PRIVACY POLICY

Last Updated: September 30, 2025

1. Introduction

Dex360 is an AI-powered digital transformation platform with customer engagement and support automation features, provided by Konvo Teknoloji A.Ş. (“Konvotech,” “Konvo Teknoloji,” “we,” “our,” or “us”).

We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our platform, websites, and related services.

It also describes your rights and our obligations under applicable data protection laws, including:

By using our Services, you acknowledge and agree to the practices described in this Privacy Policy.

2. Definitions

For the purposes of this Privacy Policy:

  1. “Personal Data” means any information that relates to an identified or identifiable individual, such as name, email address, phone number, billing details, IP address, or other identifiers.
  2. “Processing” means any operation performed on Personal Data, whether automated or not, including collection, storage, use, disclosure, or deletion.
  3. “Data Controller / Business” means the entity that determines the purposes and means of processing Personal Data. In this case, this is Konvo Teknoloji A.Ş.
  4. “Processor / Service Provider” means a third party that processes Personal Data on behalf of the Data Controller/Business.
  5. “Data Subject / User / Consumer” means any individual whose Personal Data is processed by us.
  6. “Sensitive Personal Data” means data that requires higher protection, such as health data, biometric identifiers, or information about beliefs or orientation.
  7. “Cookies & Similar Technologies” means small files or tools stored on your device that help with authentication, personalization, analytics, or security.

3. Contacting Us About Data Protection

  1. The data controller for the processing activities described in this Privacy Policy is:

    Konvo Teknoloji A.Ş. Esentepe Mah. Akademiyolu Sk. Teknoloji Geliştirme Bölgeleri Sitesi B Blok No: 10b İç Kapı No: Z05 Serdivan / Sakarya, Türkiye

    Email: [email protected]

  2. If you have any questions or concerns regarding this Privacy Policy or our data protection practices, or if you wish to exercise your rights under the GDPR, the KVKK, or the CCPA/CPRA, you may contact us using the details above.

  3. We will respond to verified requests within thirty (30) days of receipt, unless applicable law allows us to extend this period. Depending on your jurisdiction, you may also have the right to lodge a complaint with your local data protection authority if you are not satisfied with our response.

4. Information We Collect

We collect different categories of personal information from both our business users (customers) and their end-users in the context of providing Dex360 Services. The categories of data we may process include:

  1. Profile and Business Information Name, job title, company name, business email, business phone number, billing and payment details.

  2. End-User Data

    • Conversations and interactions with Dex360-powered AI agents.
    • Content uploaded or provided by customers and their end-users, including documents, website data, or other materials integrated into Dex360.
    • Information exchanged via customer-chosen integrations (e.g., WhatsApp, Google Workspace, CRM systems, or other messaging platforms).

  3. Technical and Usage Data

    • IP address, browser type, operating system, device type and identifiers, language settings.
    • Log data related to your use of the Services (e.g., access times, activity logs, error reports).

  4. Third-Party Integrations Information exchanged with or obtained from integrated third-party services (e.g., WhatsApp, Google Workspace, CRM platforms, analytics tools, or messaging applications) to the extent necessary to enable and operate the requested integration.

  5. Cookies and Similar Technologies We use cookies, SDKs, and similar technologies to support essential functions (such as login and authentication), to analyze usage patterns and system performance, and to personalize your experience with our Services. For more details, please refer to the Cookies & Tracking Technologies section of this Privacy Policy.

  6. Sensitive / Special Categories of Data We do not intentionally collect or request sensitive personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, or biometric identifiers). However, customers and end-users may choose to upload or submit such data through Dex360. In such cases, the responsibility for ensuring that lawful grounds for processing exist (e.g., explicit consent) lies with the customer providing the data.

5. Children’s Data

  1. Dex360 is a B2B SaaS platform and is not directed to, or intended for, children under the age of 16. We do not knowingly collect or process personal data from children. Under the GDPR, we do not knowingly process data of users under 16 without appropriate consent. Under the CCPA/CPRA, we do not knowingly collect data from minors under 13, and for minors aged 13–16 we only process data with affirmative authorization.
  2. If you believe that a child has provided us with personal data without the necessary consent, please contact us at [email protected] and we will promptly delete such information.

6. How We Use Personal Data

We use the personal data we collect for the following purposes:

  1. Service Delivery – To provide and operate our AI-powered chatbot services, automation features, analytics, and related tools.
  2. Platform Improvement – To enhance functionality, monitor performance, fix bugs, and develop new features.
  3. Communication – To send product updates, security notices, support information, and, where permitted, marketing communications.
  4. Security & Abuse Prevention – To detect fraud, prevent misuse, protect accounts, and ensure the integrity of our systems.
  5. Legal Compliance – To comply with applicable laws, regulations, and enforceable requests from authorities.

We process personal data only where we have a valid legal basis to do so, including consent, contractual necessity, legitimate business interests, or legal obligations, as required under the GDPR, KVKK, and CCPA/CPRA.

