1. Data controller
Your personal data is processed by Murat Cem Karaboğa (sole proprietorship, Türkiye) in its capacity as data controller, through Orbitix (an Alfred Agency brand), which it operates, for the scope, purposes and legal bases described in this notice, in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the relevant secondary legislation. This notice covers all natural persons who visit our website, use our forms or our AI assistant Orbi, request a demo, or contact us.
Data processed on behalf of businesses: For messages received on the Facebook Pages, Instagram professional accounts and WhatsApp Business numbers that businesses using Orbitix connect themselves, the business concerned is the data controller; Orbitix processes this data on behalf of the business and on its instructions, as a data processor. You can first direct requests about this data to the business concerned; if you write to us, we will forward your request to the business and help fulfil it. Details: Privacy Policy, section 9.
2. Definitions
- Personal data: Any information relating to an identified or identifiable natural person.
- Processing: Any operation performed on data, such as obtaining, recording, storing, updating, transferring or classifying it.
- Data subject: The natural person whose personal data is processed (you).
- Explicit consent: Consent relating to a specific matter, based on information, and expressed by free will.
3. Personal data processed
- Identity and contact: Full name, phone, email.
- Company/customer information: Information you share such as company name, industry, requested service, and number of employees.
- Request/transaction information: Messages, requests and complaints you submit through the site forms and the Orbi assistant.
- Transaction security and technical data: IP address, browser/device information, cookie records, and site usage logs.
- Social media and WhatsApp messages: messages and comments you send to Orbitix's own Facebook Page, Instagram account and WhatsApp line.
- Message data processed on behalf of businesses (as data processor): message content; page- or account-scoped ID (PSID / IGSID) or WhatsApp number; profile information shared by Meta (such as name, username and profile picture); message time and delivery status; the access tokens issued by Meta for the connection.
4. Method of data collection
Your personal data is collected through the contact, demo and industry forms on our website, conversations with the AI assistant Orbi, email and phone communications, and cookies and similar technologies; message data processed on behalf of businesses is collected through Meta's APIs from the accounts a business connects itself via Facebook Login for Business; in both cases by automated and partially automated means.
5. Purposes of processing
Your data is processed for the purposes of preparing and presenting a demo tailored to you, managing your requests and complaints, providing, maintaining and improving the service, conducting contractual processes, carrying out communication and marketing activities (where you have given explicit consent), ensuring information security, and fulfilling legal obligations.
6. Legal basis (KVKK art. 5)
Your data is processed on the legal grounds of its being necessary for the establishment or performance of a contract, our fulfillment of a legal obligation, our legitimate interest provided that it does not harm your fundamental rights and freedoms, and, where required, your explicit consent. Marketing communications are carried out only with your explicit consent; you may withdraw this consent at any time.
7. Retention period
Your personal data is retained for the periods required by the purpose of processing and stipulated in the relevant legislation; expired records are deleted, destroyed or anonymized by an automatic clean-up that runs every day:
- WhatsApp message records: at most 12 months.
- Facebook and Instagram direct messages and comments: at most 12 months.
- Records deleted in a business panel: kept restorable for 90 days to protect against accidental deletion, then permanently deleted.
- Access tokens: for as long as the connection exists; deleted immediately when the connection is removed or the app is uninstalled.
- Connection records (no tokens): the record of which Page and account were connected is kept for at most 12 months after the connection ends, then deleted automatically.
- Encrypted off-site backups: at most 14 days.
- Account and contact information: for as long as the service relationship lasts; within 30 days of a deletion request.
- Invoices and payment records: for the period required by law.
8. Transfer of data (KVKK art. 8-9)
Your data may be transferred, to the extent necessary for the provision of the service, to the following subprocessors and service providers and to legally authorized public institutions and organizations. We do not sell your data; we do not use message data processed on behalf of businesses for advertising or targeting, and we do not share it with other businesses.
- GNET / Güzel Hosting (Türkiye): application server and database; permanent records are stored here.
- OVH (France, via Güzel Hosting): website hosting and the encrypted off-site backup of the database.
- Cloudflare: security layer protecting access to the Orbitix team's internal admin tools.
- Meta Platforms (WhatsApp, Facebook, Instagram): receiving and sending messages.
- Google (Gemini): conversation text for AI replies and reply drafts; may be processed in any country where Google has facilities.
- Anthropic (Claude, USA): internal operations of the Orbitix team only; message content, identifiers and access tokens from Facebook, Instagram and WhatsApp connections are not transferred.
- Meta and Google advertising services: Orbitix's own promotion and ad management that businesses request for themselves.
Transfers to providers with servers located abroad are carried out only to the extent necessary for the service and in accordance with the provisions of the KVKK regarding transfers abroad.
9. Cookies
Our site may use cookies to improve your experience and provide essential functions. For details about cookies, you may review our Privacy Policy page. You can manage or delete cookies through your browser settings.
10. Data security
To prevent unlawful processing of and access to your personal data and to ensure its preservation, we take the following technical and administrative measures: all connections are encrypted with HTTPS; Meta and Google access tokens are stored encrypted at the application layer in the database and the encryption key is kept separately from the database; off-site backups are encrypted with AES-256 and transferred over an encrypted connection; server access is limited to authorized team members and requires authentication; each business's data is bound to its own workspace and one business cannot access another business's data; access and transaction records are kept.
11. Your rights as a data subject (KVKK art. 11)
Under the Law, you have the rights to learn whether your personal data is being processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in accordance with that purpose, to know the third parties to whom it is transferred domestically or abroad, to request correction if it has been processed incompletely or incorrectly, to request its deletion/destruction when the relevant conditions arise, to request that these operations be notified to third parties, to object to a result that arises against you as a consequence of the analysis of the processed data through automated systems, and to request the remedy of any damage in the event that you suffer harm.
12. Application
To exercise your rights, you may apply to us in writing through our contact page. Your application is concluded as soon as possible depending on the nature of the request, and in any case within thirty days at the latest, as a rule free of charge.
13. Changes
This notice may be updated in line with changes in legislation and our services. The current version is always published on this page.