Data processing agreement.

Who is who

• You, the client, for example a clinic: the data controller (“veri sorumlusu” under KVKK). You decide why and how your customers' data is used.
• WildZero: the data processor (“veri işleyen”). We use the data only to run the service for you, on your instructions.

WildZero is run by Talha Düz, an individual business (sole trader), based in Bayrampaşa, Istanbul, Türkiye. Contact: [email protected], WhatsApp or phone +90 507 278 78 56.

The data we hold about you as our client, such as your name and invoices, is covered by our privacy notice. There, we are the controller.

Subject and duration

This agreement covers the data our systems handle under the offer you sign: messages, bookings, reminders, reviews and reports. It starts when you sign the offer. It lasts as long as the service runs, plus the time we need to return or delete the data (see At the end).

What we do with the data

• Receive messages on your WhatsApp, Instagram and Messenger, and answer from the answers you approved.
• Pass questions the assistant can't answer to your team, and let your team take over a chat.
• Book, move and remind about appointments.
• Ask for reviews and follow up after a visit, if you switch these on.
• Make reports for you.

We never sell your data and never use it for our own marketing.

We do not use your data to train AI models. We use the AI providers' business (API) services, not their consumer apps.

Types of data and people

The people are your customers or patients who write to you, and your own team members who use the system.

• Messages: what customers write, and what the assistant or your team replies, including voice notes and files they send.
• Contact details: name, phone or WhatsApp number, Instagram or Facebook name, email if given, language.
• Booking data: appointment times, the service or treatment asked about, time zone, reminders and answers to them.
• Clinics only, photos and health data: photos patients send, for example of their teeth or hair, X-rays and health details they share. This is special category data (KVKK Article 6, GDPR Article 9). It is shared only with your own team.
• Your team: names and Telegram accounts of the people who get alerts.

Please don't send us data we don't need, such as ID numbers or card details.

Our duties

• Use the data only on your documented instructions: this agreement, your offer and the settings you choose in the system. If we think an instruction breaks the law, we tell you before acting on it.
• Keep it secure (see Security).
• Use only the subprocessors on our list (see Subprocessors).
• Help you answer people who ask to see, correct or delete their data: we pass any such request we receive to you, and find, export or delete the data you ask for. We also help with risk assessments and questions from the KVKK Board or an EU authority.
• Keep a record of the processing we do for you.
• Tell you if a court or authority asks for your data, unless the law forbids us to tell you.

Your part

• Have a legal basis for the data and give your customers your privacy notice (“aydınlatma metni”).
• The assistant can send a link to your privacy notice in its first reply.
• For clinics: get the patient's explicit consent before asking for photos or health details, where the law requires it.
• Only message people who wrote to you first or agreed to hear from you.
• Keep your own accounts, such as Meta and your calendar, and your admin and staff codes secure.

Confidentiality

Access to your data is limited to the owner of WildZero, and only to run or fix your system. Anyone who helps us in the future will only get access after signing a confidentiality promise that lasts after they leave.

The assistant answers only from the information bank you approved. Each client's data is kept separate from every other client's.

Subprocessors

We use other companies to run the service, for example the messaging channels, the database and the AI models. They are listed, with what each one does and where, on our subprocessors page.

• Each one is bound by its own data protection terms, which we check before we use them.
• We tell you in advance, in writing, before we add or replace one. If you object for a good data protection reason, we look for another way, or you can end the affected service without a fee.
• We stay responsible to you for their work.

Data sent abroad

Several of our subprocessors are outside Turkey: in the USA, the EU (Germany), Japan (our database currently runs in Tokyo; we plan to move it to the EU) and the UAE. So personal data is transferred abroad.

• KVKK: under KVKK Article 9 (as amended in 2024), we rely on the providers' standard contractual clauses, or on explicit consent where that is required.
• GDPR: if you are in the EU, tell us and we agree the EU Standard Contractual Clauses with you where they are needed.
• Each provider's location is on the subprocessors page.

Security

We protect your data with technical and organisational measures that fit the risk, especially for health data. More detail is on our security page. In short:

• Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our providers.
• Access is limited to the owner of WildZero. Your dashboard is opened with a personal admin or staff code.
• Photos, X-rays and health details are shared only with your own team.
• Customers can stop all messages by writing STOP, and every part of the system can be switched off.
• We get an alert when something in the system breaks.

If something goes wrong

• If there is a data breach that affects your data, we tell you without undue delay, and within 72 hours of becoming aware of it.
• We tell you what happened, which data and how many people, what we are doing about it, and who to contact.
• As the controller, you notify the KVKK Board (and, under GDPR, your EU authority) within 72 hours, and the people affected where the law requires it. We give you the information and help you need to do this.

At the end

When the service ends, you choose: we send your data back in a common format (for example a spreadsheet and the original files), or we delete it. We do this within 30 days and confirm in writing. Patient voice notes are deleted after 30 days in any case.

We keep only what the law makes us keep, such as invoices and contract records (10 years under Turkish tax and commercial law).

Audits

On reasonable request, you can have the information you need to check that we keep this agreement. We answer with documents first, to keep costs down. If that is not enough, you or an auditor bound by confidentiality can audit us, with reasonable notice, at a reasonable time and at your cost.

Liability

Each side is responsible for its own breaches of data protection law. Otherwise, liability is handled as in our terms.

Signing

• You accept this agreement by signing our offer or service agreement; no separate signature is needed. If this agreement and another document disagree on data protection, this agreement wins.
• Details of the processing are in the sections above, security measures on our security page, and the subprocessor list on our subprocessors page.
• This agreement is governed by Turkish law, and the courts of Istanbul have jurisdiction, as in our terms.