1. Identity of the controller
1.1 Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. ("Otai"), the operator of the Otai-branded digital services, is the controller for the independent processing activities described below.
1.2 Registered office: Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya, Türkiye Tax office / number: Antalya Kurumlar Vergi Dairesi / 2270065139 Email: info@otai.app
1.3 This Notice is prepared for visitors to the Otai website, persons who contact Otai, Customer Business representatives and personnel, Otai account users, and other natural persons whose data Otai processes as controller.
2. Role separation in Customer Business communications
2.1 When you communicate with a Customer Business through Otai, the Customer Business is normally the controller for the purpose and content of the conversation, its response, request/complaint management and the underlying business operation. Otai normally processes that data as processor on the Customer Business’s instructions.
2.2 In that context, the Customer Business’s own disclosure notice is the primary notice, and KVKK requests concerning the substance of the communication should first be submitted to that Customer Business. Otai assists the Customer Business as processor.
2.3 Otai may separately be controller for limited purposes it determines, including platform security, abuse prevention, its own contract and account administration, direct support, legal obligations, and the establishment, exercise or protection of legal rights. This Notice covers those activities.
3. Categories of personal data processed
3.1 Depending on the Otai features actually used, the following personal data may be processed:
| Data category | Examples |
|---|---|
| Identity and professional data | Name and surname, position/title, represented business and user role |
| Contact data | Business email address, telephone number and communication choices |
| Customer transaction and contract data | Proposal, contract, subscription, invoice and business-relationship records |
| Account and integration data | User/account identifier, role and permissions; Meta Business/WABA identifier, Phone Number ID, business telephone number, template/webhook and authorisation status |
| Communications and support data | Contact form, email, meeting, support request and responses |
| Processing security data | IP address, access and audit records, date/time, device/browser information, error/diagnostic records and security incidents |
| Cookies and device storage | Authentication/session identifiers; cookie and similar device-storage records; language, interface, cookie and consent choices; a chat request deferred until after login |
| Web use and analytics | Visited and referring pages, usage events, pseudonymous visitor/session identifiers and feature performance; optional analytics only after the required separate consent |
| Diagnostics and session replay | Error, performance, navigation and interaction telemetry; session replay and enhanced diagnostics only after the required separate consent and subject to masking and data minimisation |
| Legal records | Data-subject request, dispute, official request, audit and evidential records |
3.13 When Otai acts as processor for a Customer Business, telephone number, WhatsApp display name, message/media content, message time and status, language, reservation or service reference, request, complaint, feedback and resulting operational records may also be processed. The relevant Customer Business is normally the controller of that content.
3.14 Otai does not ask you to submit full payment-card data, financial-account credentials, health records or other unnecessary confidential or special-category personal data in messages. Do not put unnecessary sensitive information in free-text fields. If such data is submitted voluntarily, it is processed only as necessary to transmit or handle the request for the relevant Customer Business, comply with a legal obligation or rely on another applicable processing condition.
4. Purposes and legal grounds
4.1 Personal data is processed for the following purposes and under the conditions in KVKK Articles 5 and, where applicable, 6:
| Purpose | Main legal ground |
|---|---|
| Create and authorise a business account, contract and onboard, and provide the service | Processing directly related to the formation or performance of a contract (Art. 5/2-c) |
| Establish and operate WhatsApp/Meta and other authorised integrations | Contract formation/performance (Art. 5/2-c); documented instruction of the Customer Business |
| Receive and answer support requests | Contract formation/performance (Art. 5/2-c); legitimate interests (Art. 5/2-f) |
| Authentication, secure sessions, user-requested login/account-merging/widget/deferred-action flows and express language/interface choices | Contract formation/performance (Art. 5/2-c); legitimate interests without harming fundamental rights (Art. 5/2-f) |
| Access management, minimised error and security logs, cybersecurity, abuse detection and service continuity | Legal obligation (Art. 5/2-ç); legitimate interests without harming fundamental rights (Art. 5/2-f) |
| Finance, invoicing, accounting, audit and regulatory compliance | Expressly provided by law (Art. 5/2-a); legal obligation (Art. 5/2-ç) |
| Manage applications, official requests, disputes and legal proceedings | Legal obligation (Art. 5/2-ç); establishment, exercise or protection of a right (Art. 5/2-e) |
| Optional usage analytics through PostHog and, where enabled, Vercel Web Analytics | Separate, affirmative and freely given consent for analytics (Art. 5/1) |
| Optional interaction recordings and performance/error diagnostics | Separate, affirmative and freely given consent for session replay and enhanced diagnostics (Art. 5/1) |
| Improve reliability through genuinely anonymous statistics | Outside KVKK once the personal-data character is irreversibly removed; an applicable KVKK condition governs processing before anonymisation |
| Optional marketing | Separate consent where required for marketing, or another legal ground applicable to the specific activity |
4.14 Where Otai acts as processor for a Customer Business, the Customer Business determines the purpose and legal ground.
4.15 Providing this Notice does not constitute consent. Analytics and session replay/enhanced diagnostics are separate purposes and must be offered through separate, off-by-default choices that are specific, informed, freely given and withdrawable. Optional marketing, analytics or diagnostic consent is not a condition of the core service.
