1. Purpose and scope
This Privacy Policy explains how personal data is processed in the website, Servis365 Santral application, WhatsApp Business communication services, call centre and related digital services operated by Servis365 Tesis Yönetimi Anonim Şirketi.
2. Data controller
Trade name: Servis365 Tesis Yönetimi Anonim Şirketi
Address: NurolPark Ofis, Bahar Cad. No:41, J Blok Kat:16, Güneşli/İstanbul
Telephone: +90 850 288 8 365
Email: [email protected]
Website: https://servis365.com.tr
3. Principles applied to personal data processing
Servis365 processes personal data lawfully and fairly, accurately and where necessary kept up to date, for specified, explicit and legitimate purposes, in a manner relevant, limited and proportionate to those purposes; it retains data for the period required by applicable legislation or the purpose of processing.
4. WhatsApp communication process
4.1 Data processed
- Name, surname, telephone number, company, position and title,
- Contents of messages sent and received and documents, images and files shared,
- Message ID, date, time, type and delivery/read/failure status,
- Request, complaint, appointment, service and customer feedback information,
- API, webhook, transaction and security logs.
4.2 Purposes and legal bases of processing
Telephone number, message content and request information are processed to receive requests, direct them to the authorised team, respond, manage appointment and service processes and ensure transaction security. Depending on the circumstances, processing relies on the legal bases in Article 5 of the KVKK: formation or performance of a contract, legal obligation, establishment/exercise/protection of a right, or legitimate interests provided that the data subject’s fundamental rights are not harmed.
4.3 Method of collection
Data is collected electronically when a person contacts us via WhatsApp or shares their number through the website or another channel, when a customer receiving the service or an authorised partner lawfully provides the information, and when the WhatsApp Business Platform generates message/delivery records.
5. Call centre and voice recording
5.1 Data processed
- Calling/called number and call date, time, duration, direction and status,
- Identity, contact, request and service information shared during the call,
- Voice recording, conversation text/transcript and quality assessment,
- Call ID, user actions and security logs.
5.2 Purposes and legal bases
Call data is processed to receive requests and complaints, provide services, verify transactions, assess service quality, resolve disputes, ensure security and fulfil legal obligations. Depending on the activity, the legal bases are formation or performance of a contract, legal obligation, establishment/exercise/protection of a right, or legitimate interests. If a separate activity requires explicit consent, consent is obtained separately from the privacy notice.
6. Website and contact forms
6.1 Data processed
Depending on form fields, name, telephone, email, company, subject, message content and attachments may be processed, as well as IP address, browser/device information, date and time and security logs.
6.2 Purposes and legal bases
Data is processed to receive a request, direct it to the appropriate unit, respond and ensure communication security, relying as applicable on contract formation or performance, legal obligation or legitimate interests. Marketing consent through the form is requested separately and is optional.
7. Membership and user account
7.1 Data processed
When an account is created and used, name, telephone, email, company, position/title, username or user ID, role and authorisation information, password verification information, account status, preferences and account-related transaction history may be processed. Passwords are not stored in plain text; appropriate secure authentication methods are used.
7.2 Purposes and legal bases
Account data is processed to establish membership, verify user identity, manage roles and permissions, secure the account, respond to user requests and provide services. Depending on the process, the legal bases are contract formation or performance, legal obligation and legitimate interests, provided that the data subject’s fundamental rights are not harmed.
8. User login and session records
During account login, user ID, login/logout date and time, IP address, browser and device information, session ID, failed login attempts, password reset records, actions performed and security logs may be processed. This data is processed to secure the account and systems, prevent unauthorised access, investigate incidents, create an audit trail and protect legal rights, on the basis of legal obligation or legitimate interests.
Session and security records are retained for the maximum period specified in the data processing inventory; when the reason for processing ends they are deleted, destroyed or anonymised.
9. Quotation request form
9.1 Data processed
During a quotation request, name, telephone, email, company, position/title, service location or facility details, requested service, needs and explanations, preferred contact method and documents uploaded by the user may be processed.
9.2 Purposes and legal bases
Quotation form data is processed to assess the request and needs, contact the user, prepare and track a quotation and carry out pre-contractual steps, based on direct relevance to contract formation or legitimate interests. A quotation request does not constitute consent to marketing messages.
10. Automatic transfer to the CRM system
Personal data collected through contact forms, quotation requests, user accounts, WhatsApp or the call centre may be automatically transferred to the CRM system used by Servis365 to centrally manage customer relationships, requests and quotations, appointments, service history and feedback.
Data transferred to the CRM is limited to information required for the relevant process. The CRM provider’s role as processor or independent controller is determined by contract and actual data flows; access permissions are limited and actions recorded. If the provider’s systems are abroad, transfers rely on a valid transfer condition and appropriate safeguards under Article 9 of the KVKK.
CRM records are retained for the maximum period necessary to manage the request or quotation process, maintain the customer relationship, meet legal obligations and protect legal rights. Expired records are deleted, destroyed or anonymised in all relevant systems, including the CRM.
11. Cookies and similar technologies
The site may use essential, functional, analytics/performance and advertising/marketing cookies. Non-essential cookies are not activated without the user’s explicit consent unless another valid processing condition applies.
12. Commercial electronic messages and marketing
WhatsApp and telephone messages containing campaigns, promotions, quotations or product/service recommendations are sent only where demonstrable commercial communication consent compliant with legislation exists. Providing a privacy notice and obtaining commercial communication consent are separate; consent is not made a condition of service. Consent and opt-out records are managed through applicable İYS processes.
13. Transfer of personal data
Personal data may be transferred, limited by purpose and authority, to relevant Servis365 employees, the customer receiving the service, CRM, membership/authentication, hosting, communication, call centre and security providers, advisers and legally authorised public institutions. A customer conversation is not shared with another customer.
14. International transfers
Personal data may be processed abroad in activities using Meta/WhatsApp, CRM, membership/authentication or other overseas technology providers. Transfers rely on a valid condition and appropriate safeguards under Article 9 of the KVKK. Where required, a standard contract is signed and notified to the Personal Data Protection Authority within the period prescribed by legislation.
15. Retention and disposal
Personal data is retained for the maximum period necessary for the processing purpose, contractual relationship, legal obligations and protection of legal rights. Separate periods for message content and delivery records, call recordings, transcripts, contact/quotation form records, user accounts, session/security logs and CRM records are set out in the data processing inventory and retention and disposal policy. Data for which processing conditions have ended is deleted, destroyed or anonymised.
16. Data security
Servis365 uses appropriate technical and administrative measures, such as access control, authentication, permission limits, secure communications, logging, backups, incident management, employee training and supplier controls, to the extent actually implemented. Statements about security measures are kept current so they do not suggest that unimplemented controls exist.
17. Rights of the data subject
Under Article 11 of the KVKK, data subjects have the following rights:
- To learn whether their personal data is processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether data is used accordingly,
- To know the third parties to whom data is transferred domestically or abroad,
- To request correction of incomplete or inaccurate data,
- To request deletion or destruction where the legal conditions are met,
- To request notification of correction and deletion to third parties to whom data has been transferred,
- To object to an adverse result arising from analysis exclusively by automated systems,
- To seek compensation for damage caused by unlawful processing.
Applications may be made using the methods described under “Deletion of User Data” in this document.
18. Children’s data
Servis365 Santral and WhatsApp services are not designed for children. If a child’s personal data is believed to have been processed without authorisation, contact [email protected].
19. Policy changes and contact
This policy is updated in response to changes in legislation, services or data flows. The current version is published with its effective and last-updated date. Contact: [email protected], +90 850 288 8 365