version: 5 effective_date: 2026-07-30 replaces: v4 amendment_clause: continued-use-v1

Privacy Policy for Telephone and AI Conversations — v5

1. Nature of this Document and the Parties' Roles

This document describes the technical privacy options of DoWaba Voice and the obligations of the business using the service. Acceptance by a business user in the panel does not replace the explicit consent of the natural person making or receiving a call.

The business that determines the purpose, legal basis, retention policy and recipients of a call is generally the data controller. DoWaba acts as a data processor to the extent that it provides the service under the business's documented instructions. A reseller may be an authorised administrator/processor when implementing its customer's written instructions, but may become a controller for activities whose purposes and means it determines. Roles follow the actual processing activity, not merely contractual labels.

2. Mandatory Layered Notice

On every Voice call, before call content is persistently stored, a short first layer identifies the business, states that the caller is interacting with an AI assistant and describes the selected retention mode. Rather than a prerecorded announcement or keypad menu, this layer is spoken naturally by the AI voice conducting the conversation; its legal core is fixed, cannot be skipped, and cannot be freely paraphrased by the model. The business identity, AI nature and recording/transcription status cannot be disabled.

The detailed notice contains the controller's identity and contact details, data categories, purposes, legal basis, recipient groups, international transfers, retention period and the method for exercising rights under KVKK Article 11. It must reflect the business's actual activity and providers; another controller's text must not be copied without adaptation.

2.1 Notice Profiles: Two Forms of the Layered Notice

The scope of the first layer varies according to the notice profile selected by the controller in the panel. The short profile is the platform default; a controller that prefers the detailed (full-text) form can switch to the standard profile in the panel. The layered structure is preserved in both profiles: only the first layer is shortened, while the elements of the detailed layer are never reduced.

• Short profile (platform default). The first layer is reduced to a single sentence stating only the business name, the AI nature and the recording/transcription status appropriate to the selected privacy mode. There is no eligibility restriction on the short text: every combination of privacy mode and legal basis has an honest variant that matches the mode; in recorded mode it states that the conversation is being recorded, in transcript_only mode that a written transcript of the conversation is kept, and in no_retention mode that no permanent record of the conversation is kept. The system therefore never silently returns the first layer to the standard profile in any combination. On English-language lines, the text spoken in recorded mode on a legal basis other than explicit consent is: “Hello, I am …'s digital AI assistant. Our conversation is recorded under data-protection rules.”
• Standard profile (detailed form). The first layer states the business name, that the other party is speaking with an AI assistant, that the audio is processed transiently abroad, the selected privacy mode and, where applicable, the retention period, and then explains how to request the detail. The controller may switch to this form in the panel at any time.

In both profiles the minimum elements of the first layer are identical and cannot be disabled: the name of the controller business, the fact that the other party is speaking with an AI assistant, and the recording/transcription status appropriate to the selected mode. Shortening never extends to these three elements.

In the short profile, on legal bases other than explicit consent, the information that the audio is processed transiently abroad, the retention period, the name of the technical service provider used and the legal-basis label are removed from the first layer. Those elements are not eliminated; they move to the detailed layer, which is delivered on request within the same call. When the other party says “privacy”, “data protection”, “details” or an equivalent phrase, the detailed layer states the controller's identity, the legal basis, the fact that voice data is processed transiently abroad in order to generate the live response, the retention period, the technical service provider used, and the route to recipient categories, the KVKK Article 9 transfer mechanism and the rights under Article 11. The elements of the detailed layer do not change with the profile.

The detailed layer delivered on request is open on every line and cannot be disabled. On legal bases other than explicit consent, the short first layer does not separately announce how to request the detail; the detailed layer itself, however, remains technically available on every call: when the other party says “privacy”, “data protection” or an equivalent phrase, the detailed layer is delivered within the same call. This behaviour cannot be switched off by the notice-profile selection, by a site setting or by the business's own assistant instructions. In addition, the full notice is made accessible in the controller's own written information text, including its website and application channels. The basis of the layered notice under the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform of 10.03.2018 rests on both of these safeguards being in place together.

The first layer is not narrowed on lines relying on explicit consent. Where the legal basis is explicit consent, the information that the audio is processed transiently abroad, the route for requesting the detail and the spoken yes/no question described in Section 4 remain in the first layer in the short profile as well, because consent under KVKK Article 9 can be regarded as informed only where the transfer is disclosed before consent is obtained.

