1. Data Controller
This Privacy Notice explains how your personal data is processed when you use our AI chatbot, voicebot (voice assistant) and web chat support services.
The data controller is:
Turistik Hava Taşımacılık A.Ş. Güzeloluk Mah. 1879. Sok. No: 148, Muratpaşa / Antalya / Türkiye
2. Scope of this Notice
This Privacy Notice applies to the processing of your personal data when you use our chatbot, voicebot (voice assistant) or web chat support channel made available through our website or other related digital platforms.
This Notice specifically relates to the use of our chatbot and voicebot services and should be read in conjunction with our General Privacy Notice, our Cookie Policy and any other privacy information provided to you through our website or customer interfaces.
3. Categories of Personal Data Processed
When you use our chatbot or voicebot services, we may process the following categories of personal data:
- Identity and contact data, such as your first name, last name, email address and telephone number.
- Communication data, including the content of your messages, questions, responses and attachments, as well as your interaction history within the conversation.
- Customer support and case management data, such as chat records, request history, ticket details, resolution notes and related customer service records.
- Technical and usage data, including the date and time of your interaction, session information, device and browser information, IP-related logs where applicable and system event logs.
- Customer record data, including customer or contact profile information created and maintained within our communication management systems.
- Voice data and transcripts: where you use our voicebot service, this includes the audio recording of your conversation and the text transcript generated from that recording. As voice data may constitute biometric data under certain circumstances, your explicit consent will be obtained before a voicebot conversation is initiated (see Section 5).
Where relevant, some of the personal data listed above may be linked to your existing customer profile or to previous interactions you have had with us.
4. Chatbot and Voicebot Services
When you initiate a chat, certain personal data, including your first name, last name, email address and telephone number, may be collected in order to create and manage customer records within our communication infrastructure.
The content of your chat messages is processed for the purposes of responding to your enquiries, assisting with your requests, ensuring continuity of communication and, where necessary, escalating your request to our support teams.
When you use our voicebot service, your spoken conversation is converted into text in real time using Speech-to-Text technology, and the bot’s responses are delivered in audio format using Text-to-Speech technology. Before a voicebot session begins, the consent process described in Section 5 is completed.
The chatbot and voicebot services are supported by third-party service providers. In particular:
- Our communications infrastructure provider may process your identity, contact and chat data for the operation of the chatbot and voicebot services, as well as for the creation and maintenance of customer records.
- AI-powered response generation may be carried out using third-party artificial intelligence technologies that analyse the content of your messages and generate, or assist in generating, responses.
- For the voicebot service, Speech-to-Text and Text-to-Speech conversions are performed through an integrated third-party voice technology provider (see Sections 8 and 9).
- Accordingly, your personal data may be processed both within the third-party systems used to operate the chatbot and voicebot services and within our own internal systems and databases.
5. Purposes of Processing
We process your personal data for the following purposes:
- to provide the chatbot and webchat support and voicebot services
- to identify you and create or maintain your contact or customer record
- to receive, manage, and respond to your requests, questions, complaints, or support needs
- to ensure service continuity and allow follow-up by our customer service teams where required
- to document customer communications and maintain service records
- to improve the quality, consistency, and efficiency of our customer communication processes
- to maintain the security, integrity, and proper functioning of our systems
- to detect misuse, fraud, unauthorized access, or other harmful activity
- to establish, exercise, or defend legal claims where necessary
- to comply with legal and regulatory obligations
Voicebot sessions are initiated through the chatbot interface. Before you are transferred to a voice conversation, you will be presented with an explicit consent step within the chatbot interface. During this step, you will be clearly informed that:
- your voice data will be recorded and processed for the purpose of Speech-to-Text conversion;
- the processing will be carried out through our voice technology provider, and your data may be processed abroad (see Section 9); and
- if you choose not to provide your consent, you will continue to have access to the text-based chatbot service.
Your consent is valid only for the relevant voicebot session. You may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of any processing carried out before your consent was withdrawn.
6. Legal Bases for Processing
Depending on the context of the interaction, your personal data may be processed on one or more of the following legal bases:
- where processing is necessary for the performance of a contract or in order to take steps at your request prior to entering into a contract
- where processing is necessary for our legitimate interests, including the operation of customer communication channels, service continuity, quality assurance, fraud prevention, system security, and the efficient handling of customer requests, provided that such interests do not override your fundamental rights and freedoms
- where processing is necessary for compliance with legal obligations applicable to us
- where required under applicable law, on the basis of your explicit consent. This includes the processing of voice data in connection with the voicebot service.
7. Use of AI-Supported Technologies
As part of our chatbot and voicebot services, AI-supported tools may be used to analyse the content of your chat messages or voice conversations for the purpose of generating, or assisting in generating, responses. In the case of the voicebot service, real-time Speech-to-Text (STT) and Text-to-Speech (TTS) processing also forms part of these AI-supported technologies.
