Customer data processing terms

Updated 29 October 2026. These terms form part of the service agreement for call, knowledge-file and connected-tool data processed on customer instructions. The Privacy and KVKK Notice separately explains processing for the provider’s own purposes.

The contract language is Turkish. English is an explanatory translation; Turkish governs a difference in meaning. Mandatory rights remain.

Download document

1. Roles and scope

The customer is controller where it determines call purposes, participants, agent instructions, uploaded content and connected tools. Zorbey Torunoğlu processes that data on customer instructions to provide the service. The provider acts separately as controller for its own account administration, payments, statutory records and security purposes. These roles do not remove either party’s legal responsibilities.

2. Subject and instructions

Processing covers real-time call audio, transcription and summaries, agent instructions and knowledge files, enabled tool actions and associated records. People concerned include callers, called persons, customer employees and people whose data the customer supplies. Data may include contact details, conversation content, timestamps, action records and selected file and tool content. Instructions consist of the accepted order, agent settings, tool permissions and verified customer requests. The provider may not use this data outside those instructions for its own advertising or service to another customer.

3. Customer duties

The customer must have authority over its numbers and content, establish the appropriate processing ground and inform people in time. Separate recording or marketing permission must be obtained where required. Enabling recording is not the caller’s consent. The customer must avoid unnecessary personal or sensitive data and give callers appropriate guidance. The general service must not be configured to collect special-category data; any such processing requires a separately lawful scope, security and processing conditions.

4. Provider duties

The provider must restrict access to personnel who need it, protect confidentiality and take technical and organizational measures appropriate to the data and risk. If an instruction is assessed as unlawful, it informs the customer and may suspend the affected processing while the issue is resolved. Binding legal demands are handled only to the necessary extent, with customer notice unless legally prohibited. General customer acceptance does not transfer the provider’s own security or lawfulness duties to the customer.

5. Service providers and overseas transfers

The customer authorizes the hosting, backup, telephone transmission and AI processing necessary for the service under these terms. OpenAI processes call audio and content; enabling Google, Microsoft or Telegram sends the data necessary for the selected action to that service. This contractual authority is not data-subject consent or a safeguard under KVKK Article 9. Each party must meet transfer conditions appropriate to its role; a route requiring safeguards for routine transfers cannot be used without them. The provider informs customers about subprocessors and material changes. A justified data-protection objection is addressed through disabling the affected feature or ending the service, with mandatory refunds considered. The provider retains its statutory responsibility for processors it selects.

6. Individual requests and incidents

The provider assists the customer with access, correction, deletion and other individual requests concerning the data it processes. Requests received directly about customer-controlled processing are referred to the customer where lawful; the provider handles requests about its own controller processing itself. On learning of a personal-data breach affecting customer data, it informs the customer without delay, shares known scope, affected data, effects and measures, and updates the information as it becomes available. This does not replace either party’s mandatory regulator or individual notifications in its own role.

7. Duration, return and deletion

Processing is limited to service needs and limited lawful retention purposes. The call-history retention policy is 90 days after call end for transcripts and summaries, and 30 days for optional stored audio and observed caller numbers. Independently exported copies are the customer’s responsibility. Stopping subscription charges does not immediately erase all data. On service end the customer may instruct return or deletion; records that must legally remain are isolated for that purpose with restricted access. Completed deletion decisions must be preserved when restoring backups. The provider informs the customer of the applicable operation’s scope and result.

8. Information and precedence

Customers may request reasonable information and verification concerning processing and security duties at hi@golubvoice.com. Information is supplied in a way that protects other customers and service security. For processing on customer instructions, these terms take priority over general use terms, without removing statutory rights or either party’s KVKK responsibilities. They do not replace the Turkish Board’s official standard contracts for overseas transfers.

Seller and service provider

Service: Golub Voice
Business name: Golub Superintelligence
Seller: Zorbey Torunoğlu
Tax identification number: 8570513849
Tax office: Kale Vergi Dairesi Müdürlüğü
Business address: Sularbaşı Mah. Afyon Sk. Tevfik Çorapçı Apt. No: 7, İç Kapı No: 8, Merkez/Sivas
Telephone: +90 554 596 06 36
Email: hi@golubvoice.com

Questions about these terms go to hi@golubvoice.com.