Opening order on outbound calls. On outbound calls, on legal bases other than explicit consent, the business's opening message and the first-layer notice may be delivered together within the same opening turn — the message first, the notice immediately after; on lines relying on explicit consent, the notice and the consent question come before the business's message in every case.

Responsibility and audit record. Use of the short first-layer notice is the controller's choice and responsibility; the controller may switch to the detailed (full-text) notice form in the panel at any time. The controller assesses whether the first layer is sufficient for its own specific activity, call type and audience. Full and proper performance of the information obligation under KVKK Article 10 — including making the full notice text accessible on its own website and application channels — rests exclusively with the controller. The controller is responsible for the accuracy of the business name, privacy mode, legal basis and retention period it declares on the platform; the notice text is generated from those declarations. DoWaba provides the technical infrastructure upon documented instruction in the capacity of data processor within the meaning of Law No. 6698; it neither represents nor assesses the sufficiency of the first layer on the business's behalf. Each call records the notice version and the notice profile actually applied. Under the rules in Section 8, a reseller cannot change the notice profile of a customer site.

2.2 Layered Notice in Messaging Channels

The same layered structure applies in written form to exchanges on WhatsApp, Instagram, Telegram and Messenger. On those channels the short first layer is prepended to the first AI reply sent to the other party and is not sent again to the same person during the repeat period. The notice text is not posted beneath public comment replies; where the person moves to a private message, the first layer is shown there. Voice lines follow the announcement arrangement in Section 2.1. In the web widget the first layer is not sent as a message; the name of the business, the fact that the other party is exchanging messages with an AI digital assistant and the fact that the exchange is recorded remain permanently visible in the widget interface. The detailed layer is open in the widget as well: when the visitor writes “privacy”, “KVKK” or an equivalent phrase, the detailed text is delivered within the same conversation. Where explicit consent mode is enabled, the widget shows, before the exchange begins, a consent box stating together that the exchange is recorded, that the data is processed abroad in order to generate the answer, that explicit consent is given to this processing and transfer, how consent may be withdrawn and how the details may be requested; the exchange does not begin until the box is ticked, and the text actually displayed at the moment of consent is written to the audit record together with its version and digest (SHA-256).

The minimum elements of the written first layer are: the name of the controller business, the fact that the other party is exchanging messages with an AI assistant, and the statement that the exchange is recorded. Shortening never extends to these three elements. On English-language channels, the core of the text sent on a legal basis other than explicit consent is: “Hello! I am …'s digital AI assistant. Our message exchange is recorded under data-protection rules.”

Elements not included in the short first layer are not eliminated; they move to the detailed layer, which is delivered in writing on request in the same channel. When the other party writes “privacy”, “data protection”, “details” or an equivalent phrase, the detailed layer is delivered within the same exchange and states that message content is processed and stored on servers abroad, the retention period applicable to the site, the commands for moving to a human operator and for requesting deletion of data, the rights under KVKK Article 11 and the route for making an application. The elements of the detailed layer do not change with the channel.

The detailed layer delivered on request is technically available on every channel and cannot be disabled. The short first layer does not separately announce how to request the detail; the detailed layer itself, however, remains available on every channel and cannot be switched off by a site setting or by the business's own assistant instructions. In addition, the full notice is made accessible in the controller's own written information text, including its website and application channels. The basis of the layered notice under the Communiqué of 10.03.2018 referred to in Section 2.1 likewise rests, in messaging channels, on both of these safeguards being in place together.

The first layer is not narrowed in explicit-consent mode. Where the international transfer relies on explicit consent, the short first layer includes the information that message content is processed on servers abroad, the statement that continuing to use the service counts as explicit consent to that processing and transfer, and the route for withdrawing consent (writing “Delete my data”), because consent under KVKK Article 9 can be regarded as informed only where the transfer is disclosed before consent is obtained. Explicit-consent mode is a site-level choice and is disabled by default; the distinction between a legal basis and explicit consent is set out in Section 4.

