1. Identity of the Data Controller

This notice has been prepared by Voratrix Yazılım ve Yapay Zeka Teknolojileri Anonim Şirketi as data controller, pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the related Communiqué on the fulfilment of the disclosure obligation.

Address: Yakuplu Mah. Hürriyet Blv. Skyport Residence No: 1 İç Kapı No: 62, Beylikdüzü / İstanbul

MERSIS No: 0925134248300001 · Tax office / number: Beylikdüzü / 9251342483

Email: info@voratrix.com · Phone: +90 850 303 14 52

2. Controller and Processor

For the data of subscribers who open a Xaly.ai account, our company is the data controller.

For personal data processed in conversations between a Subscriber and its own customers, the Subscriber is the controller and our company is the processor. We process such data only on the Subscriber's instructions, for the purpose of delivering the service.

If you were a party to such a conversation and wish to exercise your rights, you should apply first to the company that made the call (the Subscriber); if your request reaches us, we will direct it to them.

3. Categories of Personal Data Processed

Identity: first name, surname, company name.
Contact: email address, telephone number, address.
Customer transactions: order and subscription details, request and complaint records.
Financial: invoice details, tax office and number, payment amount and date (card numbers are not processed).
Transaction security: IP address, session and sign-in records, device and browser information, audit logs.
Audio records: call recordings and their transcripts.
Marketing: message preferences based on explicit consent.

4. Purposes of Processing

Conducting contractual processes and delivering the service.
Carrying out finance, accounting and invoicing operations.
Following up requests and complaints and managing customer relations.
Operating information security processes and preventing unauthorised access and abuse.
Measuring service quality and improving business processes.
Providing information to authorised persons and institutions and following up legal matters.
Sending promotional and informational messages where explicit consent exists.

5. Legal Bases (Article 5 of the Law)

Directly related to the conclusion or performance of a contract (Art. 5/2-c).
Necessary for the controller to fulfil a legal obligation (Art. 5/2-ç).
Necessary for the establishment, exercise or protection of a right (Art. 5/2-e).
Necessary for the legitimate interests of the controller, provided fundamental rights are not harmed (Art. 5/2-f).
Expressly provided for by law (Art. 5/2-a).
Explicit consent for processing outside the above conditions (Art. 5/1).

6. Transfer of Personal Data (Articles 8 and 9)

Your personal data may be transferred, limited to the processing purposes, to:

Suppliers providing hosting, server and backup services.
Electronic communications carriers and SIP providers — so that calls can be established.
Messaging platforms — where the relevant channel is used.
Payment institutions and banks — to carry out payment transactions.
Professionals engaged by us such as accountants, independent auditors and lawyers.
Competent public authorities and judicial bodies — after assessing the lawfulness of the request.

7. International Transfers

Core components of the service are hosted in Türkiye. Where supporting services such as messaging platforms, email delivery and error monitoring operate through providers located abroad, transfers are made on the conditions set out in Article 9 of the Law and, where necessary, standard contractual clauses.

With the self-hosted option, data remains on the Subscriber's infrastructure and no international transfer takes place.

8. Method of Collection

Your personal data is collected by wholly or partly automated means through forms completed on the website and dashboard, account registration, contact by email and telephone, the call and messaging flows carried out under the service, and cookies.

9. Retention Periods

Your personal data is retained for as long as the purpose of processing requires and until the end of the limitation periods set out in applicable legislation. Category-level periods are detailed in the "Retention Periods" section of the Privacy Policy.

At the end of the period, data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

10. Rights of the Data Subject (Article 11)

Under Article 11 of the Law, by applying to the data controller you may:

Learn whether your personal data is being processed.
Request information if it has been processed.
Learn the purpose of processing and whether the data is used in line with that purpose.
Know the third parties to whom the data is transferred in Türkiye or abroad.
Request rectification if the data is incomplete or inaccurate.
Request erasure or destruction under the conditions of Article 7.
Request that rectification, erasure and destruction be notified to third parties to whom the data was transferred.
Object to an adverse outcome arising from analysis carried out solely by automated systems.
Claim compensation for damage suffered due to unlawful processing.

11. How to Apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests in writing to the address above with a wet signature, through a registered electronic mail (KEP) address, using a secure electronic or mobile signature, or from the email address registered in our system.

Application email address: info@voratrix.com

Your application must include your name and surname, signature (for written applications), Turkish ID number (passport number for foreign nationals), address for notification, email and telephone if any, and the subject of your request.

Your application is concluded free of charge as soon as possible and within thirty days at the latest. Where the process entails an additional cost, the fee set out in the tariff determined by the Board may be charged.

If your application is rejected, the response is found insufficient, or no response is given within the period, you may file a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the application date.

KVKK Data Protection Notice