Data Processing

Data flow

Conversations and form submissions are turned into structured data that is understandable, processable and actionable for managers. Your business owns the data.

Roles and data minimisation

ArtificAgent may act as controller for website, quote and billing activities. Roles for live agent processing on a customer’s behalf are defined in the project agreement and data-processing schedule. Each flow collects only fields necessary for the defined task; card data never enters ArtificAgent systems.

Sub-processors (service providers)

To deliver the service we work with a limited number of infrastructure providers. These providers process only the necessary data, under contractual confidentiality and security obligations.

• Voice processing and speech infrastructure provider: processing of voice conversations.
• Hosting and infrastructure provider: website and application hosting.
• Email and communication infrastructure provider: notification and confirmation messages.
• Telephony/SIP infrastructure provider: call transport (depending on configuration).

International transfers and subprocessor changes

Where infrastructure processes or makes data accessible outside Türkiye, the data category, country/region, transfer purpose and applicable KVKK transfer mechanism are documented in the project data flow. Subprocessors are contractually governed by security, confidentiality, retention and deletion obligations, and material changes are notified to the relevant customer.

Retention and destruction

Forms, calls, transcripts, quotes, agreements, payments and audit records are not kept under one blanket period; separate schedules apply by purpose and legal obligation. At expiry, deletion, destruction or anonymisation is performed and subprocessor copies are tracked contractually.

Security

Access is restricted by role and need; appropriate controls in transit and at rest, server-side validation, rate limiting, bot protection, secret management and audit logging are applied. Payment callbacks use signature checks, amount matching, idempotency and replay protection. We do not claim any certification we do not hold.