KVKK Privacy Notice
Data protection notice under Law No. 6698 (KVKK)
1. Introduction and Scope
Pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform published by the Personal Data Protection Board, this KVKK Privacy Notice (“Privacy Notice”) has been prepared to inform individuals who use the Kynic Agent platform, website (kynicagent.com), applications, and artificial intelligence-powered customer communication services.
For more comprehensive information about how Kynic Agent generally processes personal data and its privacy principles, please refer to the Privacy Policy, and for data processing principles between businesses, please refer to the Data Processing Agreement and the Subprocessors List.
2. Data Controller and Contact Information
The information of the entity acting as the Data Controller under the KVKK with respect to your personal data processed in accordance with the legislation of the Republic of Türkiye is provided below:
- Trade Name / Business Name: Muhammed Eren Akbaş – Kynic Agent
- Tax Office and Number: Küçükköy Tax Office / Tax Identification Number: 0151249191
- Address: Istanbul, Türkiye
- Email Address: contact@kynicagent.com
- Website: kynicagent.com
- VERBIS Registration: Pursuant to the decisions of the Personal Data Protection Board, the Data Controller is exempt from the obligation to register with the Data Controllers Registry (VERBIS) within the framework of the statutory annual employee count and financial balance sheet exemption criteria.
3. Scope and Categories of Data Subjects
This Privacy Notice covers the following categories of Data Subjects whose personal data is processed within the scope of Kynic Agent systems and services:
- Business Customers and Authorized Representatives (“Customer”): Business owners, company officers, representatives, and employees who register on the Kynic Agent platform, purchase platform services, and use the dashboard and integrations.
- End Users: Natural persons with whom our Customers communicate, exchange messages, or create appointments/orders through the Kynic Agent platform (WhatsApp, Instagram, Web Chatbot, etc.). (Note: With respect to End User data, the Customer is the primary Data Controller; Kynic Agent acts as the Data Processor).
- Site Visitors: Users who visit kynicagent.com and its subdomains.
- Business Partners, Supplier and Service Provider Representatives: Authorized representatives and employees of third parties that have a commercial or contractual relationship with Kynic Agent.
- Employees and Job Applicants: Employees working for Kynic Agent and candidates applying for employment.
4. Categories of Personal Data Processed and Collection Methods
Your personal data is collected through our website, platform dashboard, WhatsApp/Instagram integrations, APIs, contact forms, support channels, and contractual processes by automated, partially automated, or non-automated means.
The categories of data collected are as follows:
| Data Category | Description and Scope |
|---|---|
| Identity Information | First name, last name, title, Turkish National ID Number (TCKN)/Tax Identification Number (VKN) (for invoicing). |
| Contact Information | Email address, telephone number, address, messaging account ID information. |
| Customer Transaction & Profile Information | Company/business name, avatar/profile picture, account preferences, support requests, transaction history. |
| Integration & Access Tokens | Google Calendar OAuth tokens, Instagram/Meta access tokens, API keys. |
| Financial and Billing Information | Billing address, tax office/number, payment history.(Credit card information is not stored by Kynic Agent; it is processed by iyzico, a PCI-DSS-compliant payment infrastructure provider). |
| Transaction Security and Technical Data | IP address, port information, browser/device type, operating system, access times, login/logout records, logs, and cookies. |
| End User Chat Data | Chat message contents, appointment/reservation/order data exchanged by the Customer with End Users through the Services.(This data is processed on behalf of the Customer in the capacity of Data Processor). |
| Marketing & Analytics Data | Cookie records, site usage preferences, campaign interaction data. |
| Legal Transaction Data | Official correspondence, requests from administrative and judicial authorities, contractual records. |
5. Purposes and Legal Bases for Processing Personal Data
Your personal data is processed based on the following legal grounds specified under Articles 5 and 6 of the KVKK:
a) Establishment or Performance of a Contract (KVKK Art. 5/2-c)
- Provision of the Kynic Agent SaaS platform services, membership, and account management.
- Operation of the artificial intelligence-powered customer representative (chatbot) infrastructure.
- Provision of integrations (Google Calendar, Instagram, WhatsApp, etc.) and technical support.
- Responding to End User messages and operating automation workflows in accordance with the Customer’s instructions.
b) Compliance with Legal Obligations (KVKK Art. 5/2-ç)
- Carrying out payment and invoicing processes and retaining commercial books and invoice records (Turkish Commercial Code, Tax Procedure Law).
- Retaining system access logs and transaction security data pursuant to Law No. 5651 and applicable legislation.
- Responding to legal requests from authorized public institutions and judicial authorities.
c) Legitimate Interest of the Data Controller (KVKK Art. 5/2-f)
- Ensuring platform security, information security, and network continuity.
- Improving service quality, performance, and user experience.
- Customer relationship management and the evaluation and resolution of requests and complaints.
d) Establishment, Exercise, or Protection of a Right (KVKK Art. 5/2-e)
- Fulfilling evidentiary obligations in potential legal disputes and conducting litigation and enforcement proceedings.
e) Explicit Consent (KVKK Art. 5/1)
- Marketing, sending commercial electronic communications, optional cookies, and specific circumstances requiring explicit consent.
