Chatinbox Privacy Policy

Introduction

Welcome to Chatinbox. Chatinbox is a cloud-based CRM platform that lets you bring your customer relationship and communication processes, including social messaging apps, together under one roof. This Privacy Policy explains how your personal data and other information is collected, used, transferred, stored and protected while you use the services offered by Chatinbox.

Chatinbox treats the protection of the confidentiality and integrity of personal data as a fundamental principle, and undertakes to comply with all applicable data protection rules, in particular the European Union General Data Protection Regulation (GDPR), the legislation on the protection of personal data in force in Türkiye and other relevant legislation.

By accessing or using the platform, you declare that you have read and understood this Privacy Policy and that you accept the principles set out in it. If you do not accept any part of this Policy, please do not use the Chatinbox services.

1. Scope

1.1. This Privacy Policy applies to:

• the Chatinbox website and web application,
• Chatinbox mobile applications,
• the Chatinbox API and its integrations,
• all personal data processed through the support and communication channels offered by Chatinbox.

1.2. When we process end-user data on behalf of our corporate customers, we act in most cases as a data processor. For data such as our own user accounts, billing and security logs, however, we may hold the capacity of data controller. This distinction is defined separately on the basis of contracts and processes.

2. Definitions

2.1. Within this Policy:

• Chatinbox / the Company: Inbox Limited. Registered address: İstanbul, Türkiye.
• Services: covers all products and services offered by Chatinbox; web, mobile and API-based solutions.
• Personal Data: any information relating to an identified or identifiable natural person.
• Data Subject: the natural person whose personal data is processed; may be a Chatinbox user, customer, prospective customer, supplier or visitor.
• Data Controller / Data Processor: the natural or legal person who, under applicable legislation, determines the purposes and means of processing personal data, or processes them on behalf of the data controller.

3. Types of information

3.1 Information users provide directly

The information you send us directly while using our services may include:

• account and profile information (such as first name, surname, work email, phone number, company title and role),
• user content you create and send through Chatinbox (messages, conversation records, attachments, files, images, videos, voice recordings),
• invoice information used in subscription and billing processes and references relating to payment instrument details,
• your support requests, feedback, complaints, survey answers and other written or verbal correspondence with Chatinbox.

3.2 Information collected automatically

When you use Chatinbox, our systems may automatically process various technical data:

• device and browser information (such as browser type, operating system, device type, language preference),
• IP address and approximate location based on the IP address,
• sign-in and sign-out times, session duration, pages and features accessed,
• technical data on system performance, errors and log records,
• usage statistics obtained through cookies and similar technologies.

In most cases this information does not directly reveal your identity; however, when combined with other information it may become personal data.

3.3 Information obtained from third parties

If you use our services integrated with certain third party services, we may receive specific information from those providers. For example:

• conversation content and metadata through integrations with WhatsApp, Instagram, Facebook or other messaging platforms,
• usage patterns and performance information through analytics tools such as Google Analytics,
• limited information arising from your social media interactions relating to Chatinbox.

We would remind you that in such integrations the privacy policies of the relevant third parties also apply.

4. Purpose of use

4.1. The personal data collected may be used for the following purposes:

• to provide, operate, maintain and improve the Chatinbox services,
• to carry out account creation, identity verification and secure sign-in,
• to let you run message and customer relationship processes and to make communication within the team easier,
• to manage subscription and payment processes and to meet billing and accounting obligations,
• to improve the system by analysing usage statistics, error and performance data,
• to detect and prevent security threats, fraud and unauthorised access attempts,
• to send important changes to the services, security warnings and mandatory notifications,
• where you have given explicit consent, to send campaigns, announcements, newsletters and promotional content,
• to comply with legal obligations and to respond to requests from official institutions and organisations,
• to resolve disputes, protect and defend our rights in line with our legitimate interests.

In every case the processing of personal data is based on legal grounds compliant with the data protection legislation in force.

5. Sharing of information

5.1. Chatinbox does not share users' personal data with third parties arbitrarily; sharing takes place only in the following situations and to the extent necessary:

• service providers we receive support from in delivering the service, such as hosting, cloud storage, security, customer support, communication and payment institutions,
• authorised institutions and organisations under legal obligations; court decisions, requests from administrative authorities, or for the establishment, exercise and protection of legal rights,
• commercial transactions involving the transfer of all or part of Chatinbox, mergers, demergers, restructuring or asset sales,
• data transfers to third party systems through integrations, based on your explicit consent or carried out on your instruction.

Other than in these cases, your personal data is not shared with third parties for marketing or similar purposes.

6. International data transfers

6.1. Given the nature of its services, Chatinbox may process and store your data on servers located inside or outside Türkiye. Where personal data is transferred to infrastructure in different countries, contractual, technical and administrative security measures compliant with applicable data protection rules are taken. For example, for users covered by the GDPR, standard contractual clauses and additional safeguards are applied to transfers to recipients outside the European Union. For users in Türkiye, the provisions of the Personal Data Protection Law on transfers abroad are followed.