Responsibility and audit record. The layered structure is a means of performing the controller's information obligation; the controller assesses whether the first layer is sufficient for its own specific activity, channel and audience. Full and proper performance of the information obligation under KVKK Article 10 — including making the full notice text accessible on its own website and application channels — rests exclusively with the controller. The controller is responsible for the accuracy of the business name and retention period it declares on the platform; the first-layer text is generated from those declarations. Management of the first layer at site and channel-account level is available to the controller in the panel; the consequences of that choice under Article 10 rest with the controller. The controller also assesses whether the continuation statement used in explicit-consent mode constitutes valid explicit consent within the meaning of KVKK Article 9 for its own activity; the spoken yes/no rule provided for voice calls in Section 4 is not altered by that mode. DoWaba provides the technical infrastructure upon documented instruction in the capacity of data processor within the meaning of Law No. 6698; it neither represents nor assesses the sufficiency of the first layer on the business's behalf. Each sending records the notice version and the text variant actually applied in the audit record (the notice_version field of the kvkk_disclosures record and the kvkk.disclosure.sent audit event).

3. Privacy Modes

The “Audio file” column in the table shows persistence, not the moment at which the recorder runs. For technical infrastructure reasons the call audio is recorded temporarily for the duration of the call in every mode; the decision to make it persistent is taken at the end of the call and according to the selected mode. In recorded mode, persistence occurs only after the notice and, where required, an affirmative consent; if consent is not given or the recording is objected to, the temporary technical recording is destroyed without its content being read. In transcript_only mode the temporary recording is used solely to produce the written transcript and is destroyed once that operation is complete; no audio file is made persistent. In no_retention mode the temporary technical recording is destroyed at the end of the call without its content being read.

In no_retention mode, audio may be processed transiently during the call to generate a response. The telephone number, direction, start/end time, duration, technical status, and notice/preference audit events may be retained separately from content where limited to security, billing, service evidence and legal obligations. An appointment, order, support record or callback expressly requested by the caller may also be saved as a separate service transaction; these records are not the audio recording or transcript of the conversation. “No content retention” therefore does not mean that no technical metadata or caller-requested business transaction is processed.

4. Legal Basis and Explicit Consent

The business selects the legal basis applicable to its specific activity and attests to the accuracy of that choice. DoWaba does not make that legal determination for the business. Available bases may include performance of a contract, establishment/exercise/defence of legal claims, a proportionate legitimate interest, an actual legal obligation, or explicit consent.

• Where processing relies on explicit consent, the notice and the request for consent are presented distinguishably: at the end of the fixed notice announcement, the same AI voice asks a fixed spoken yes/no question; if the answer is unclear or not given in time, a short fixed re-ask is read. To understand that short response, only the minimum audio of the answer may be processed transiently in a privacy-only session at the selected Voice provider and is not persistently retained. The main assistant session, customer context, tools, and selected persistent retention begin only after a clear, unambiguous spoken “yes”; a clear “no” counts as rejection. Silence, an unclear response, continuation of the call or failure to object is not consent. No keypad input is used for new calls. This limited first transfer is also subject to the international-transfer arrangements described in Section 7. Historical keypad-method records remain retained solely as evidence and for audit.
• Where another KVKK legal basis applies, no additional “consent” is requested, but the notice remains mandatory.
• Wording implying that the recording is commanded by the KVKK is not used: “we record because the KVKK requires it”, “recording is compulsory under the KVKK” and equivalents are prohibited. The KVKK does not require every call to be recorded; the business states only the purpose and legal basis that genuinely apply. By contrast, the wording “our conversation is recorded under data-protection rules” falls outside this prohibition and is expressly permitted: it is a deliberate legal register conveying that the recording is carried out in accordance with Law No. 6698 rather than at its command, and it is the standard wording of the short first layer shown in Sections 2.1 and 2.2.

5. Recording Objection and Preference Changes

If the call party says “do not record” or an equivalent phrase, the system stops persistent audio recording, clears content buffers not yet made persistent for that call, and safely changes the remainder of the call to no_retention. A human transfer may be offered only when configured by the business; the system does not promise an unavailable representative. The call ends if privacy-safe continuation is not technically possible.

Automatic spoken-objection detection and the switch to no_retention apply only while the AI assistant is actively handling the call. Where the selected privacy mode does not permit permanent audio recording (transcript_only/no_retention), DoWaba retains no audio or transcript from a human representative, translation (translate) or application (app) transfer leg; in the "audio and transcript" (recorded) mode, the post-transfer portion of the conversation is likewise included in the call recording. If the business records through a separate PBX or representative system, the objection is made directly to the controller business/its representative; the business implements the recording-stop and any required deletion process under its own systems and procedures.

In an explicit-consent flow, a negative response means that persistent audio or transcript storage is never started. The refusal/preference time may be retained at metadata level only where necessary as evidence.