6. Third Parties to Whom Personal Data Is Transferred and Purposes of Transfer
Your personal data may be transferred, in accordance with Articles 8 and 9 of the KVKK, to the following categories of recipients and authorized institutions for the uninterrupted provision of services, technical infrastructure requirements, and compliance with legal obligations:
| Recipient Group / Subprocessor | Function and Purpose of Transfer | Location / Transfer Type |
|---|---|---|
| OpenAI / Anthropic / Google (AI LLM API) | Artificial intelligence response generation (Stateless LLM API) | International (USA / EU) |
| Meta (Instagram & WhatsApp API) | Instagram DM and WhatsApp messaging integration | International (USA) |
| Gupshup / Evolution API | WhatsApp Business API gateway infrastructure | International / EU |
| iyzico (İyzi Ödeme ve Teknolojileri A.Ş.) | PCI-DSS-compliant payment collection and billing | Domestic (Türkiye) |
| Authorized Public Institutions and Organizations | Courts, enforcement offices, regulatory authorities as required by law | Domestic (Türkiye) |
In the event of a change to the Subprocessors List, the updated list will be published on the Subprocessors List page, and Customers will be notified in advance in accordance with the provisions of the DPA.
7. Principles Regarding International Data Transfers (KVKK Article 9)
Some artificial intelligence providers (OpenAI, Anthropic, Google Gemini) and messaging providers (Meta, Gupshup) used within the Kynic Agent platform have servers located outside Türkiye.
The international transfer of your personal data is carried out based on the following safeguards in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad:
- It is checked whether an Adequacy Decision has been issued by the Board.
- Where no adequacy decision exists, appropriate safeguards are provided by entering into Standard Contracts (Standard Contractual Clauses - SCCs) or undertakings published by the Personal Data Protection Board.
- Where necessary and required by applicable legislation, Explicit Consent is obtained from Data Subjects.
Your rights under Article 11 of the KVKK remain fully applicable with respect to your personal data transferred abroad.
8. Special Categories of Personal Data and Automated PII Masking
The Kynic Agent platform is not designed, as a rule, for the processing of special categories of personal data (health data, biometric data, religious/political beliefs, etc.). Customers are prohibited from collecting such data from End Users pursuant to the Terms of Service (Article 7 - Acceptable Use).
Technical Safeguard (Automated PII Masking Layer): Before chat and message data is transmitted to external artificial intelligence services (OpenAI, Gemini, etc.), high-risk data such as identification numbers, credit card numbers, and telephone numbers that can be detected by the system is automatically masked through the PII (Personally Identifiable Information) Masking Layer. This technical measure minimizes the risk of processing special categories of personal data, and its details are regulated in the DPA document.
9. Data Retention, Deletion, and Destruction Periods
Your personal data is retained for the period required by the purposes of processing and in accordance with the statutory retention periods prescribed under applicable legislation.
| Data Type / Category | Retention Period | Legal Basis / Explanation |
|---|---|---|
| Customer Account and Profile Data | As long as the membership account remains active + 10 years | Service performance and retention obligations under the Turkish Commercial Code |
| Invoice and Financial Records | 10 Years | Turkish Commercial Code and Tax Procedure Law |
| Transaction Security and Access Logs | 2 Years | Mandatory log retention pursuant to Law No. 5651 |
| End User Chat Records | At the Customer’s discretion (Standard: 30-90 Days) | Customer instructions and DPA retention rules |
| Support and Communication Requests | 3 Years | Legitimate interest and dispute management |
Personal data for which the retention period has expired or the purpose of processing has ceased will be deleted, destroyed, or anonymized in accordance with our Data Retention and Destruction Policy and applicable KVKK legislation.
10. Processing by Automated Systems and Right to Object
Within the scope of our Services, End User messages may be automatically responded to by artificial intelligence models. This processing activity does not, by itself, constitute a decision based exclusively on automated processing that produces legal effects concerning the Data Subject or significantly affects the Data Subject in a similar manner. Our Customers may provide manual human intervention at any stage. Data Subjects may exercise their right to object to automated analysis.
11. Rights of the Data Subject (KVKK Article 11)
Pursuant to Article 11 of the KVKK, as the Data Subject, you have the following rights:
- To learn whether your personal data is being processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether it is used in accordance with such purpose,
- To know the third parties to whom your personal data is transferred domestically or abroad,
- To request the correction of your personal data if it has been processed incompletely or inaccurately,
- To request the deletion or destruction of your personal data within the conditions stipulated under Article 7 of the KVKK,
- To request that correction, deletion, or destruction operations be notified to third parties to whom the data has been transferred,
- To object to the occurrence of a result to your detriment arising from the analysis of processed data exclusively through automated systems,
- To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.
Important Note (For End Users): If you are an End User of a business (Customer) using the Kynic Agent platform, the Data Controller with respect to your chat data is the Customer from whom you receive services. You must submit your requests regarding the exercise of your rights directly to the relevant business from which you receive services.
12. Application Procedure and Contact
To exercise the rights specified above, you may submit your requests through the following channels in accordance with the provisions of the Communiqué on the Procedures and Principles of Application to the Data Controller:
- Application by Email: You may submit an application from the email address registered in our system to contact@kynicagent.com.
- Written Application: You may submit a written and wet-ink signed petition to our company address together with documents verifying your identity.
Your application must clearly specify your full name, TCKN/Passport No., address for notification purposes, email address, and the subject of your request. Your requests will be concluded free of charge as soon as possible and, in any event, within 30 (thirty) days at the latest, depending on their nature.
13. Updates and Effective Date
This Privacy Notice may be updated in accordance with changes in legislation, decisions of the Personal Data Protection Board, VERBIS updates, or technological developments in Kynic Agent services. The current version of this Privacy Notice shall become effective on the date it is published at kynicagent.com/legal/kvkk.