1. Who we are
Callibee is a company operating in Türkiye and the Netherlands. We design and run AI call workflows for businesses. For the processing described in this policy as our own, Callibee is the data controller. We process personal data in line with the Turkish Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR).
2. Our two roles
We handle personal data in two different roles, and it helps to know which one applies to you.
- Controller. We decide why and how the data is used. This covers visitors to our website, people who use the contact form or book a demo, and staff of our customers, suppliers and partners.
- Processor. We act on behalf of a customer. This covers people our customers call through Callibee, and people who call our customers. In these cases the business is the controller. We process the data only on its documented instructions, under a data processing agreement.
If a business called you using Callibee, please contact that business first. If you write to us instead, we forward your request to them without undue delay.
3. Personal data we collect
As a controller, we collect the following.
- Contact form: your name, work email, company and the message you write.
- Demo bookings: the details you give our scheduling tool (Calendly) when you book a time.
- Customer and partner contacts: name, business email and phone number, job title, organisation, our correspondence and meeting notes.
- App accounts: name, business email, role, organisation, sign-in and security information, and an audit log of actions taken in the app.
- Billing: billing contact, company details, invoices and payment status. Card payments are handled by our payment provider, and we do not store full card numbers.
- Technical data in server logs: IP address, browser and device information, pages requested and timestamps.
- Meeting or demo recordings, only with your consent.
We do not ask for special-category data (such as health data or political opinions) from website visitors or business contacts. Please do not include it in messages to us.
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Answering enquiries and arranging demos | (b) steps taken before a contract, and (f) legitimate interests |
| Providing the services and the app, and giving support | (b) performance of a contract |
| Invoicing, accounting and tax | (c) legal obligation |
| Keeping our systems secure, preventing abuse and fixing errors | (f) legitimate interests |
| Improving our services using aggregated or de-identified usage information | (f) legitimate interests |
| Sending product news to business contacts | (f) legitimate interests for existing customers; otherwise (a) consent. You can opt out at any time |
| Recording a meeting or demo | (a) consent |
| Establishing, exercising or defending legal claims | (f) legitimate interests |
Where we rely on legitimate interests, we weigh them against your rights and expectations. You can object to this processing at any time (see section 10).
5. Call data we process for customers
When a customer uses Callibee to place or receive calls, we may process the called person's name and phone number, case details supplied by the customer (for example an invoice number or an appointment time), the call recording, a transcript, a summary, the outcome of the call and any follow-up actions.
- All data we process for a customer is covered by a non-disclosure agreement (NDA) with that customer. No data is processed before this agreement is signed.
- We process this data only on the customer's instructions.
- We do not sell this data, and we do not use one customer's data to serve another customer.
- Retention follows the customer's instructions. At the end of the service we delete or return the data, unless the law requires us to keep it.
- The customer is responsible for having a legal basis for the calls, including consent for commercial calls where it is required.
7. Where your data is stored
We store and process personal data in data centres in the European Union. We do not transfer it outside the European Economic Area.
Personal data collected in Türkiye is therefore transferred to the EU. These transfers follow Article 9 of the KVKK, as described in our KVKK notice.
You can ask us for a copy of the safeguards that apply.
8. How long we keep data
- Enquiries that do not lead to a contract: up to 24 months after our last contact.
- Customer and account data: for the length of the contract and up to 24 months afterwards.
- Invoices and accounting records: for the period required by applicable tax and commercial law.
- Server and security logs: normally no longer than 90 days, unless we need them to investigate an incident.
- Meeting recordings: up to 12 months, or until you withdraw your consent.
- Customer call data: as the customer instructs.
After these periods we delete or anonymise the data.
9. Security
We use appropriate technical and organisational measures to protect personal data. These include encryption in transit and at rest, role-based access, audit logging, managed encryption keys and need-to-know access for our staff.
No system is perfectly secure. If a personal data breach occurs, we notify the people and authorities concerned as the law requires.
10. Your rights
Under the KVKK and the GDPR, as applicable to you, you have the right to:
- Access your personal data and receive a copy.
- Have inaccurate data corrected.
- Have your data erased or its use restricted, where the law provides for it.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Receive your data in a portable format.
- Withdraw your consent at any time, without affecting earlier processing.
- Lodge a complaint with a supervisory authority: in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr), and in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
To use these rights, email info@callibee.com. We may ask you to confirm your identity. We reply within one month, and can extend this by up to two months for complex requests, in which case we tell you why. How to apply under the KVKK is described in the KVKK notice.
11. Automated decisions
We do not make decisions about website visitors or business contacts based solely on automated processing that has legal or similarly significant effects.
In customer call workflows, AI is used to understand calls and to suggest or carry out the routine next steps the customer has configured. Customers decide what must always go to a person.
13. Changes to this policy
When we change this policy, we publish the new version here with its date. We inform our customers of significant changes.
14. Contact
Callibee, İstanbul, Türkiye and Rotterdam, the Netherlands. Email: info@callibee.com