Privacy Policy

• Company Name: Blesyum Software and Technology Limited Company
• Tax Office / No.: Yakacık Tax Office / 1781821060
• Address: Orta Mah. Alparslan St. No. 8, 34880 Kartal/Istanbul
• Email: hello@blesyum.com
• Phone: 0850 307 71 77

3.1. Identification Information

First name, last name, Turkish ID number (only during contract processes), title, company information.

3.2. Contact Information

Email address, phone number, address information, and any corporate social media accounts you have shared.

3.3. Customer Transaction Information

Subscription plan and module information, order and project details, service history, Invoice information (company name, tax office, tax ID/Turkish ID number, address), payment amount and status, contract information, and usage information from the customer dashboard (accounts.blesyum.com) usage information.

Card information is not shared with us: Card payments are processed through the infrastructure of a licensed payment provider; we only retain non-identifying information such as the transaction reference and the last four digits of the card.

3.4. Digital Trace Data

IP address, browser type and version, operating system, device information, screen resolution, language preference, pages visited, page view durations, click data, session information.

3.5. Cookie and Tracking Data

Cookie identifiers, anonymous visitor ID, and consent record. Analytics and advertising measurement data (campaign parameters, conversion events) are collected only if you have given your consent to the relevant cookie category and if the relevant tool has been enabled by us; you can see which tools are enabled in the cookie preferences panel and withdraw your consent at any time.

3.7. Content Data (Subscription Services)

Records entered by our subscribers into the dashboard: accounts, invoices, quotes, inventory transactions, customer and call records, documents, and attachments. This data belongs to the subscriber; Blesyum processes it solely for the purpose of providing the service. Messages received from the subscriber’s WhatsApp Business, Messenger, and Instagram accounts linked to Blesyum CRM are also included in this scope (see Section 8).

3.6. Marketing and Communication Data

Form submission information, meeting requests, free analysis requests, newsletter subscriptions, consent for commercial electronic communications, and marketing preferences.

• Website: Through contact forms, free analysis forms, meeting request forms, and cookie technologies on www.blesyum.com;
• Customer Portal: Through transactions conducted via accounts.blesyum.com;
• Direct Communication: Via email (hello@blesyum.com), phone (0850 307 71 77), and in-person meetings;
• Automated Methods: Through essential cookies and—if you have given your consent—analytics and marketing measurement tools;
• Customer Dashboard and Modules: Through records entered into the dashboard by the subscriber and authorized users (the subscriber is the data controller for this data);
• Messaging Platforms: Through messages received on and sent from the subscriber’s WhatsApp Business, Messenger, and Instagram accounts linked to Blesyum CRM (the subscriber is also the data controller for this data; see Article 8);
• Contractual Processes: Within the scope of service agreements, partnership applications, and commercial relationships.

• Providing and ensuring the continuity of Subscription Services (ERP, CRM, E-Commerce, B2B, Call Center, Email, Consulting, Advertising Management, and Web modules);
• Execution, delivery, and acceptance of Project Services (custom software, mobile applications, integration, and data migration);
• Account creation and management, as well as user and access rights management;
• Conducting contract processes, preparing proposals, invoicing, and Collection;
• Addressing support requests and measuring service quality;
• Ensuring product security and preventing misuse and fraud;
• Developing the website and control panel, and improving the user experience;
• Marketing communications and campaign measurement, subject to your consent;
• Compliance with legal obligations and resolution of legal disputes;
• Sending commercial electronic communications (to individuals who have given their consent);
• Ensuring information security and preventing fraud.

Pursuant to Article 5(2) of the Personal Data Protection Law (KVKK), your personal data is processed based on the following legal grounds:

• As explicitly provided by law (tax legislation, commercial law obligations);
• Directly related to the conclusion or performance of a contract;
• To enable the data controller to fulfill its legal obligations;
• Legitimate interests, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject;
• Your explicit consent (data processing for marketing purposes, use of cookies, commercial electronic communications).