7. Cookies and similar technologies

7.1. Chatinbox may use cookies and similar technologies on its website and applications. These technologies are used for purposes such as:

• allowing the site and the platform to perform their core functions,
• remembering your session information,
• storing your preferences,
• measuring and improving performance,
• producing analytical and statistical reporting to the extent necessary,
• subject to your explicit consent, measuring advertising performance and ad attribution (including click identifiers of platforms such as Google and Meta, e.g. gclid/fbclid).

7.2. You can block cookies partly or completely through your browser settings; in that case some Chatinbox functions may not work properly. Chatinbox is not responsible for problems arising from this.

7.3. Analytics and marketing/advertising cookies are only enabled with your explicit consent (cookie consent); if you do not give consent, these cookies are not set. Click identifier information stored for ad attribution (gclid/fbclid) is likewise kept only when you give consent.

8. Data retention and deletion periods

8.1. Your personal data is kept only for as long as the processing purposes require and limited to the minimum periods stipulated by the legislation in force. When those periods expire or the processing purpose ceases to exist, the data is deleted, destroyed or anonymised by appropriate methods.

8.2. In determining retention periods, mandatory periods in the relevant legislation, limitation periods, audit and evidence obligations and the balance of legitimate interests are taken into account.

9. Data security

9.1. Chatinbox applies administrative and technical measures generally accepted in the industry in order to keep personal data secure. Within this scope:

• encryption protocols such as TLS/SSL are used during data transmission,
• stored data is encrypted with strong algorithms where appropriate,
• multi-factor authentication and role-based access controls are applied,
• access logs and security events are monitored,
• regular tests and audits are carried out against security vulnerabilities,
• staff are made aware of confidentiality and information security matters.

9.2. Aware that no system can provide absolute security, a continuous improvement approach is adopted in order to reduce possible risks to a minimum.

10. Children's privacy

10.1. By its business model Chatinbox is intended for professional and corporate use; it does not offer a service aimed at children. It does not knowingly collect data from persons under the age of 13. If such a case is identified, the relevant records are deleted or anonymised within a reasonable time.

11. Third party sites and organisations

11.1. Links to third party websites or services may be provided through Chatinbox, and Chatinbox may also be used integrated with third party messaging and social media platforms. The privacy policies, terms of use and data security practices of these third parties are entirely independent of Chatinbox. We therefore recommend that you review the policies and statements of those providers separately. Chatinbox is not responsible for the data processing activities third party service providers carry out in their own domains.

12. Updates to the policy

12.1. This Privacy Policy may be revised from time to time due to technological and legal developments, changes in our business processes or updates within the scope of the service. When significant changes are made, users will be informed by a reasonable method (in-platform notification, email or announcement on the website). Continuing to use the services after the changes means that you accept the new provisions of the Policy.

13. Limitation of liability

13.1. General principle: Chatinbox takes the utmost care to apply all technical and administrative measures reasonably necessary to protect personal data and ensure confidentiality. Nevertheless, given the nature of the internet and digital systems, the Data Subject accepts in advance that no system can provide absolute security. Without prejudice to mandatory rules of law in force, Chatinbox may only be held liable for damages arising from attacks, leaks, interruptions and similar events that are reasonably unforeseeable and unpreventable where its own intent or gross negligence is present.

13.2. The customer's data responsibility and obligations: In most cases Chatinbox acts as a data processor in respect of its corporate customers' end-user data. In this context, customers holding the capacity of data controller over that personal data are themselves responsible for fulfilling their disclosure obligations under Turkish data protection law, the GDPR and other relevant legislation, for obtaining the necessary explicit consents, for not processing data unlawfully, and for the lawfulness of the data transferred to integration channels.

13.3. Third party services and integrations: Chatinbox may offer integration with third party platforms such as WhatsApp, Instagram and Facebook. The privacy policies, terms of use and data security practices of these platforms are entirely independent of Chatinbox. Chatinbox cannot be held liable for data breaches, interruptions or security weaknesses arising from the systems or infrastructure of third party service providers, or for damages that may arise from the use of those services.

13.4. Indirect damages and loss of profit: Without prejudice to mandatory provisions in force, Chatinbox shall not be liable for any loss of profit, loss of data, business interruption, loss of reputation, or any indirect, special, incidental or consequential damage that may arise in connection with the processing of personal data or the performance of obligations under this Policy.

13.5. Cap on liability: Chatinbox's total liability is limited to the total subscription/service fee paid to Chatinbox by the relevant user or customer in the twelve (12) month period before the date the relevant claim arose. This cap does not apply to cases arising from Chatinbox's intent or gross negligence, or to situations where limiting liability is not legally possible.

13.6. Force majeure and events beyond control: Chatinbox assumes no liability where it is unable to fulfil its obligations, or is delayed in doing so, because of events that may be considered force majeure and that develop beyond its reasonable control; such as natural disaster, war, acts of terror, civil unrest, strike, lockout, general electricity or communication infrastructure outages, acts and transactions of public authorities, or large-scale cyber attacks.

13.7. Mandatory provisions reserved: No provision in this section may be interpreted as setting aside mandatory rules that apply where, under the law in force, Chatinbox's liability cannot be wholly excluded or limited in advance.

14. Contact

For any questions, requests and feedback regarding this Privacy Policy or the processing of your personal data, you can reach us through the following channels:

• Email: hello@chatinbox.net
• Address: İstanbul, Türkiye
• Phone: +90 216 372 9400