6. Retention and Destruction

Persistent content in recorded and transcript_only modes is automatically destroyed after the period configured for the site. The default is 90 days; the business may change it in the panel where necessary and proportionate. no_retention creates no persistent audio file, persistent transcript, content summary or quality sample; the temporary technical recording held for the duration of the call is automatically destroyed at the end of the call without its content being read. transcript_only likewise keeps no persistent audio file; the temporary recording is used solely to produce the written transcript and is destroyed once that operation is complete.

The period shown in the panel and the period used by automated destruction are both governed by the same sites.voice_retention_days field. A deletion request or recording objection may require removal before the normal periodic period expires.

7. AI Providers and International Transfers

Transient audio processing is performed through the selected Voice provider. Because the actual provider and processing region depend on site configuration, the notice does not make fixed claims that “Google/Anthropic/OpenAI is used” or that “standard contracts have been signed.” The detailed notice lists only providers actually used for the call.

Voice/AI processing runs through the business's own AI provider account or API key configured in the panel; in that case the business is the party to the service and data-processing relationship with the provider. DoWaba uses that key only on the business's instructions, acting as processor.

Where an international transfer occurs, the controller (the business) must determine, implement and maintain a valid KVKK Article 9 transfer mechanism before processing and complete any required filings or notifications; DoWaba does not establish that mechanism on the business's behalf and makes no representation that it has been established. At trunk activation the business accepts this allocation of responsibility through a panel declaration; DoWaba keeps that declaration and the platform gate's basis of effect in auditable records. Call-level explicit consent, continuing the call, or listening to the notice does not replace this regular-transfer obligation.

8. Authorisation and Audit

• A site owner/controller may select the mode and legal basis for its own site.
• A reseller may change a customer site's policy only where the product holds a verifiable, auditable authorisation record. The current version has no such durable delegation mechanism; panel access or an off-product documented instruction alone is insufficient, so a reseller cannot currently change the customer's policy.
• Acceptances of the Voice Policy, IYS, and B2B-DPA may be given only by the site owner from their own account; a reseller, superadmin, or other actor cannot substitute for the owner's acceptance.
• Agents and users with site-pivot-only access cannot change the privacy policy.
• The policy acceptance given at trunk activation also covers acceptance of the international-transfer responsibility arrangement in Section 7 (the Article 9 mechanism is established by the controller).
• A mode or legal-basis change records the actor, site, old/new values, time, IP and controller attestation.
• Each call stores a snapshot of mode and legal basis, notice version/time, recording start time, and any explicit consent or recording-objection time.

9. Outbound Marketing Calls

This policy does not replace obligations under Law No. 6563 and the Commercial Electronic Message Management System (IYS). Outbound sales/marketing calls separately require any applicable prior approval, sender identity, disclosure of the commercial nature of the call, and an easy/free refusal mechanism.

10. Amendments and Continued Use

DoWaba reserves the right to update this text due to changes in legislation, changes in the scope of service, or reasonable commercial reasons. Changes are announced to the Customer by email and/or panel notification at least 15 days, and material changes at least 30 days, before they take effect. The notice states the changed documents, the new version number and the document digest (SHA-256).

The Customer may object before the notice period expires, through the panel or by writing to kvkk@dowaba.com; upon objection the new version does not automatically take effect for that Customer, the parties consider a resolution in good faith, and if none is found the Customer may terminate the relevant service. If no objection is raised and the Customer continues to use the service after the notice period has expired, such continued use constitutes acceptance of the new version. The acceptance is recorded in the audit log together with the notice date, waiting period, evidence of use, version number and document digest, and is visible to the Customer in the panel.

This provision covers only the contractual relationship between the Customer (the business owning the panel) and DoWaba. It cannot establish the explicit consent under Article 9 or the disclosure under Article 10 of the Turkish Data Protection Law of the person called or calling; acceptance through continued use does not replace the Customer's own obligations towards data subjects.

11. Version

• Version: v5
• Effective date: 30 July 2026
• Previous version: v4
• Notice version: v4.4
• Notice profiles: short (default — in every privacy mode, with a variant matching that mode) · standard (detailed form, selected in the panel)
• Contact: info@dowaba.com — KVKK: kvkk@dowaba.com

This document describes technical product behaviour and the parties' service-contract responsibilities. It does not replace an independent legal review of the business's sector and actual data flow.