version: 2 effective_date: 2026-07-17 replaces: v1

International Data Transfer Notice — v2

This International Data Transfer Notice has been prepared by DoWaba (Acr Yapay Zeka Eğitim Ve Bilişim Teknolojileri Limited Şirketi, https://dowaba.com, Burdur / Turkey, info@dowaba.com) to inform data subjects within the scope of Article 9 of the Personal Data Protection Law No. 6698 ("KVKK"), due to the fact that a significant portion of the infrastructure and service providers used are located outside Turkey.

1. Purpose and Scope

This notice explains personal data processing and transfers outside Türkiye that may occur according to enabled DoWaba features. Read it with KVKK Voice Disclosure v3 and B2B-DPA v2.

It does not itself establish a transfer mechanism and does not represent that an adequacy decision, signed provider DPA, KVKK standard contract, or Authority notification exists.

2. Potential Data Categories

Depending on the feature, account/contact data, message content, technical records, and call data may be processed. In Voice:

• recorded: audio and transcript after privacy gates,
• transcript_only: persistent transcript without an audio file,
• no_retention: transient processing without persistent audio/transcript.

Listing a category does not mean it is transferred for every user or call.

3. Potential Providers and Conditional Use

The current list is at Sub-processors. Country, region, retention, and training/improvement behaviour are described from the product actually selected and verified account/contract settings.

4. KVKK Article 9 Legal Gate

EU membership or GDPR applicability is not by itself an adequacy decision under KVKK. Commercial terms or a data processing agreement do not alone create Article 9 authority.

A regular and continuous transfer does not begin until an actually applicable Article 9 route is verified for provider, product, and data flow and recorded by Legal and Operations under an auditable reference. Consent under the incidental-transfer exception is not a general safeguard for regular Voice/AI transfers. Panel acceptance or call-level consent cannot open the platform gate.

5. Verification of Technical and Organisational Measures

DoWaba selects and applies measures appropriate to the transfer and risk. Possible controls include access restriction, transfer security, logging, key management, retention limits, and incident response. This is not an absolute guarantee that the same control exists for every provider, data item, or storage layer.

Before a transfer is opened, the provider product, flow, region, retention setting, contractual scope, and security controls are documented. Product-specific statements such as “encrypted at rest,” “not used for training,” or a fixed region require verified evidence.

6. Access and Audit

Access is limited by least privilege and need. Audit, notification, breach cooperation, and deletion/return periods are documented according to applicable law, executed agreements actually in force, and verified operational capability. This notice alone creates no absolute audit right or fixed deadline commitment.

7. Where the Transfer Mechanism Is Not Ready

A regular data flow without a verified Article 9 route does not begin. Accordingly, DoWaba Voice remains fail-closed even where Google Gemini Voice or OpenAI Realtime Voice is selected. Customer or caller consent cannot bypass this gate.

Where another feature can technically and legally be provided without an international transfer, it may be assessed separately; the Service is not operated by concealing the transfer.

8. KVKK Art. 11 Rights

As a data subject, you have the following rights under KVKK Art. 11:

1. To learn whether your personal data is being processed,
2. To request information if it has been processed,
3. To learn the purpose of processing and whether it is used in accordance with its purpose,
4. To know the third parties to whom it has been transferred domestically or internationally,
5. To request correction if it has been processed incompletely or inaccurately,
6. To request deletion or destruction within the framework of KVKK Art. 7,
7. To request that the transactions carried out be notified to third parties to whom the data has been transferred,
8. To object to an adverse outcome resulting from analysis carried out through automated systems,
9. To request compensation for damages suffered due to unlawful processing.

Applications may be directed to kvkk@dowaba.com. A response is given within thirty days in accordance with the Communiqué on Procedures and Principles for Applications to Data Controllers.

9. Appropriate Safeguard Record

An adequacy decision, standard contract, binding corporate rules, or another Article 9 route is relied upon only if actually applicable to the data flow and any required signature, record, or notification steps are complete. Provider, product, role/module, and data-category scope is recorded under an auditable reference.

Publication, customer acceptance, or caller preference does not replace those records.

10. Contact, Version, and Legal Review

• Version: v2 (replaces v1; prior hashes remain in audit records)
• Effective: 17 July 2026
• KVKK contact: kvkk@dowaba.com
• Request: https://dowaba.com/kvkk-talep

Information on the current mechanism may be requested subject to protection of trade secrets and security information.

This notice is not independent legal advice. The KVKK Article 9 mechanism, provider/product scope, party roles, and required signatures/filings must be verified by independent counsel before regular transfers and the Voice gate are opened.