Controller / provider: ASİSTONE YAZILIM VE TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ Address: Kınıklı Mah. Hüseyin Yılmaz Cad. Pamukkale Üniversitesi No:67/2, 20160 Pamukkale/Denizli, Türkiye MERSİS: 0086175105600001 Tax office / tax ID (VKN): Pamukkale Vergi Dairesi / 0861751056 Phone: 0538 701 94 10 Contact: [email protected]
Asistone retains account-administrator data within the relevant organization/subscription account. ERP records (orders, products and stock, e-documents, current-account, cash, and expense records, and the buyer, customer, supplier, and employee details in them) and CRM records (WhatsApp Business, Instagram DM, Facebook Pages, and Messenger messages and attachments, leads, support tickets, and knowledge-base content) processed on a business customer's instructions are retained within that business's shared service account while the account is active. In this model, removing an employee's individual user account does not erase the company's accessible shared conversations, customer records, or ERP records. When an organization account is closed or a deletion request is made, we assess the requester, scope, customer instructions, legal retention duties, disputes, and other data subjects' rights.
E-Fatura and e-Arşiv documents are kept for 10 years under tax law by the e-document provider Asistone works with (a private integrator authorized by the Turkish Revenue Administration). The duty to keep these documents lies with the customer company as the taxpayer and with the private integrator that provides the storage service on its behalf; Asistone does not assume a separate legal retention duty for them. Asistone keeps the document records the service needs (document number, ETTN, status, amounts, recipient details, and the document's XML file) for as long as the company's other ERP records and does not keep a separate archive copy beyond that. A company that asks for its ERP records to be deleted should separately assess its own legal retention duties.
For website records where Asistone is controller, the periods are: meeting requests are kept for two years after the last contact, and if the request leads to a contract, the retention period for contract records applies; commercial-message consent records are kept while the consent is valid and for three years from the date it stops being valid, and other records of commercial electronic messages sent are kept for three years from the date of the record (Article 13(2) of the Turkish Regulation on Commercial Communication and Commercial Electronic Messages); the hashes used for the meeting request form's abuse protection are kept for at most 24 hours.
Send deletion requests to [email protected]. For data processed for a business customer (for example the details of an order, invoice, or shipment placed with a business, or conversations with that business), contact the organization that owns the Asistone account first; it can instruct Asistone as processor. We may request reasonable information to verify identity and authority. Disconnecting an integration alone does not mean stored copies have been deleted.
The scope and timing of a deletion request depend on its nature, organization instructions, applicable legal retention duties, and other data subjects’ rights. We therefore do not promise automatic deletion within a fixed number of days or irreversible destruction. Records subject to legal retention duties may be processed only to the extent and for the period required. A supplier contract or a statutory exception does not by itself prove that deletion has actually been completed.
Rights and deletion/destruction conditions under Article 7 of KVKK and its secondary legislation remain applicable. Official source: KVKK Regulation on Deletion, Destruction or Anonymization (opens in a new tab).
Requests properly submitted under the Turkish Personal Data Protection Law are answered as soon as the nature of the request allows and within 30 days at the latest. Accepted erasure or destruction requests are fulfilled within the procedures and deadlines required by applicable law; responding to a request does not itself establish that destruction across all systems has been completed.