1. Data controller
For the processing described in this notice as our own, the data controller is Callibee, a company operating in Türkiye and the Netherlands. Contact: info@callibee.com
2. Scope
Callibee processes personal data in two roles:
- As a controller: website visitors, people who use the contact form or request a demo, and employees and representatives of our customers, suppliers and partners.
- As a processor: people called through Callibee on behalf of our customers, and people who call our customers. The business is the controller and is responsible for informing you and for having a legal basis. Callibee acts only on the business's instructions under a data processing agreement. This data is also covered by a non-disclosure agreement (NDA) with the business, and no data is processed before it is signed.
3. Categories of personal data
| Category | Examples |
|---|---|
| Identity | First and last name |
| Contact | Work email, phone number |
| Professional | Company, job title, department |
| Customer transaction | Requests and messages, meeting notes, demo requests, contract and quote details |
| Finance | Invoice and payment status. Card details are handled by our payment provider and are not stored by us |
| Transaction security | IP address, session and sign-in records, in-app activity records, server logs |
| Visual and audio recordings | Meeting and demo recordings, only with your explicit consent |
| Marketing | Product news and communication preferences |
As a controller, we do not aim to process special-category personal data.
4. Purposes of processing
- Carrying out communication activities
- Scheduling demos and meetings
- Contract processes and customer support
- Finance, accounting and invoicing
- Information security
- Improving our services, using aggregated or de-identified data
- Legal affairs
- Providing information to authorised persons and authorities
- Promotional and product-news communication, where you have given explicit consent
5. Legal grounds
We rely on the following grounds in Article 5 of the KVKK:
- Article 5/2(c): processing is directly related to the formation or performance of a contract.
- Article 5/2(ç): processing is necessary for the controller to comply with a legal obligation.
- Article 5/2(e): processing is necessary for establishing, exercising or protecting a right.
- Article 5/2(f): processing is necessary for the controller's legitimate interests, provided it does not harm your fundamental rights and freedoms.
- Article 5/1: explicit consent. Meeting and demo recordings, and promotional communication outside an existing customer relationship, rely on your explicit consent, which you can withdraw at any time.
6. How we collect data
We collect personal data electronically, by automated or partly automated means, through our web form, scheduling tool, email, meetings, the Callibee app and server logs.
7. Transfers
Within the purposes above, personal data may be transferred to:
- Service providers acting on our behalf, by category: cloud hosting, authentication, telephony and SMS, speech recognition and speech synthesis, language-model providers, email delivery, scheduling and payments.
- Competent public authorities and courts.
Personal data is stored and processed in data centres in the European Union, so personal data collected in Türkiye is transferred to the EU. Data is not transferred outside the European Economic Area.
Transfers follow Article 9 of the KVKK as amended by Law No. 7499 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, provided a condition in Article 5 or 6 is met. We rely first on an adequacy decision. Where none exists, we use appropriate safeguards such as the Board's standard contract, which the parties sign and which is notified to the Authority within five business days of signature. Only for incidental transfers where neither is possible do the exceptions in Article 9/6 apply.
8. Retention and destruction
We keep personal data for as long as the purpose and the law require. After that it is erased, destroyed or anonymised under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
Retention periods by category are set out in section 8 of our privacy policy.
9. People called through Callibee
If a business called you using Callibee, that business is the controller of your data.
We recommend that you apply to that business first. If you apply to us, we forward your request and help with the process.
For calls that are commercial electronic communications, obtaining consent and carrying out İYS (İleti Yönetim Sistemi) checks under Law No. 6563 on the Regulation of Electronic Commerce and its regulation is the obligation of the controller business.
10. Your rights as a data subject
Under Article 11 of the KVKK you may apply to the controller to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties to whom data is transferred in Türkiye or abroad,
- Request correction if data is incomplete or inaccurate,
- Request erasure or destruction under the conditions in Article 7,
- Request that correction and erasure or destruction be notified to the third parties to whom the data was transferred,
- Object to a result against you that arises from analysis of the data exclusively by automated systems,
- Claim compensation for damage caused by unlawful processing.
11. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply by writing to info@callibee.com, either signed with a secure electronic signature or mobile signature, or from an email address you have previously given us and that is registered in our systems.
Your application must include:
- First name, last name and signature
- Turkish ID number (for foreigners, nationality and passport number)
- A residence or workplace address for notification
- Email address and phone number, if any
- The subject of your request
We conclude applications free of charge and at the latest within 30 days, depending on the nature of the request. If the process requires extra cost, a fee under the Board's tariff may be charged.
If your application is rejected, the answer is insufficient or we do not reply in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.
12. Changes
We may update this notice. The current version is always published on this page.