1. Introduction
This Privacy Policy explains how personal data of our users and visitors is collected, used, stored, shared, and protected within the scope of the services provided by the Convord platform ("Platform"). This policy has been prepared in compliance with the Personal Data Protection Law No. 6698 ("KVKK"), the European Union General Data Protection Regulation ("GDPR"), and other applicable legislation.
By using our Platform or accessing our services, you are deemed to have accepted the terms set forth in this Privacy Policy. If you do not accept our policy, please do not use the Platform.
2. Data Controller
The entity acting as the data controller with respect to your personal data:
- Company Owner: Fatih Öztürk
- Trade Name: Convord.com
- Address: Şeyhmüftü Mahallesi, Çarıkçılar Çarşısı Sokak No:2 İç Kapı No:2, Mustafakemalpaşa/Bursa
- Phone: +90 XXX XXX XX XX
- Email: kvkk@convord.com
- Website: https://convord.com
3. Personal Data Collected
The following categories of personal data are collected through the Platform:
3.1. Identity Information
- First name, last name
- Turkish National ID Number (solely for e-invoice transactions, on business accounts)
- Company name and tax identification number
3.2. Contact Information
- Email address
- Phone number
- WhatsApp number
- Business address
3.3. Account and Financial Information
- Username and password (stored in encrypted form)
- Subscription plan and payment history
- Billing information (tax office, tax identification number)
- Payment method information (card details are stored directly with the payment provider and are not retained by us)
3.4. Order and Transaction Information
- Order messages and their contents received via WhatsApp
- Order details (product names, quantities, prices)
- Customer information (information belonging to the business's own customers)
- Product catalog information
- Invoice and delivery note data
3.5. Technical and Usage Information
- IP address
- Browser type and version
- Operating system information
- Access dates and times
- Page view data
- Cookie data
- Device identifiers
- Session durations
3.6. Voice Message Data
- Voice message files sent via WhatsApp
- Transcribed versions of voice messages
4. Methods of Collecting Personal Data
Your personal data is collected through the following methods:
- Directly from you: Through registration forms, profile updates, support requests, and contact forms
- Automatically: Through cookies, server logs, and analytics tools during Platform use
- WhatsApp Business API: Through customer messages received by your business (only messages linked to your business account)
- Third-party service providers: Through payment providers, e-invoice integrations, and other connected services
5. Purposes of Processing Personal Data
Collected personal data is processed for the following purposes:
5.1. Service Delivery
- Creation and management of your Platform account
- Receiving, processing, and converting WhatsApp messages into orders
- Transcribing voice messages and processing them as orders
- Product catalog management and AI-assisted product matching
- Order management, inventory tracking, and reporting
- E-invoice and e-archive invoice generation
- Order intake via QR code
- Customer relationship management (CRM)
5.2. Payment and Subscription Transactions
- Management of subscription plans
- Processing of payment transactions
- Billing and accounting records
5.3. Communication and Support
- Provision of technical support
- Sending system notifications (Telegram, email)
- Informing about service changes and updates
5.4. Security and Legal Obligations
- Ensuring Platform security and preventing misuse
- Compliance with legal regulations and obligations
- Conducting legal claims and audit processes
- Preventing fraud and unauthorized access
5.5. Development and Improvement
- Monitoring and improving Platform performance
- Enhancing user experience
- Training and improving the accuracy of AI models (with anonymized data)
- Statistical analysis and reporting
6. Legal Bases for Processing Personal Data
Your personal data is processed based on the following legal grounds specified in Articles 5 and 6 of the KVKK:
- Explicit consent: For marketing communications and cookie usage
- Performance of a contract: For the establishment and fulfillment of the service agreement
- Legal obligation: For compliance with tax legislation, commercial law, and other legal regulations
- Legitimate interest: For Platform security, fraud prevention, and service improvement
- Establishment of a right: For the assertion or defense of legal claims
7. Sharing of Personal Data
Your personal data may be shared with the following parties and in the following circumstances:
7.1. Service Providers
| Service Provider Type | Purpose of Sharing | Types of Data Shared |
|---|
| WhatsApp (Meta) | Provision of messaging services | Phone number, message contents |
| Payment providers (PayTR, Stripe, PayPal) | Processing of payment transactions | Billing information, payment amounts |
| E-invoice provider (Uyumsoft) | Official invoice generation | Billing information, tax identification number |
| Server infrastructure provider | Data hosting | All data on the Platform (encrypted) |
| Artificial intelligence service provider | Message analysis and order extraction | Message contents (anonymized) |
7.2. Legal Obligation Situations
- To authorized institutions and organizations pursuant to court orders or legal regulations
- To relevant public authorities within the scope of tax audits
- To the Personal Data Protection Authority (in application and complaint processes)
7.3. Cross-Border Data Transfers
Some service providers used by the Platform may have servers located abroad. In such cases, your personal data may be transferred in accordance with Article 9 of the KVKK and the relevant provisions of the GDPR, to countries where an adequate level of protection is ensured or where appropriate safeguards (Standard Contractual Clauses, etc.) are in place.
