Last updated: July 5, 2026
Colendi Yapay Zeka ve Büyük Veri A.Ş. (“Colendi”, “we”, or “us”) is committed to protecting the privacy of individuals whose personal data we process. This Privacy Policy describes how Colendi collects and processes personal data through our website, our mobile and web applications, and our messaging and voice communication channels, including WhatsApp.
This Privacy Policy applies together with any terms of business and other contractual documents, including any agreements we may have with you.
When we collect and use personal data, we do so in compliance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”), and, where applicable, the UK General Data Protection Regulation and the Data Protection Act 2018.
This policy may be modified by Colendi from time to time. Material changes will be notified through a notice on this page and, where appropriate, by e-mail to info@colendiai.com subscribers.
This Privacy Policy covers:
Where we act as controller. For Colendi's own products and services — including our consumer lending and Buy Now Pay Later products — Colendi determines the purposes and means of processing and acts as data controller.
Where we act as processor. Colendi also provides its AI assistant platform to business clients, who use it to communicate with their own customers. In these cases the business client is the data controller and Colendi acts as a data processor, processing personal data only on that client's documented instructions and under a written data processing agreement. This Privacy Policy does not govern those clients' own processing activities; please refer to the privacy notice of the business you are communicating with.
When you communicate with us or with one of our business clients through a messaging channel, we process:
Where you interact with us by telephone, we process call metadata (such as number, time and duration), and, where applicable and disclosed to you at the time, call recordings and transcripts.
We do not request special category personal data through our messaging channels. However, individuals sometimes choose to send documents containing such data — for example identity documents, or medical documentation in support of a claim of financial hardship.
Where such data is received:
If you do not wish to submit such documents through a messaging channel, please contact us at info@colendiai.com to arrange an alternative method.
| Purpose | Legal basis |
|---|---|
| Providing our products and services, including servicing credit agreements and processing payments | Performance of a contract |
| Communicating with you about your account, balance, payment obligations and requests | Performance of a contract; legitimate interests |
| Providing customer support and handling complaints and disputes | Performance of a contract; legal obligation |
| Sending marketing and promotional communications | Your explicit consent |
| Preventing fraud, money laundering and abuse | Legal obligation; legitimate interests |
| Meeting legal, regulatory and reporting obligations | Legal obligation |
| Improving the quality and reliability of our services | Legitimate interests |
Where we rely on your consent — including consent to receive messages through WhatsApp — you may withdraw it at any time. You can stop receiving messages on WhatsApp by replying with a stop keyword such as “DURDUR” or “STOP”, or by contacting us using the details in Section 10. Withdrawing consent does not affect your ability to contact us, or our ability to respond to messages you initiate.
Some of our communication channels use AI assistants. Where this is the case:
Certain of our services may involve automated decision-making — for example, initial credit assessments. Where a decision producing legal or similarly significant effects is made solely by automated means, you have the right to request human intervention, to express your point of view and to contest the decision, in line with Article 11 of the KVKK and, where applicable, Article 22 of the UK GDPR.
The content of your messages is not used to train or fine-tune AI models.
We may share personal data with:
Where you communicate with us through WhatsApp, your messages are transmitted through infrastructure operated by Meta Platforms, Inc. and its affiliates. Meta processes this data in accordance with its own terms and privacy policy, which are available at https://www.whatsapp.com/legal/. We recommend that you review them.
We do not sell personal data.
Personal data collected through our channels is stored in Türkiye.
Where personal data is transferred outside Türkiye, we do so on the basis of your explicit consent or another lawful transfer mechanism under Article 9 of the KVKK (such as a Board-approved undertaking or an adequacy determination), and we implement appropriate safeguards. Transfers to messaging platform providers are inherent in the operation of those platforms and are described in Section 5.
Our systems are designed to protect your security and privacy. Our measures are intended to prevent personal data from being accidentally lost, or used, accessed, altered or disclosed in an unauthorised manner. These measures include:
We retain personal data only for as long as necessary for the purposes described in this Policy, or for as long as required by applicable law.
| Data | Retention period |
|---|---|
| Website contact form and subscription data | 2 years after our last contact with you |
| Recruitment data | 1 year after the recruitment process concludes |
| Conversation records (messages and metadata) | 3 years |
| Media submitted through messaging channels | 1 year |
| Special category documents | 90 days |
| Call recordings and transcripts | 3 years |
| Consent and opt-out records | For as long as necessary to honour your opt-out |
| Records required for regulatory or accounting purposes | As required by applicable law |
Where we act as a processor for a business client, retention is determined by that client's instructions and by our agreement with them.
Subject to applicable law, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact us using the details in Section 10. We will respond within the period required by applicable law — under KVKK, within thirty days at the latest.
Where we process your data as a processor on behalf of a business client, we will refer your request to that client, who is responsible for responding.
You can contact us with any question or request relating to the collection and processing of your personal data:
You also have the right to contact the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, where applicable, your local data protection authority.