What we do with your data under KVKK and GDPR

Our position

• KVKK (Law No. 6698): We are the processor for data tenants enter, and the controller for our own subscribers and site visitors. Data security obligations (Article 12) apply to us in both roles.
• GDPR (2016/679): For tenants processing data of people in the European Union we act as a processor within the meaning of GDPR Article 28, and we sign a matching data processing agreement on request.

Cross-border transfer

The platform runs in a data center in Germany. Since the Personal Data Protection Board has not issued an adequacy decision for Germany, sending data from Türkiye to these servers is a cross-border transfer under KVKK Article 9; we do not claim that it is exempt because it is in Europe. Accordingly, we are carrying out the process of signing the Board’s standard contracts with recipients and notifying the Authority under Article 9(4)(c). Some subprocessors (such as email, network security and AI features switched on by the company owner) may process data outside Türkiye and Germany too; all of them are listed with their locations on the subprocessors page.

For the data you enter on the platform (your customers, leads and incoming messages), the transfer chain is:

• You and Müşavir: You are the data controller and Müşavir is the processor. Our data processing agreement covers processing on infrastructure in Germany and the cross-border transfer terms.
• Müşavir and the infrastructure provider: This is where data leaves Türkiye for servers in Germany; the Board’s processor-to-processor standard contract is used and notified to the Authority.
• Müşavir and AI providers: When the company owner switches AI features on, data goes through OpenRouter (USA) to Anthropic (USA); this is also a cross-border transfer under KVKK Article 9. The providers are listed with their locations on the subprocessors page.
• You and your own customers: Informing your own data subjects (your customers, people who message you) about this processing and the cross-border transfer, and obtaining explicit consent where needed, is your obligation as the data controller.

Data subject rights

How to apply for the rights under KVKK Article 11 and GDPR Articles 15 to 22:

1. If your relationship is with a company that uses Müşavir (as its customer, employee or supplier), apply to that company.
2. If your relationship is directly with us, apply in writing by one of the routes listed in the KVKK Privacy Notice (email, post or secure electronic signature); our application address is also on the contact page. Details are in our privacy policy.
3. KVKK requests are concluded within thirty days at the latest and free of charge as a rule (Article 13).

Automated decisions and AI

KVKK Article 11(1)(g) grants a right to object to an adverse result produced solely by automated analysis, and GDPR Article 22 provides similar protection. AI assistants on the platform produce suggestions, drafts and answers, and may perform internal workflow steps such as routing a request to the right team. AI does not message the person or make payments or official submissions; every action that leaves the company waits for a person’s approval, and every AI action is logged.

If the overnight automated task is on, the AI looks at the previous day’s conversations and updates the lead record’s stage, full name and short needs profile without waiting for approval. The update is made to the record inside the company: the AI does not message the person, change assignments or open proposals. Records already converted to customers are not changed. Every change is written to the status history and the audit trail with an “AI” label; your team can correct the change from the panel, and your company can switch the task off at any time. If a person believes this update produces an adverse result for them, they object to the company that is the data controller; the company can review and correct the record.