KVKK Personal Data Protection Notice
Last updated: August 29, 2026
1. Data Controller
In accordance with the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Digital Staff Pro (DSP Software Services) ("Company", "we") as the data controller for the purposes and methods outlined in this notice.
Authorized Representative: Anıl Yavuz
Email: [email protected]
Web: https://digitalstaffpro.com
2. Processed Personal Data
When using our platform, the following categories of personal data are processed:
- Identity and contact data: full name, email address, phone number, company/business name
- Account and transaction security data: login credentials (passwords stored hashed/encrypted), IP address, session logs
- Customer transaction data: subscription and billing information (tax ID, billing address — if corporate invoice is requested)
- Communication content data: customer chat contents handled via your AI agents on WhatsApp, Instagram, Telegram, SMS, or Web Widget (these belong to your customers; the Company processes them solely for service performance)
- Security and platform data: linked third-party account IDs (Meta/WhatsApp Business Account ID, Instagram Business Account ID), access tokens (stored encrypted)
- Marketing data (only with explicit consent): communication preferences if subscribed to the email newsletter
3. Purposes of Processing Personal Data
- Account registration and user authentication
- Delivering platform services (AI sales assistant, channel integrations) and contract performance
- Managing subscription and payment operations, invoicing
- Fulfilling customer support requests
- Ensuring platform security and preventing abuse
- Fulfilling legal obligations (tax and commercial legislation)
- Improving service quality and resolving technical issues
- Sending commercial electronic communications where explicit consent is granted
4. Legal Grounds for Data Processing
Your personal data is processed pursuant to Articles 5 and 6 of KVKK based on:
- Necessity for the establishment or performance of a contract (membership agreement, service subscription)
- Compliance with legal obligations of our Company (tax and accounting regulations)
- Legitimate interests of the data controller, provided it does not harm fundamental rights and freedoms (platform security, service quality improvement)
- Explicit consent (for marketing communications and optional procedures)
5. Transfer of Personal Data
Your personal data may be transferred strictly limited to the purposes stated above to the following parties:
- Cloud Infrastructure Provider: Google Cloud Platform (data hosting)
- Payment Processor: iyzico (subscription/payment operations — card data does not reach us, handled directly by iyzico's secure infrastructure)
- Meta Platforms, Inc.: messaging data when using WhatsApp Business API and Instagram integrations
- Authorized public authorities: upon legal demand by competent authorities
The Company never sells your personal data to third parties. Where cross-border data transfers occur (e.g., hosting cloud infrastructure abroad), legal safeguards under KVKK Article 9 are ensured.
6. Collection Method of Personal Data
Your personal data is collected electronically via registration forms on the website and panel, electronic communication tools (email, support request forms), and automated means during platform usage (cookies, log records).
7. Retention Period of Personal Data
Your personal data is retained for the duration required by the processing purpose and statutory limitation periods (up to 10 years under Turkish Commercial Code and Tax Procedure Law). Upon account deletion, data not subject to legal retention obligations is deleted or anonymized within 30 days.
8. Data Security
- All data is encrypted during transit and at rest
- Access tokens are stored encrypted in the database
- Access is restricted to authorized personnel on a strict need-to-know basis
- Data is hosted on secure cloud infrastructure (Google Cloud Platform)
9. Your Rights Under KVKK Article 11
Pursuant to Article 11 of KVKK, by applying to the data controller, you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether data is used in accordance with its purpose,
- Know third parties to whom personal data is transferred domestically or abroad,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction of personal data under Article 7 conditions,
- Request notification of correction/deletion operations to third parties to whom data has been transferred,
- Object to results against you produced solely through automated system analysis,
- Claim compensation for damages suffered due to unlawful processing.
10. Application Procedure
To exercise your rights, you can send your requests in writing together with identity verification documents to [email protected]. Your application will be resolved free of charge within 30 days depending on its nature.
11. Operations Requiring Explicit Consent
Account registration does not require explicit consent as it is based on contract performance. However, explicit consent is requested for commercial electronic messages (marketing emails) or cross-border data transfers where applicable, and can be withdrawn anytime without justification.
12. Amendments
This Disclosure Notice may be revised in line with regulatory changes or service updates. The current version is always published on this page and the date at the top is updated accordingly.