Legal
Explicit Consent and Undertaking Text
1. Purpose, Scope, and the Principle of Free Will in Consent
1.1. This Explicit Consent and Undertaking Text has been executed for the purpose of determining the scope, conditions, and legal liabilities of the parties regarding data processing and transfer activities that require explicit consent, pursuant to the Law No. 6698 on the Protection of Personal Data ("KVKK"), the Law No. 6563 on the Regulation of Electronic Commerce ("ETK"), and the relevant secondary legislation, within the scope of the use of the FlexInbox cloud-based SaaS platform ("Platform") provided by VRT Yazılım Bilişim ve Danışmanlık Hizmetleri Ticaret Limited Şirketi ("Right Holder" or "Company").
1.2. The User acknowledges, declares, and undertakes that the optional explicit consents covered by this text are not imposed as a mandatory prerequisite ("take-it-or-leave-it") for the core performance of the service; that they possess the right to make independent and separate choices (opt-in) regarding each processing purpose; and that, even if they do not consent to optional cookies and authorizations, they may continue to benefit from the Platform's core communication and integration functions under fair and non-discriminatory conditions.
2. Trainable Artificial Intelligence (RAG Models) and Algorithmic Development Processes
2.1. The trainable AI agent (RAG architecture) offered within the platform performs analysis and generates responses based on user-uploaded documents, customer interactions, and messaging content when activated by the user.
2.2. User data is not used to train general-purpose AI models or AI models that serve other customers. Data is processed solely for the purpose of providing the AI features enabled by the respective User.
When the AI agent is activated by the user, text and images are processed via OpenAI (Vision), voice notes via OpenAI Whisper, and knowledge base files (PDF, DOCX, CSV) are converted to text on the server and processed as text. No models are trained using customer data; "RAG" is not training, but rather a process of searching the knowledge base.
This information is also displayed and confirmed when the artificial intelligence agent is activated in the panel; the name of the administrator providing confirmation and the time of confirmation are recorded.
2.3. The ultimate supervision, verification, and approval responsibility for all outputs produced by artificial intelligence (text, response, direction) belongs exclusively to the User. Artificial intelligence outputs do not constitute legal, medical, or financial advice; the Right Holder gives no warranty regarding the accuracy of these outputs or their fitness for a particular purpose.
3. Cross-Border Transfer of Personal Data
3.1. Pursuant to the requirements of the Platform's cloud architecture and integration infrastructure; the systems of WhatsApp (Meta Platforms Inc.), Telegram, Zoho CRM, Bitrix24, HubSpot, GoHighLevel (LeadConnector), and server infrastructure providers are located abroad.
3.2. It may be necessary to transfer messaging flows conducted via the Platform, CRM records, names and surnames, phone numbers, e-mail addresses, user credentials, and transaction logs to the aforementioned servers and service providers located abroad for the purposes of ensuring the uninterrupted provision of the service, maintaining data synchronization, and executing technical integrations. Such transfers are carried out within the scope of Article 9 of the Personal Data Protection Law (KVKK), based on an adequacy decision or appropriate safeguards (primarily standard contractual clauses notified to the Personal Data Protection Authority); explicit consent is not relied upon for these transfers, as they are essential for the provision of the service. When a User activates third-party services and integrates them into the Platform, they provide explicit consent for the transfer of information regarding said third-party services abroad. Details are available in the “Transfer Abroad” section of the Privacy Policy.
4. Cookies and Digital Tracking Technologies
4.1. On the promotional website (https://flexinbox.io), in addition to mandatory cookies that ensure technical system security, Google Analytics cookies may be used solely with the consent provided via the visitor's browser. Google Analytics is not used within the panel.
4.2. Google Analytics cookies are placed if the User enables them through their browser settings; browsing and click data are processed for statistical reporting purposes. Visitors may modify this preference in their browser settings. Granting consent for Google Analytics cookies via browser settings constitutes the provision of explicit consent.
5. Commercial Electronic Message and Marketing Communication Approval
5.1. Pursuant to Law No. 6563 and relevant regulations, and subject to the User’s separate consent, express consent is granted for the transmission of commercial electronic messages—including FlexInbox product updates, newsletters, launches of new modules and features, tariff changes, and promotional content—via the e-mail address, phone number, and WhatsApp and Telegram accounts provided by the User during registration.
5.2. The User accepts that it may revoke its commercial electronic message approval at any time without stating any reason, via the Commercial Electronic Message Management System (İYS), by using the opt-out/unsubscribe link provided in the Company's communications, or by notifying support@flexinbox.io.
6. Storage of Payment Instrument Data (Tokenization Consent)
6.1. Credit card and payment instrument information entered for the collection of Platform subscription fees are processed exclusively within the infrastructure of the payment service provider (Paddle) for the execution of the relevant periodic invoice.
