1. Scope and data-processing roles
Yasha Systems LLC (“Yasha,” “we,” or “us”) is the controller where it determines the purposes and means of processing for website enquiries, its own business relationships, user accounts, security, and operational notifications managed by Yasha. Contact us at [email protected].
When Yasha's voice agent answers calls for a real-estate office or another business customer, that business will usually be the controller of caller and lead data, and Yasha processes the data on the business's documented instructions as its processor or service provider. The notice given at the beginning of the call and the relevant business's own privacy notice also apply. The business decides what information the call should collect, why it is collected, and how follow-up occurs.
This notice is not a consent form. Privacy notice and consent are separate processes; we request consent separately only where it is required for a particular activity.
2. Data we may handle
- Identity and contact: name, phone number, email address, company, user-account details, and role.
- Call and lead: call time and duration, the caller's request, property preferences, area, budget, timing, appointment or callback request, and call summary.
- Audio and text: where enabled for the deployment and legally permitted, call recordings, transcripts, and AI-generated summaries.
- CRM and usage: lead status, assigned consultant, notes, follow-up actions, user role, and action history.
- WhatsApp: notification number, recorded operational-message opt-in and its source, opt-out records, the version of the statement shown, delivery/read/error status, and consultant status replies.
- Technical and security: IP address, timestamps, request and error logs, browser/device information, session, and security events.
- Enquiries: messages you send us and the information you provide so we can respond.
The service is not designed to request sensitive personal data. Please do not volunteer unnecessary health, biometric, political-opinion, or similarly sensitive information during a call. If such information is volunteered, the relevant controller should restrict or delete it in line with applicable law.
We may obtain data from you, from Yasha's business customer, automatically during a call, WhatsApp exchange, or panel session, and from communications or infrastructure services.
3. Purposes and legal bases
We handle data to answer and route calls; qualify enquiries; create CRM records and call summaries; notify the correct team member; verify user access; provide support; operate and secure the service; troubleshoot; prevent misuse; meet legal obligations; and establish, exercise, or defend legal rights.
The applicable legal basis depends on the relationship, jurisdiction, and activity. It may include performing or taking steps related to a contract, complying with law, establishing or defending rights, legitimate interests that do not override individual rights, or data deliberately made public for the relevant purpose. Where no other lawful basis applies and the law requires it, we request specific consent separately.
Where Yasha acts as processor for a customer, that customer determines the purpose and lawful basis for processing.
5. International transfers
Some communications, AI, hosting, or support providers may be established outside Türkiye or process data in more than one country. Personal data may therefore be transferred internationally depending on the enabled service and deployment.
For transfers subject to Türkiye's Law No. 6698, the relevant controller must assess the conditions and mechanism under Article 9. Depending on the transfer, this may involve an adequacy decision, appropriate safeguards such as standard contracts, authorization by the Board, or a legally permitted occasional-transfer exception. For transfers under Yasha's control, Yasha uses the applicable permitted mechanism and technical/organizational safeguards; where Yasha is a processor, it provides information and assistance appropriate to its role.
See the Turkish Personal Data Protection Authority's official international-transfer resources for the current framework.
6. Retention and security
We retain data for as long as needed to provide the relevant service, follow contracts and customer instructions, preserve security records, comply with law, and manage potential disputes. The period varies with the data type, customer configuration, relationship, and applicable requirements. When the conditions for processing end, data is deleted, destroyed, or anonymized as applicable.
We use risk-appropriate measures such as access controls, separation of permissions, available encryption, logging, backups, and provider controls. No internet transmission or storage system can guarantee absolute security.
7. WhatsApp consultant notifications
The WhatsApp flow is designed to message only an authorized consultant whom the real-estate office assigned to the customer opportunity and who confirms from the mapped WhatsApp number that they want these operational notifications. After the consultant agrees to receive one generic activation invitation, the office manager records that limited permission, its timestamp, and the displayed statement version in the Ekip panel. The invitation contains no customer information. Merely importing or adding a number is not activation. We do not use this flow for advertising or promotional marketing.
The assigned consultant sees the information needed to return the call in the WhatsApp message—normally the customer's first name and surname initial, phone number, and a short request summary. We do not add the call transcript, recording link, or unnecessary private notes to this notification. The consultant calls from their own mobile service; this first version does not bridge the consultant and customer through Twilio or record the consultant's call through Yasha.
The consultant may report the follow-up state using Aldım (accepted), Ulaşamadım (unreachable), or Kapatıldı (closed). These are self-reported states and do not mean that we independently verified a phone call occurred.
The manager's record permits the generic activation invitation only. Customer-opportunity delivery starts only after the exact mapped number taps or sends BAŞLAT; this inbound confirmation records the statement version, time, number, and source. The consultant does not need to repeat BAŞLAT each day. Notifications can be stopped at any time by replying STOP or DUR on WhatsApp. We may retain the opt-out record as needed to honor the request and prevent unwanted re-enrollment. The consultant does not need to sign in to the panel for this flow.
Customer contact details may remain in the assigned consultant's WhatsApp history. The relevant real-estate office should manage its authorized-consultant list and device/account access. Use of WhatsApp is also subject to Twilio's, Meta/WhatsApp's, and other relevant communications providers' privacy terms and may require the international-transfer assessment described in section 5.
8. Your rights and how to contact us
Depending on the law that applies, you may have rights to know whether and how your data is processed; request access or correction; learn the purpose and recipients; request deletion, destruction, or notification to recipients; object to certain solely automated outcomes; withdraw consent where processing depends on consent; and seek a remedy for unlawful processing.
For processing where Yasha is the controller, email [email protected] with the subject “Privacy Request” and identify the data or activity concerned. We may need to verify your identity and authority before acting to protect your information.
For data connected with a call to a real-estate office, contacting that business as controller is usually the fastest route. If a request reaches Yasha, we will route or support it within our role and applicable legal limits.
For rights under Türkiye's Law No. 6698, see the Authority's official English text of the law.