Main services involving cross-border data transfers:
- WhatsApp Business API (Meta Platforms, USA – within the scope of the EU-US Data Privacy Framework)
- Artificial intelligence services (for message analysis)
- Payment infrastructures (Stripe – USA, PayPal – USA)
8. Retention Period of Personal Data
Your personal data is retained for the period required by the purpose of processing and within the framework of legal obligations:
| Data Category | Retention Period | Justification |
|---|
| Account information | While the account is active + 1 year after account deletion | Service continuity and reactivation |
| Order and invoice data | 10 years | Turkish Commercial Code and Tax Procedure Law requirement |
| WhatsApp messages | While the account is active + 6 months | Service delivery and order verification |
| Voice message records | 30 days after processing | Technical verification |
| Payment records | 10 years | Legal accounting obligation |
| Server logs | 1 year | Security and error tracking |
| Cookie data | 30 days – 1 year depending on cookie type | Functionality and analytics |
Data whose retention period has expired is periodically deleted, destroyed, or anonymized.
9. Personal Data Security
The following technical and administrative measures are implemented to ensure the security of your personal data:
9.1. Technical Measures
- Data transmission with 256-bit SSL/TLS encryption
- Encryption at rest at the database level
- Hashing of passwords with bcrypt/argon2 algorithms
- Firewall and intrusion detection systems
- Regular security updates and patches
- Maintenance of access logs (audit log)
- Rate limiting and brute-force protection
- CSRF and XSS protection
- Daily automatic backups
9.2. Administrative Measures
- Limitation of access permissions under the principle of least privilege
- Data security training for employees
- Confidentiality agreements and data processing agreements
- Regular security audits
- Data breach response plan
10. User Rights
Under Article 11 of the KVKK and the GDPR, you have the following rights:
- Right to be informed: To learn whether your personal data is being processed
- Right of access: To request information regarding your personal data if it has been processed
- Right to rectification: To request correction if your personal data has been processed incompletely or inaccurately
- Right to erasure: To request deletion or destruction of your personal data under the conditions set forth in Article 7 of the KVKK
- Right to restriction: To request restriction of processing
- Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format
- Right to object: To object to a result arising against you through the analysis of processed data exclusively by automated systems
- Right to compensation for damages: To request compensation for damages if you suffer harm due to unlawful processing of personal data
10.1. How to Exercise Your Rights
To exercise the rights listed above, you may use one of the following methods:
- Email: Identity-verified application to kvkk@convord.com
- Within the Platform: Submit a data access request from Settings > Profile
- Mail: Send a notarized or wet-signed petition to Şeyhmüftü Mahallesi, Çarıkçılar Çarşısı Sokak No:2 İç Kapı No:2, Mustafakemalpaşa/Bursa
Your applications will be concluded free of charge as soon as possible and in any event within 30 (thirty) days, depending on the nature of the request. However, if the process additionally requires a cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.
11. Cookies
Our Platform uses cookies to improve user experience and provide our services. For detailed information regarding cookie usage, please refer to our Cookie Policy page.
12. Third-Party Links
Our Platform may contain links to third-party websites or services. We have no control over and no responsibility for the privacy practices of these third-party sites. When you visit these sites, we recommend that you review the privacy policy of the relevant site.
13. Children's Privacy
Our Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from an individual under the age of 18, we will take the necessary steps to delete such data immediately.
14. Data Breach Notification
In the event that a security breach affecting your personal data is detected:
- Notification will be made to the Personal Data Protection Board within 72 hours.
- Relevant data subjects (you) will be informed as soon as possible.
- Immediate technical and administrative measures will be taken to mitigate the impact of the breach.
- Details of the breach and measures taken will be recorded.
15. Policy Changes
This Privacy Policy may be revised from time to time in line with changes in legal regulations or updates to our services. When significant changes are made, you will be notified through the Platform and/or by email. The updated policy enters into force on the date it is published on the Platform.
We recommend that you regularly review changes to the policy.
16. Contact
For questions, requests, or complaints regarding the Privacy Policy:
- Email: kvkk@convord.com
- Phone: +90 XXX XXX XX XX
- Address: Şeyhmüftü Mahallesi, Çarıkçılar Çarşısı Sokak No:2 İç Kapı No:2, Mustafakemalpaşa/Bursa
- Subject: "Regarding Privacy Policy" or "Personal Data Request"
You also retain the right to apply to the Personal Data Protection Board:
Web: www.kvkk.gov.tr