Data processing agreement.

Who is who

• You, the client, for example a clinic: the data controller (“veri sorumlusu” under KVKK). You decide why and how your customers' data is used.
• WildZero: the data processor (“veri işleyen”). We use the data only to run the service for you, on your instructions.

WildZero: legal company name, address, Istanbul, Turkey, MERSİS and tax number.

The data we hold about you as our client, such as your name and invoices, is covered by our privacy notice. There, we are the controller.

Subject and duration

The agreement covers the data our systems handle under the offer you sign: messages, bookings, reminders, reviews and reports. It starts when you sign the offer. It lasts as long as the service runs, plus the time we need to return or delete the data (see At the end).

What we do with the data

• Receive messages on your WhatsApp, Instagram and Messenger, and answer from the answers you approved.
• Pass questions the assistant can't answer to your team, and let your team take over a chat.
• Book, move and remind about appointments.
• Ask for reviews and follow up after a visit, if you switch these on.
• Make reports for you.

We never sell your data and never use it for our own marketing.

We use AI providers on terms that do not let them train their models on your data.

Types of data and people

The people are your customers or patients who write to you, and your own team members who use the system.

• Messages: what customers write, and what the assistant or your team replies, including voice notes and files they send.
• Contact details: name, phone or WhatsApp number, Instagram or Facebook name, email if given, language.
• Booking data: appointment times, the service or treatment asked about, time zone, reminders and answers to them.
• Clinics only, photos and health data: photos patients send, for example of their teeth or hair, and health details they share. This is special category data (KVKK Article 6, GDPR Article 9) and gets the strictest care.
• Your team: names and Telegram accounts of the people who get alerts.

Please don't send us data we don't need, such as ID numbers or card details.

Our duties

• Use the data only on your documented instructions: this agreement, your offer and the settings you choose in the system. If we think an instruction breaks the law, we tell you.
• Keep it secure (see Security).
• Use only the subprocessors on our list (see Subprocessors).
• Help you answer people who ask to see, correct or delete their data, and help with risk assessments and questions from the KVKK Board or an EU authority.
• Keep a record of the processing we do for you.
• Tell you if a court or authority asks for your data, unless the law forbids us to tell you.

Your part

• Have a legal basis for the data and give your customers your privacy notice (“aydınlatma metni”).
• The assistant can send a link to your privacy notice in its first reply.
• For clinics: get the patient's explicit consent before asking for photos or health details, where the law needs it. Lawyer to check
• Only message people who wrote to you first or agreed to hear from you.
• Keep your own accounts, such as Meta and your calendar, secure.

Confidentiality

Only people at WildZero who need your data to run or fix your system can see it. Each of them has signed a confidentiality promise that lasts after they leave.

New answers saved to your knowledge base are stored without names or private details.

Subprocessors

We use other companies to run the service, for example the messaging channels, the database and the AI models. They are listed, with what each one sees and where, on our subprocessors page.

• Each one is bound by data protection terms at least as strict as this agreement.
• We tell you number days before we add or replace one. If you object for a good data protection reason, we look for another way, or you can end the affected service without a fee.
• We stay responsible to you for their work.

Data sent abroad

Some of our subprocessors are outside Turkey, for example in the EU or the US. Before any data goes abroad:

• KVKK: we sign the Personal Data Protection Board's standard contract with the provider (KVKK Article 9, as changed in 2024) and notify the Personal Data Protection Authority within 5 business days of signing.
• GDPR: for clients in the EU, we use the EU Standard Contractual Clauses: controller to processor between you and us, processor to processor with our providers. Where a US provider is certified under the EU–US Data Privacy Framework, that can be used instead.
• Each provider's location is on the subprocessors page.

Lawyer to check which of the Board's standard contract types fits each flow, who sends the notice, and whether health data needs extra steps.

Security

We protect your data with technical and organisational measures that fit the risk, especially for health data. The full list is on our security page and is attached to the agreement. In short:

• Data is encrypted on its way between systems, and we choose providers that encrypt stored data.
• Two-step login on every admin account, and access only for the people who need it.
• Photos and files are stored privately. Only your team can open them.
• Customers can stop all messages by writing STOP, and every part of the system can be switched off.
• We get an alert when something in the system breaks.

If something goes wrong

• If there is a data breach that affects your data, we tell you without undue delay, and within number hours of finding out.
• We tell you what happened, which data and how many people, what we are doing about it, and who to contact.
• We help you notify the KVKK Board within 72 hours, and the people affected where the law needs it. Under GDPR, the 72-hour deadline is also yours as the controller. Lawyer to check

At the end

When the service ends, you choose: we send your data back in a common format (for example a spreadsheet and the original files), or we delete it. We do this within number days and confirm in writing. Copies in backups are gone within number days.

We keep only what the law makes us keep, such as invoices.

Audits

You can ask for the information you need to check that we keep this agreement. We answer with documents first, to keep costs down. If that is not enough, you or an auditor bound by confidentiality can audit us once a year, or after a breach, with number days' notice and at your cost. Lawyer to check

Liability

Each side is responsible for its own breaches of data protection law. Lawyer to write The expected starting point is the same limit as in our terms, except where the law does not allow a limit.

Signing

• The DPA is signed together with your offer. If the DPA and another document disagree on data protection, the DPA wins.
• Attached: A. details of the processing (the sections above), B. security measures, C. the subprocessor list.
• Turkish law and Istanbul courts, as in our terms. For EU clients, the Standard Contractual Clauses follow their own rules. Lawyer to write