version: 3 effective_date: 2026-08-24 replaces: alt-isleyenler-v2
Sub-processors — v3
This page is the current list of third-party providers that may process personal data on behalf of and under the instructions of DoWaba (Acr Yapay Zeka Eğitim Ve Bilişim Teknolojileri Limited Şirketi) while the Service is provided. It should be read together with KVKK Articles 8–9, the B2B Data Processing Agreement, and the notices applicable to the features actually used.
Last updated: 23 August 2026
1. Current Sub-processor List
Inclusion in this list does not mean that a provider is used for every customer or call. Channel, AI/Voice, and payment providers are engaged only when the relevant feature is enabled and selected for the site. Hetzner is the core hosting infrastructure.
| Sub-processor | Location | Processing Purpose | International Transfer Status |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Server, hosting, data centre, and backup | Data is processed in the EU (Germany); a GDPR Article 28 data processing agreement is in force |
| Google LLC (Gemini AI, Business Profile) | USA / EU | AI responses and Gemini Voice when selected; Google business reviews when enabled | Enabled with the customer's own account and API key; certified under the EU-U.S. Data Privacy Framework; subject to the provider's data processing terms |
| OpenAI, L.L.C. | USA | Embeddings, AI responses, and real-time Voice processing when selected | Enabled with the customer's own account and API key; certified under the EU-U.S. Data Privacy Framework; subject to the provider's data processing terms |
| Anthropic PBC | USA | AI text processing and summarisation when selected; also the AI service used in DoWaba's own support and operations tooling | Certified under the EU-U.S. Data Privacy Framework; subject to the provider's data processing terms |
| Meta Platforms, Inc. | Ireland / USA | Message transmission when the relevant WhatsApp, Instagram, or Messenger channel is connected | Certified under the EU-U.S. Data Privacy Framework; the channel is activated when the customer connects it |
| Telegram FZ-LLC | UAE / global | Message transmission when the Telegram channel is connected | The channel/service is enabled at the customer's choice; transmission is subject to the provider's own terms and transfer mechanisms |
| TikTok | USA / Ireland / Singapore | Messages and comments when the TikTok feature is enabled | The channel/service is enabled at the customer's choice; transmission is subject to the provider's own terms and transfer mechanisms |
| X Corp. | USA | Message transmission when the X channel is connected | The channel/service is enabled at the customer's choice; transmission is subject to the provider's own terms and transfer mechanisms |
| NetGSM | Türkiye | SMS and SIP / telephone infrastructure | Domestic processing; the selected flow is assessed separately |
| PayTR | Türkiye | TRY payment collection | Domestic processing |
| Stripe, Inc. | USA / Ireland | International payment collection when selected | Certified under the EU-U.S. Data Privacy Framework; international payment is used at the customer's choice |
| PayPal | USA / Luxembourg | Payment collection when selected | The channel/service is enabled at the customer's choice; transmission is subject to the provider's own terms and transfer mechanisms |
| Paraşüt (Logo Yazılım) | Türkiye | e-Invoice / e-Archive invoice operations | Domestic processing |
Our current assessment under KVKK Article 9 and Chapter V of the GDPR is explained in the International Transfer Assessment published in the Trust Center.
System email is sent through DoWaba's own Mailcow infrastructure in Germany. The infrastructure and data flows used are also assessed per feature.
2. International Transfers and Safeguard Status
- This list is provided for information purposes; the current legal status and assessment of the relationship with each provider is explained in the International Transfer Assessment published in the Trust Center.
- A regular and continuous transfer may begin only where an actually applicable route under KVKK Article 9 exists for that transfer. Explicit consent under the incidental-transfer exception cannot be used as the general safeguard for regular Voice/AI transfers.
- Commercial terms, a data processing agreement, or this provider list do not by themselves create authority under KVKK Article 9. Legal and Operations verify the scope of the established mechanism and any required record or notification and retain an auditable reference.
- Google Gemini Voice or OpenAI Realtime Voice is used only when actually selected for the site. DoWaba keeps Voice fail-closed at platform level until the regular international-transfer mechanism is verified; consent from the customer or caller cannot open this platform gate.
3. Retention and Provider Terms
DoWaba's own retention and destruction periods apply under the Privacy Policy and Voice Privacy Policy. A sub-processor's own technical retention, region, and training/improvement use must be separately verified against the product actually selected, account settings, and provider terms actually in force. This page gives no unverified “not used for training” or fixed-region guarantee.
4. List Changes
DoWaba keeps this list current. The addition or replacement of a sub-processor is announced by e-mail and by a panel notification at least 15 days before it takes effect. The Customer and the Reseller may object within that period on reasoned data protection grounds; where the parties cannot agree on an alternative, DoWaba may suspend only the affected feature and fees already accrued remain payable. The full procedure is set out in the Data Processing Agreement and the B2B Data Processing Agreement. This list constitutes Annex III to the standard contractual clauses (see SCC Annexes).
5. Contact
- Data Controller: Acr Yapay Zeka Eğitim Ve Bilişim Teknolojileri Limited Şirketi — Emek Mah. Karacaoğlan Cad. No: 54/14, Merkez / Burdur
- KVKK / data request: kvkk@dowaba.com · https://dowaba.com/kvkk-talep
- Related documents: B2B DPA · KVKK Disclosure · International Transfer