These tools are used to improve response times, consistency and the overall efficiency of our services. However, the chatbot and voicebot may not always provide complete, accurate or appropriate responses in every situation. Where necessary, your request may be referred to a member of our staff for further review and handling.
We recommend that you do not share unnecessary sensitive personal data during your chatbot or voicebot interactions unless it is strictly required in order to address your request.
To the extent technically and operationally feasible, we take reasonable measures to ensure that the personal data shared with AI-supported systems is limited to what is necessary for the relevant processing purpose.
8. Recipients and Service Providers
Your personal data may be shared with, or made accessible to, the following recipients:
- our customer communications infrastructure providers, including providers supporting chatbot operations and the creation of customer records;
- AI technology providers supporting chatbot and voicebot response generation or related processing activities;
- our voice technology provider. For the purposes of Speech-to-Text (STT) and Text-to-Speech (TTS) processing, your voice data is transferred to an integrated voice technology provider. This provider acts as a sub-processor, and further details regarding this transfer are set out in Section 9;
- our internal customer support, operations, IT, legal, compliance and authorised management teams, on a need-to-know basis;
- other group companies or affiliated entities, where relevant and legally permissible; and
- public authorities, regulatory bodies, courts, law enforcement authorities or other third parties where required by law or where necessary for the establishment, exercise or defence of legal claims.
Any access to or sharing of personal data is limited to what is necessary for the relevant purpose and is subject, where applicable, to appropriate contractual, technical and organisational safeguards.
9. International Data Transfers
Because some of our technology providers or their sub-processors may operate internationally, your personal data may be transferred to and processed in countries outside your country of residence or outside the jurisdiction from which the data originates.
Where such international transfers take place, we implement the transfer mechanism required under applicable data protection law, including where relevant adequacy decisions, standard contractual clauses, or other legally recognized safeguards.
Our voice technology provider is established in the United States. For the purposes of Speech-to-Text (STT) and Text-to-Speech (TTS) processing, voice data is processed using this provider’s infrastructure located in the United States. This transfer is safeguarded through the Standard Contract under Article 9 of the Turkish Personal Data Protection Law (KVKK) and the Standard Contractual Clauses (SCCs) under the GDPR. Voice data is not retained on the provider’s servers once the required Speech-to-Text (STT) and Text-to-Speech (TTS) processing has been completed.
You may contact us for more information regarding the safeguards applied to international transfers where applicable.
10. Data Retention Periods
Your personal data will be processed and retained for as long as necessary to fulfil the purposes described in this Privacy Notice, including responding to your requests, maintaining customer records, managing customer communications, complying with legal obligations, resolving disputes and protecting our rights and legitimate interests.
The applicable retention periods may vary depending on the nature of the interaction, the relevant legal obligations and the operational requirements of the service.
Voice data is not retained on the voice technology provider’s servers once the required Speech-to-Text (STT) and Text-to-Speech (TTS) processing has been completed. The transcript generated from the conversation is subject to the same retention period as other customer records.
11. Sources of Personal Data
In most cases, the personal data processed through the chatbot or voicebot services is collected directly from you when you provide your information and communicate with us through chat or voice interaction.
Where appropriate, this information may be combined with or supplemented by personal data already held in our systems in connection with your existing customer relationship, previous requests, bookings, transactions or support history.
12. Requirement to Provide Personal Data
Certain personal data may be required in order to operate the chatbot or voicebot services or to respond to your request. If you do not provide the required information, we may be unable to initiate or continue the chat session, verify your request or provide effective support.
If you choose not to provide your consent for the use of the voicebot service, you may continue to use the text-based chatbot service.
13. Automated Processing
The chatbot and voicebot services may use automated processing to understand your messages or voice requests and to generate, or assist in generating, responses. However, unless explicitly stated otherwise, the chatbot and voicebot are not designed to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Where your request requires human assessment, intervention or decision-making, it may be referred to the appropriate teams for further handling.
14. Your Rights
Subject to the requirements and limitations of applicable law, you may have the following rights:
- to request access to your personal data;
- to request the rectification of inaccurate or incomplete personal data;
- to request the erasure of your personal data;
- to request the restriction of the processing of your personal data;
- to object to certain processing activities;
- where applicable, to request the portability of your personal data;
- where processing is based on your consent, to withdraw your consent at any time, including for the processing of voice data in connection with the voicebot service, without affecting the lawfulness of processing carried out before the withdrawal; and
- to lodge a complaint with the competent data protection authority.
If you wish to exercise your rights, you may contact us at:
15. Security Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or misuse.
These measures include access controls, role-based access restrictions, contractual safeguards with service providers, logging and monitoring where appropriate, and other reasonable security practices proportionate to the nature of the processing activities. Encryption is applied during the transmission and processing of voice data within the voicebot service.
16. Updates to this Notice
This AI Chatbot and Voicebot Privacy Notice may be updated from time to time to reflect changes in legal requirements, technical infrastructure, service providers or our data processing practices. The updated version will be made available through the relevant website or digital interface.