WhatsApp Privacy Policy
This policy explains how personal data is processed in conversations conducted through zWaPi, ZETU's application on the Meta WhatsApp Business Platform, and the OmniZetu communication platform. It serves as the privacy notice under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and Articles 13–14 of the EU General Data Protection Regulation (GDPR).
1. Who we are
Zetu Güvenlik Sistemleri Bilişim Telekomünikasyon Medya Sanayi ve Ticaret Limited Şirketi (“ZETU”, “we”), a company registered in Türkiye.
- Address: Üçevler Mah. Aslantaş Sk. No: 7 İç Kapı No: 9, Nilüfer / Bursa, Türkiye
- MERSIS (trade registry) no: 0998159689800001
- Tax office / no: Çekirge Vergi Dairesi – 9981596898
- Email: [email protected]
- Phone and WhatsApp: +90 850 611 06 12
2. Our role
ZETU acts in one of two roles:
- Controller: when you message ZETU's own WhatsApp line (+90 850 611 06 12), ZETU processes your data for its own purposes.
- Processor: when a business uses our zWaPi/OmniZetu infrastructure to message you on WhatsApp, that business is the controller of your data. ZETU processes the data only on that business's instructions and under our data processing agreement with it. To exercise your rights, contact that business first; we forward any requests we receive to the relevant business.
3. Data we process
| Category | Examples |
|---|---|
| Identity and contact | Phone number, WhatsApp profile name, any name and email you share |
| Message content | Text, photos, videos, voice notes, documents, contact cards, shared locations |
| Transactions and requests | Support tickets, order and appointment details, conversation notes |
| Technical records | Message IDs, timestamps, delivery and read statuses |
| Consent records | Opt-ins to promotional messages and opt-out records |
| Business customer account data | WhatsApp Business account and phone number IDs, display name, business profile, message templates, access tokens received from Meta (stored encrypted), names and emails of dashboard users |
4. Purposes and legal bases
| Purpose | GDPR | KVKK |
|---|---|---|
| Answering your questions and support requests | Art. 6(1)(b), 6(1)(f) | Art. 5/2-c, 5/2-f |
| Sending order, appointment and service notifications | Art. 6(1)(b) | Art. 5/2-c |
| Providing the platform service to our business customers | Art. 6(1)(b) | Art. 5/2-c |
| Security, abuse prevention and legal record keeping | Art. 6(1)(c), 6(1)(f) | Art. 5/2-ç, 5/2-f |
| Sending promotional messages | Art. 6(1)(a) (consent) | Art. 5/1 (explicit consent) and consent under Law No. 6563 |
| Establishing and defending legal claims | Art. 6(1)(f) | Art. 5/2-e |
We do not sell your data or use it to build advertising profiles. Data we receive from WhatsApp and Meta is used only to provide the service.
5. Automated replies and AI
Message content may be processed by AI models to classify and prioritise support requests and to draft suggested replies; outside business hours some replies may be sent automatically. This processing does not produce decisions based solely on automated processing that have legal or similarly significant effects on you. You can object to automated replies and ask to speak to a human agent at any time.
6. Who we share data with
- Meta Platforms (WhatsApp Business Platform): to deliver messages. Under the Cloud API, Meta processes the data on our behalf.
- Cloudflare: to route traffic to our platform securely.
- AI service providers (Google Gemini, ZETU LLM): for the purposes above, limited to the message content needed.
- Our business customers: where we act as processor, the business you are talking to.
- Competent public authorities: where required by law.
7. International transfers
ZETU is based in Türkiye, and the servers of Meta, Cloudflare and AI providers may be located elsewhere (e.g. the European Union and the United States). Transfers are made with appropriate safeguards: the European Commission's Standard Contractual Clauses or adequacy decisions under the GDPR, and the standard contracts published by the Turkish Personal Data Protection Authority under Article 9 of the KVKK.
8. How long we keep data
- ZETU's own conversations: 5 years after the conversation is closed, or longer where the law requires (e.g. 10 years for commercial records).
- Data processed for business customers: for the period the business sets; deleted or returned to the business within 30 days after the service ends.
- When the period expires, data is deleted, destroyed or anonymised.
9. Security
We encrypt data in transit, store access tokens encrypted, limit access to authorised staff and log that access. If a personal data breach occurs, we notify the competent authorities and affected individuals within the time limits set by law.
10. Your rights
Depending on where you live, you have the following rights under the GDPR (Articles 15–22) and the KVKK (Article 11):
- Access your data and obtain a copy
- Have inaccurate or incomplete data corrected
- Have your data erased
- Restrict processing and object to processing
- Receive your data in a structured format (data portability)
- Withdraw your consent at any time
- Learn which third parties received your data and have corrections or erasures passed on to them
- Contest an outcome against you resulting from automated processing
- Seek compensation for damage caused by unlawful processing
You may lodge a complaint with the data protection authority of your EU/EEA country of residence, with the Information Commissioner's Office (ICO) in the United Kingdom, or with the Personal Data Protection Authority (KVKK) in Türkiye.
11. Contacting us
Send requests to [email protected] or by post to the address above. After verifying your identity we respond free of charge within 30 days.
12. Opting out of promotional messages
You can stop promotional messages at any time by replying “STOP” (or “DUR” in Turkish) on WhatsApp or by using the opt-out option in the message. Order and service notifications are not affected.
13. Children
Our service is not directed at anyone under 18, and we do not knowingly collect children's data.
14. Changes
We may update this policy. The current version is always published on this page with its last-updated date.
Last updated: 27 September 2026