5. AI-assisted processing
5.1 Otai may use automated systems to interpret a message, retrieve Customer Business information, draft a response, translate or summarise content, classify a request or complaint, and route it to the relevant workflow. Outputs may be inaccurate or incomplete and must be subject to human review where appropriate.
5.2 Otai does not use WhatsApp Business Solution Data to create, train or improve shared or general-purpose AI models. Where an AI subprocessor is used, data must be processed only to produce the contracted output for the relevant Customer Business and under restrictions prohibiting provider model training with that content.
5.3 Otai is not intended to make a solely automated decision that produces a legal or similarly significant effect about an individual.
6. Transfers of personal data
6.1 Personal data may be transferred, only as necessary and limited to the stated purposes, to:
6.2 The service-provider categories used are stated above. Specific provider legal identities are disclosed to authorised Customer Businesses, Meta or competent authorities where required by contract or law.
- the relevant Customer Business and authorised users;
- communication and integration providers such as WhatsApp/Meta that the user or Customer Business authorises;
- processors providing hosting, database/storage, authentication, analytics, security, performance/error monitoring, logging, support, email and AI-inference services;
- legal, accounting, audit and insurance advisers under confidentiality obligations; and
- legally authorised public authorities, courts and enforcement bodies.
7. International transfers
7.1 Use of WhatsApp/Meta, cloud infrastructure, authentication, analytics, security, error monitoring or AI services may result in data being processed outside Türkiye or being remotely accessible from abroad.
7.2 Regular international transfers occur only when a condition in KVKK Article 9 is met and the applicable transfer mechanism has been completed. Depending on the data flow, this may be an adequacy decision, the appropriate standard contract published by the Turkish Personal Data Protection Board, approved binding corporate rules, a Board-authorised undertaking, or another safeguard provided by law. Occasional-transfer exceptions are used only where the transfer is genuinely occasional and the legal requirements are satisfied.
7.3 Consent is not treated as a blanket or sole basis for all continuous international transfers. KVKK standard contracts are notified to the Authority within the statutory period; onward-transfer and subprocessor chains are assessed separately.
7.4 Foreign recipient categories are limited to WhatsApp/Meta communications infrastructure, cloud/hosting, database/storage, authentication, analytics, security/performance/error monitoring, support/email and AI-inference providers. Purpose and scope are limited to providing, measuring and securing the relevant service. Optional analytics or diagnostics consent is not used as the sole legal mechanism for a continuous international transfer.
8. Collection methods
8.1 Personal data is collected by wholly or partly automated electronic means through the Otai website, forms, email, support conversations, contracting/onboarding, Otai interfaces, cookies and similar device-storage technologies, server and security logs, and authorised Meta/WhatsApp and customer integrations.
8.2 Where data is not obtained from the individual, notice is provided under the applicable statutory timing and method: within a reasonable period, at first communication, or before/at first transfer as applicable. The Customer Business normally bears this duty for communications in which it is controller.
10. Retention and disposal
10.1 Personal data is retained only for the period required by the relevant processing purpose, the Customer Business’s documented instructions or contract, and applicable legal obligations. Need is assessed according to data type, purpose, legal duties, limitation periods, security needs and individual rights.
10.2 When the purpose and legal ground cease, personal data is deleted, destroyed, returned to the relevant party or anonymised so it cannot reasonably be linked back to the person. Data temporarily remaining in protected backups after active-system deletion is closed to ordinary use and removed or overwritten through the applicable backup cycle.
10.3 Business-account, contract, invoice, accounting, security, support, audit, consent-withdrawal and communication-objection records are retained only while the corresponding legal, contractual, security or proof purpose remains and are securely disposed of afterwards. WhatsApp/Meta authorisation information is revoked or deleted when the connection and access need end.
10.4 Pseudonymised or masked data is not anonymous. Information is treated as anonymous only where it cannot reasonably be re-associated with an individual.
11. Rights under KVKK Article 11
11.1 As a data subject, you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose and whether data is used in accordance with that purpose;
- know the third parties to whom it is transferred in Türkiye or abroad;
- request correction of incomplete or inaccurate data;
- request deletion or destruction under KVKK Article 7;
- request notification of correction/deletion/destruction to recipients;
- object to an adverse result arising exclusively from automated analysis; and
- request compensation for loss caused by unlawful processing.
12. Application method
12.1 You may submit an application under the Communiqué on the Procedures and Principles of Application to the Data Controller:
12.2 The application must include information sufficient to verify the applicant and identify the request, as required for the chosen method. Additional verification information proportionate to the request may be requested; unnecessary documents are not required.
12.3 Applications are normally answered free of charge within 30 days at the latest. If the response causes an additional cost, the fee in the Board’s current tariff may apply.
12.4 For the substance of a conversation with a Customer Business, contact that Customer Business first. If the request reaches Otai, we forward it to and reasonably assist the relevant Customer Business for the part in which we act as processor.
- in writing to Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya;
- with a secure electronic signature or mobile signature to info@otai.app; or
- from an email address previously notified by you and registered in our systems to info@otai.app.
13. Updates
13.1 This Notice may be updated when data flows or law change. The current version is published with a new date. A materially different new purpose is not applied retroactively without an appropriate legal basis and the required notice.
13.2 Important: This disclosure is not a consent form and does not mean that you automatically consent to any activity.