No Sale of Personal Data: We do not sell personal data. Under the CCPA/CPRA, this also means that we do not “sell” or “share” your information with third parties for cross-context behavioral advertising without your explicit consent.

7. Sharing of Personal Data

We limit the sharing of personal data to what is strictly necessary and only with trusted parties under appropriate safeguards:

  1. AI Providers – Certain data may be processed by carefully selected AI service providers (such as OpenAI) solely for the purpose of generating responses. Such data is processed only to fulfill user requests and is never used to train, improve, or commercialize AI models.
  2. Hosting & Infrastructure – Personal data is securely stored in Hetzner data centers located in Germany and Finland. These facilities operate under robust data protection laws (including the GDPR) and apply strict technical and organizational safeguards. Beyond these essential hosting services, we do not currently engage external subprocessors for the processing of personal data.
  3. Third-Party Disclosures – We do not sell or rent personal data. Under the CCPA/CPRA, this also means we do not “sell” or “share” your personal information for cross-context behavioral advertising. Any limited disclosures we make are always governed by contractual safeguards and for legitimate purposes only.
  4. Legal & Regulatory Compliance – We may disclose personal data if required to do so by applicable law, regulation, legal process, or governmental request. We may also disclose information when necessary to protect our rights, enforce our agreements, ensure user safety, or respond to lawful requests by public authorities.

8. Data Storage & Security

  1. Data Location – All personal data is hosted within the European Union at Hetzner facilities in Germany and Finland, ensuring compliance with GDPR standards.
  2. Technical Safeguards – We implement industry-standard measures, including encryption at rest and in transit, role-based access control, network firewalls, and continuous monitoring.
  3. Organizational Safeguards – Access to personal data is strictly limited to authorized personnel on a need-to-know basis. All access is logged, monitored, and periodically reviewed.
  4. Resilience & Recovery – Our infrastructure is designed with redundancy and disaster recovery measures to minimize risks of data loss or downtime.
  5. Compliance Roadmap – We are continuously improving our security and privacy program. While not yet formally certified, we are actively working toward full GDPR alignment, SOC 2 compliance, and maintaining best practices in line with KVKK and international standards.

9. Data Retention

  1. Retention Period – We retain customer data only for the duration of the subscription or business relationship, unless a longer retention period is required by applicable law (for example, for tax or accounting obligations).
  2. Deletion on Termination – Upon termination of services, all customer data will be securely deleted from our active systems within 30 days, unless retention is required by law. Backup data will be overwritten in accordance with our standard backup lifecycle.
  3. On-Demand Deletion & Export – Customers may request data deletion or export at any time. Verified requests will be processed promptly and in compliance with applicable laws (GDPR, KVKK, CCPA).

10. International Data Transfers

As Dex360 is a global platform, personal data may be transferred to, or accessed from, other jurisdictions. Where required by law, we implement appropriate safeguards to protect cross-border data transfers, including:

These safeguards are designed to ensure that personal data remains protected to the same high standards regardless of where it is processed.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  1. Right of Access – Obtain confirmation of whether we process your personal data and, if so, receive a copy.
  2. Right to Rectification – Correct inaccurate or incomplete personal data.
  3. Right to Erasure (“Right to be Forgotten”) – Request deletion of your personal data, subject to certain legal exceptions.
  4. Right to Restrict Processing – Limit the ways in which we use your data.
  5. Right to Data Portability – Receive your personal data in a structured, commonly used, and machine-readable format, and transmit it to another controller where technically feasible.
  6. Right to Object – Object to the processing of your personal data, including for direct marketing purposes.
  7. Automated Decisions – Request human review of decisions made solely through automated processing, including profiling, that may significantly affect you.

12. Exercising Your Rights

To exercise any of the rights described above, please contact us at: [email protected]. We will respond to verified requests within 30 days, unless a longer period is permitted by law.

13. Cookies & Tracking Technologies

Dex360 uses cookies and similar technologies to support the operation of our Services and improve user experience. These technologies are used for:

  1. Login and Authentication – enabling secure sign-in and account management,
  2. Functionality and Preferences – remembering settings and improving user experience,
  3. Analytics – analyzing website and product usage to improve performance,
  4. Personalization and Security – tailoring features and protecting against misuse.

Users can manage cookie preferences through their browser settings. For EEA, UK, and Türkiye users, consent is obtained where required by law, and you may withdraw or adjust your preferences at any time. More details can be found in our Cookie Notice (if provided separately).

14. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We encourage you to review it periodically. Any material changes will be communicated through our website or, where appropriate, by email or in-service notification. The “Last Updated” date at the top of this document indicates when the most recent changes were made.

15. Questions or Complaints

If you have questions, concerns, or complaints about how we process your personal data, please contact us:

[email protected]

We will respond promptly and within the timelines required by law.

Depending on your location: