directly related to the establishment or performance of a contract (Art. 5/2-c): Concluding and performing subscription and service agreements.
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2-ç): Fulfilling obligations arising from billing, accounting, and tax legislation.
• Being mandatory for the establishment, exercise, or protection of a right (Art. 5/2-e): Keeping audit trails and log records to serve as evidence in potential disputes.
• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f): Ensuring service security, monitoring system performance, and preventing misuse.
• Within the scope of Flow 2, BotFront, in its capacity as data processor, conducts data processing activities in accordance with the written instructions of the company, which is the data controller, based on the legal grounds set out above.

The processing of special categories of personal data (KVKK Art. 6) is not within the scope of the services offered by BotFront, and such data is not requested. Companies and users must not transfer data of this nature into the system.

In order to provide the offered services in an uninterrupted and secure manner, your personal data is transferred to the sub-processors (third-party service providers) listed below, in a manner limited and proportionate to the processing purpose only. Since some of these providers' servers are located abroad (in particular in the United States), such transfers constitute transfers abroad within the scope of KVKK Art. 9:

Anthropic (Claude LLM — USA)

Processing of message content via artificial intelligence models for the purpose of intent classification. Transfer abroad.

Google Firebase / Google Cloud (USA/EU)

Provision of authentication, authorization, configuration management, and server hosting (GCP virtual machines) services. Transfer abroad.

Vercel (USA)

Hosting and serving of the management panel (dashboard). Transfer abroad.

Meta / WhatsApp Business API (USA)

Provision of the WhatsApp message delivery infrastructure. Transfer abroad.

Polar (Billing)

Management of subscription, billing, and payment processes. May involve transfer abroad.

Legal basis for transfers abroad (under the new regime following the amendment to KVKK Art. 9 that entered into force on 10.07.2024): Given the nature of continuous SaaS services, explicit consent is not positioned as the primary basis on its own for these transfers. Transfers are based, in a tiered manner, on the following legal safeguards pursuant to KVKK Art. 9: (i) the existence of an adequacy decision announced by the Personal Data Protection Board (the “Board”); (ii) in the absence of an adequacy decision, the provision of the appropriate safeguards stipulated by law (including the Standard Contract announced by the Board); (iii) where such safeguards cannot be provided, the existence of the incidental (one-off/temporary) transfer exceptions stipulated in Art. 9.

Within the scope of Flow 2, transfers to these recipients are carried out in accordance with the instructions of the company, which is the data controller, and on its behalf. BotFront positions these service providers as sub-processors committing to the same data security standards and submits them for the company's approval.

• Directly, through the company representative creating an account via the management panel (botfront.com.tr), logging in via an email verification link, and completing the integration forms (Flow 1).
• Through the automatic synchronization of product and stock data from the integrated e-commerce store (Shopify/PlatinMarket) via the API channel (Flow 2).
• Through the automatic receipt of end-customer messages delivered via the Meta WhatsApp Business API by means of a webhook (data transfer mechanism) (Flow 2).
• By means of session, log (system log), and cookie data recorded through automatic methods during the use of the Platform.

• Customer and company account/subscription data: Retained for as long as the service relationship continues and, following the termination of the agreement, for the statute of limitations periods stipulated in the relevant legislation.
• Billing and financial records: Retained for a minimum of 10 years pursuant to the Turkish Commercial Code and the Tax Procedure Law.
• End-customer chat/message data and stock movement history: Retained in accordance with the written instructions and retention policies of the company as data controller; upon the company's request when the service relationship ends, it is deleted, destroyed, or returned.
• Log and transaction security records: Retained for the legal periods determined in accordance with information security requirements and the relevant legislation.

When the purposes requiring the processing of personal data cease to exist and the legal retention periods expire, the data is deleted, destroyed, or anonymized pursuant to KVKK Art. 7 and the relevant regulations.

Pursuant to Article 11 of the KVKK, as a personal data owner (data subject), you may exercise the following rights by applying to BotFront:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request the correction of personal data in the event that it is processed incompletely or inaccurately,
• To request the deletion or destruction of personal data within the framework of the conditions stipulated in KVKK Art. 7,
• To request that the correction, deletion, or destruction operations be notified to the third parties to whom the data has been transferred,
• To object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
• To request the compensation of damages in the event that you suffer damage due to the unlawful processing of personal data.

Requests within the scope of Flow 2 (end-customer data) must be directed directly to the relevant company in its capacity as data controller. BotFront, in its capacity as data processor, will forward such requests received by it to the relevant company without delay and will provide technical support for the company to conclude the request.

You may submit your requests to exercise the rights set out above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with documents verifying your identity, through the following channels:

Email

contact@lumiostudio.co

Web

https://botfront.com.tr

Your applications will be concluded free of charge as soon as possible and within no more than 30 (thirty) days, depending on the nature of your request. However, if the operation requires an additional cost, the fee set out in the tariff determined by the Board may be charged. In the event that your application is rejected, the response provided is found insufficient, or no response is given within the time limit, you reserve the right to file a complaint with the Board.