Privacy & Data Protection Notice

1. Data Controller

• Entity: True Yapım ve Medya A.Ş. (operating the “Bansa” brand)
• Address: Çağlayan Mah. Zuhal Sk. No:45B, Kağıthane / İstanbul, Türkiye
• Registry (MERSİS) No: 0859119946100001 · Trade Registry No: 280936-5 · Tax Office/No: Kağıthane - 8591199461
• Email: destek@bansa.tech · Web: bansa.tech

2. Personal Data Processed

• Identity & contact: name, phone number, business name (if any)
• Call data: voice recording, transcript and AI-generated call summary
• Order/reservation data: delivery address, order contents, date-time, notes
• Security data: IP address, device/browser info, timestamps, logs
• Payment data: amount, date and transaction reference/result. Card details (PAN, expiry, CVV) are NEVER stored or seen by the Company, and the Company does NOT use card storage (see Section 8)

3. AI Voice Assistant & Call Recordings

Incoming calls are answered by an AI assistant and may be recorded for service quality, accuracy and dispute resolution. Recordings are transcribed and summarized using automatic speech recognition and large language model (LLM) technologies, processed via workflow automation (n8n). Recordings are held on the AI calling infrastructure (Retell AI); call summaries, appointments and transaction records are stored on cloud database infrastructure (Supabase). Data is processed solely to provide the service and is not sold to third parties for advertising.

4. Purposes

• Answering calls and handling orders/reservations
• Responding to requests and sending confirmation messages (WhatsApp/SMS)
• Measuring and improving service quality
• Payment and billing
• Security, fraud and abuse prevention
• Compliance with legal obligations

5. Legal Grounds

• Necessity for the establishment/performance of a contract
• Compliance with a legal obligation
• Establishment, exercise or protection of a right
• Legitimate interest, without harming fundamental rights
• Your explicit consent where required (e.g. cross-border processing of recordings)

6. Service Providers and International Transfers

To deliver the service, data is processed through the providers below. Server regions have been verified in the providers’ own consoles; this notice is updated and its version incremented whenever the list changes.

• SUPABASE — cloud database and hosting. Data: customer/patient records, appointments, call summaries and transaction logs. Server region: IRELAND (eu-west-1) — European Union. This covers the panel database ONLY; call recordings and transcripts are processed in the UNITED STATES on the Retell AI infrastructure below.
• RETELL AI — AI call answering infrastructure. Data: call recording, transcript, caller number. Server region: UNITED STATES. Recordings are kept for at most 90 days. Retell uses its own sub-processors (including a large language model provider) to deliver the service; their current list is published by Retell.
• META PLATFORMS (WhatsApp Business Platform) — delivery of appointment notifications, reminders and automation messages. Data: phone number and message content. Servers are located outside Türkiye.
• ORACLE CLOUD — hosting for the server running Bansa’s workflow automation (n8n). Data: appointment and contact details passing through during message delivery. Server region: UNITED STATES.
• IYZICO — payment infrastructure. Does NOT process patient data; it processes the business’s billing and payment data only. Servers are in Türkiye and iyzico acts as its own controller in that relationship. Card details never reach Bansa servers.

SAFEGUARDS IN PLACE. Each provider above is bound by its own data processing agreement covering confidentiality, security and processing only on instructions. These are contractual safeguards.

ROLE ALLOCATION — IMPORTANT. For a healthcare provider’s patient data, the CLINIC is the DATA CONTROLLER and Bansa is the processor. Establishing the legal basis for international transfer under KVKK Art. 9 — explicit consent, a standard contract with notification to the Board, an undertaking, or Board permission — is therefore the CLINIC’s obligation. Bansa supplies the information needed to meet it (provider, purpose, data category, server region) in the table above and supports the clinic in doing so. THIS DOES NOT REMOVE BANSA’S OWN OBLIGATIONS: as processor, Bansa must put appropriate contractual safeguards in place with the international sub-processors it uses, document them, and provide the relevant documentation on the clinic’s request.

For data where Bansa is itself the controller (business contact details, billing and support records), transfers are made under the contractual safeguards above and limited to what the service requires.

7. Cookies

We may use strictly necessary and performance cookies for site operation, security and anonymous usage statistics. You can manage cookies via your browser; blocking essential cookies may affect functionality.

8. Payment Data & iyzico

Payments for credits and monthly plans are processed via iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), a payment institution licensed under Turkish Law No. 6493. Your card details (number, expiry, CVV) are never seen, stored or recorded by the Company; they are handled directly by iyzico in line with PCI-DSS and secured via tokenization. The Company only sees the transaction result/reference.

Card details (number, expiry, CVV) are never seen, processed or stored by the Company; they are handled solely by iyzico per PCI-DSS. The Company does NOT store your card: every payment is a separate transaction you authorise with 3D Secure at that moment, and no charge is made without your authorisation. The Company retains only transaction records (amount, date, iyzico reference) for accounting and statutory retention.

9. Retention & Security

Personal data is retained for periods required by law, reasonable service periods and limitation periods needed to protect rights; thereafter it is deleted, destroyed or anonymized per KVKK. Data is protected with access controls, encryption, authorization and logging.

10. Your Rights (KVKK Art. 11)

• Learn whether your data is processed and request information
• Learn the purpose and whether it is used accordingly
• Know third parties to whom data is transferred (domestic/abroad)
• Request correction, or deletion when conditions are met
• Request notification of corrections/deletions to recipients
• Object to adverse automated decisions and claim damages

11. How to Apply

To exercise your rights, contact destek@bansa.tech or the postal address above. Requests are answered within statutory periods.

Contact & Updates

For questions and requests, reach us via our contact page. This notice may be updated in line with legislation and service changes; the latest version is always published here.