6.2. Payment method details are not stored on FlexInbox servers; for recurring subscription charges, they are stored by the payment service provider, Paddle, in accordance with Paddle’s own terms. This processing is necessary for the performance of the subscription agreement, and explicit consent is not required. Users may delete their registered payment method or cancel their subscription via Paddle.
7. Data Minimization, Prohibition of Sensitive Data, and Data Security Isolation
7.1 It is the User's responsibility to determine the appropriate legal basis and necessary additional safeguards before enabling the processing of e-Government passwords, banking and financial account login credentials, biometric/genetic data, or special categories of personal data (such as health data, criminal conviction records, etc.) via the platform. FlexInbox processes this data in accordance with your instructions for the purpose of providing the Service. When the artificial intelligence feature is enabled, relevant text, image, or audio data may be transmitted to OpenAI. Implementing human oversight and access restrictions in high-risk use cases is the user's responsibility.
7.2. The Right Holder undertakes not to use strategic commercial data, customer communication volumes, and competitively sensitive data processed by the User in its own commercial activities or in third-party competitor analyses, and warrants that the data will be maintained using tenant-based logical isolation and access control.
8. Data Portability and Interoperability Rights
8.1. Ownership and disposition rights over all database records, message logs, and customer lists uploaded to the system by the User belong exclusively to the User.
8.2. Users have the right to export customer and messaging data transferred to the system during their subscription period in structured, standard, and machine-readable formats. Reports can be downloaded in CSV format, and media files can be downloaded individually. Users can perform bulk exports from the Platform. Therefore, the regular export and storage of User data is the User's responsibility. The Rights Holder shall not implement technical barriers that unjustifiably restrict or prevent the export of data.
9. Procurement of Third-Party/Customer Consents, Burden of Proof, and Recourse Liability
9.1. The User accept, declare, and undertake that they have personally provided the necessary privacy notices and fully obtained valid explicit consents in accordance with Articles 5, 6, and 9 of KVKK No. 6698 regarding the acquisition, CRM synchronization, and artificial intelligence analytics of personal data belonging to third parties (End User/Customer) transferred to the system.
9.2. The User is obligated to retain date, time, IP address, and transaction logs of explicit consents received from end users in a provable format, and to submit them within 3 (three) business days upon request of the Right Holder.
9.3. Any administrative fines, compensation, litigation costs, and attorney fees that may be imposed on the Right Holder by the Personal Data Protection Board, the Ministry of Commerce, or judicial authorities due to failure to properly notify end users, failure to obtain consent, or sending unauthorized commercial messages (spam), together with legal interest and accessories, shall be immediately recourse to the User without requiring any court decision or warning.
10. Revocation Procedure of Consent and Evidence Agreement
10.1. The User may withdraw the explicit consents given under this text at any time. The User has the right to withdraw the explicit consent given for marketing communications via the "Profile > Privacy and Permissions" section on the Platform or the "unsubscribe" link in the messages; the explicit consent given for analytical cookies via browser settings; and the explicit consent given for artificial intelligence by disabling the AI agent, or, in any case, by providing written notice to support@flexinbox.io.
10.2. It is acknowledged that if the consents for mandatory data processing and transfer to overseas servers—which constitute the core technical architecture of the service—are withdrawn, the Platform’s functions cannot be performed, either in whole or in part, due to the nature of the SaaS architecture.
10.3. The Parties accept and declare that server logs, IP records, and digital timestamps maintained by the Right Holder regarding the approval of this explicit consent text, log records, in-system transaction movements, and electronic consent records shall constitute exclusive and conclusive evidence pursuant to Article 193 of the Code of Civil Procedure No. 6100.
Explicit Consent and Selection Table
The selections below are made independently of one another on the relevant screens within the Platform and on the promotional site; none of them is a prerequisite for using the service.
| Article No | Data Processing Activity and Scope | Preference |
|---|---|---|
| 1 | When the artificial intelligence agent is activated, messages, images, audio, and knowledge base content are transmitted to OpenAI to generate responses (no model training takes place; consent is obtained via the panel when enabling the AI). | [ ] I AGREE [ ] I DO NOT AGREE |
| 2 | Transfer of data to servers abroad within the scope of cloud architecture and integrations (WhatsApp, Telegram, CRM) | [ ] I AGREE [ ] I DO NOT AGREE |
| 3 | Use of Google Analytics cookies on the promotional site | [ ] I AGREE [ ] I DO NOT AGREE |
| 4 | Sending newsletters, campaigns, new feature announcements, and commercial electronic messages via email. | [ ] I AGREE [ ] I DO NOT AGREE |