KVKK Disclosure Notice

This Disclosure Notice is prepared under Art. 10 of Turkey’s Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation, for the business users of the osdosistan service provided by OSDO Arge, their representatives, and persons who contact us through our website.

If you are an end-customer of a business using the service (that is, you messaged a business’s WhatsApp line), the controller for that data is the business concerned; OSDO Arge acts as a processor. The disclosure notice to be provided to you is published by the business you interact with.

Data Controller / Service Provider

• Legal entity: OSDO Arge Yazılım Sanayi ve Ticaret Limited Şirketi
• Product: osdosistan · Web: osdoarge.com
• Address: Yalı Mah. 6523 Sk. No:32 CB, 35550 Karşıyaka/İzmir
• Registered e-mail (KEP): osdo.arge@hs01.kep.tr
• KVKK / contact e-mail: info@osdoarge.com
• MERSIS/Tax: MERSİS: 0648181278400001 · Vergi No: 6481812784 (Çiğli VD)

1. Categories of Personal Data

2. Purposes of Processing

• Providing the service, carrying out setup and managing contractual processes.
• Customer relations, support and handling of requests/complaints.
• Answering the demo, pricing, setup and other questions you send through the contact form on our website, and getting back to you.
• Billing, collection and fulfilment of financial obligations.
• Information security, abuse prevention and access rights management.
• Conducting activities in compliance with legislation and informing authorized bodies.
• Follow-up of legal affairs, storage and archiving.
• Only where you give explicit consent: sending promotional, campaign and marketing messages.

3. Method of Collection and Legal Bases (Art. 5)

Your personal data is collected by wholly or partly automated means through the e-mails you send us, the contact form on our website, onboarding conversations, the account you create in the business panel and the knowledge-base content you enter, requests sent via the manager channel, connection information generated when you visit our website, and system records generated during use of the service.

Your data is processed on the following legal grounds:

• Art. 5/2-c — Directly related to the conclusion or performance of a contract.
• Art. 5/2-ç — Necessary for compliance with our legal obligations.
• Art. 5/2-e — Necessary for the establishment, exercise or protection of a right.
• Art. 5/2-f — Necessary for our legitimate interests, provided your fundamental rights are not harmed.
• Art. 5/1 explicit consent — Only for marketing and promotional messages. Consent is not a precondition of the service and may be withdrawn at any time.

The information you send through the contact form is processed on the legal ground of Art. 5/2-c where your request concerns entering into a service contract, and otherwise Art. 5/2-f; your explicit consent is not requested for this processing. The box on the form only lets you indicate that you have read this notice.

The disclosure obligation and the obtaining of explicit consent are fulfilled separately.

4. Transfers (Art. 8) and International Transfers (Art. 9)

Your personal data may be transferred to the following recipients, limited to the purposes above:

In addition, when you visit our website your IP address is processed on our server in Türkiye so the page can be delivered. The information you enter in the contact form is stored on our server in Türkiye and is not transferred abroad. Transfers may be made to legally authorized public authorities upon request and to advisers such as accountants and lawyers, only to the extent required by law. The current list is published on the Sub-processor List page.

Among the recipients above, OpenAI, TypeSafe, Meta and Telegram, and Netlify, the hosting provider of our website, are established abroad, so those transfers fall under KVKK Art. 9. To place them on a legal basis compliant with Art. 9, the process of signing the Board’s Standard Contract and notifying the Board is being carried out; the basis in force is updated once it is completed. The primary database and storage are in Türkiye; transfers abroad are limited to the minimum data required for the service to function.

5. Transparency on AI Use

The assistant runs on generative AI (a large language model) and clearly tells the person it is talking to that it is an AI. The assistant’s next step is chosen by a separate classification model (decision layer) that does not write reply text. The knowledge-base content and Business Rules that business users enter in the panel are sent to the language-model provider with every end-customer message so that the assistant can write its replies; personal data should not be written into these fields unless necessary. No fully automated decisions producing legal or similarly significant effects are made. Data processed within the service is not used by us for model training. This section was prepared taking into account the Authority’s Guide on Generative AI and the Protection of Personal Data dated 24.11.2025.

6. Retention

Your data is retained for as long as the processing purpose requires and for the minimum periods prescribed by law. Periods by data category are published in the table in Section 9 of the Privacy Policy. On expiry, data is deleted, destroyed or anonymized under Art. 7 of the KVKK; periodic destruction runs at intervals of no more than six months.

7. Your Rights (KVKK Art. 11)

You have the rights to learn whether your personal data is processed; request information if it is; learn the purpose and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request correction if it is incomplete or incorrect; request deletion or destruction under Art. 7; request that correction, deletion and destruction be notified to transferees; object to an adverse result arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

8. How to Apply

Applications must follow the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application must contain your Turkish ID number (for Turkish citizens) or nationality, passport number or ID number (for foreign nationals); your residence or business address for service of notice; your e-mail, phone or fax number if any; and the subject of your request.

You may submit it (a) in writing with a wet signature to Yalı Mah. 6523 Sk. No:32 CB, 35550 Karşıyaka/İzmir in person, via notary or by registered mail with return receipt, (b) to our registered e-mail address osdo.arge@hs01.kep.tr, (c) using a secure electronic signature or mobile signature, or (d) from an e-mail address you have previously notified to us and which is registered in our system, to info@osdoarge.com.

For the ready-made form and detailed procedure: Data Subject Application Form and Procedure.

Your application is concluded free of charge as soon as possible and within thirty days at the latest. Where the process incurs an additional cost, the fee in the Communiqué’s tariff may be charged: no fee for the first ten pages of a written reply, 1 TRY per page thereafter; where the reply is given on a recording medium such as a CD or flash drive, a fee not exceeding the cost of that medium may be charged.

We may request information to verify that the applicant is the data subject and ask questions to clarify the request. To apply on behalf of another person, a notarized special power of attorney issued in the applicant’s name is required.

Under KVKK Art. 14, if your application is rejected, the reply is found insufficient, or no reply is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the reply and in any case within sixty days of the application date.

9. Effect

This notice follows a layered disclosure approach and should be read together with the short notices provided at relevant points of the service. Effective date: 22.09.2026. In case of conflict between the Turkish and English versions, the Turkish text prevails.