• Hosting and Infrastructure: Providers from whom we obtain server, database, backup, domain name, DNS, and

content delivery network (CDN) services;

• Payment Provider: Card payments are processed via the iyzico Ödeme Hizmetleri A.Ş. infrastructure;

card information does not reach Blesyum and is not stored by Blesyum;

• E-Invoice / E-Ledger Integrator: An authorized private integrator for

transmitting financial documents to the Turkish Revenue Administration (GİB);

• Email and Notification Delivery: Delivery providers used to

transmit system emails and notifications;

• Artificial Intelligence Providers: Only when you use artificial intelligence features

and only to the extent necessary for that specific process; providers do not use the data for model training;

• Messaging Platforms: Messages sent from the subscriber’s linked WhatsApp Business, Messenger,

and Instagram accounts are transferred to Meta for delivery (see Section 8);

• Analytics and Advertising Platforms: Only if you have given consent

for the relevant cookie category and the relevant tool has been enabled by us;

• Legal Authorities: Courts, prosecutors’ offices, and regulatory agencies (when

legally required).

You can request an up-to-date list of our subprocessors by emailing kvkk@blesyum.com. We do not sell your data.

International Data Transfers: The servers of some infrastructure, messaging platform, analytics, and artificial intelligence providers may be located abroad. These transfers are carried out in accordance with the provisions of Article 9 of the KVKK; they are made to countries with adequate protection, based on a written commitment or your explicit consent. If you do not use consent-based tools (analytics/marketing), no such transfers will take place.

Our subscribers can link their own WhatsApp Business, Facebook Messenger, and Instagram accounts to the Blesyum CRM module via Meta’s official connection flow and with their own consent. This section explains the data processed through this connection.

Data Processed:

• The content of messages received by and sent from the linked account;
• The sender’s identity on the platform (phone number on WhatsApp; user ID provided by the platform on Messenger and Instagram) and the profile name shared by the platform;
• Images, videos, audio, and documents shared in messages;
• Message delivery and read statuses;
• WhatsApp message templates approved by the subscriber on Meta and their approval statuses;
• Account information required for the connection (business account, phone number, or page ID, display name) and the access token provided by Meta. Access tokens are stored in encrypted form.

Purpose of processing: Solely to enable the subscriber to manage customer communications in Blesyum CRM’s shared inbox: messages appearing in the inbox, agents responding to them, and the subscriber sending messages using approved templates and rules they have defined. If the subscriber enables the AI response feature, the content of the relevant message is transmitted to the AI providers listed in Section 7 solely for the purpose of generating that response.

Our Role: The data controller for this data is the business that links the account (the subscriber); Blesyum acts solely as a data processor, operating only to the extent of the subscriber’s instructions and the performance of the service. How the business you’re messaging processes your data is determined by that business’s own privacy policy.

Usage restrictions: This data is not used for advertising, profiling, or training artificial intelligence models; it is not sold to third parties and is not shared for any purpose other than the subscriber’s service. Data obtained from Meta platforms is processed in accordance with the Meta Platform Terms and WhatsApp Business policies. By their very nature, messages pass through Meta’s infrastructure to be delivered; in this regard, Meta is subject to its own privacy policy.

Disconnection: When the subscriber removes the account’s connection from Blesyum CRM or revokes this permission via the business settings on Meta, Blesyum’s access to the relevant account ends; from that point onward, no messages are received or sent through that account.

Retention: Previously received messages are part of the subscriber’s CRM records and are retained for the duration of the Subscription; when the Subscription ends, the Subscription content data rule in Section 9 applies.

Deletion Request:

• You may contact the business you messaged directly, as they are the data controller;
• You may contact us at hello@blesyum.com or via the methods outlined in Article 12; we will forward your request to the relevant business and assist them in the deletion process;
• Users who have authorized the Blesyum CRM app with their Facebook account can also submit a data deletion request through Meta by removing the app from the “Apps” section in their Facebook settings. This request is forwarded to our app’s data deletion address (https://crm.blesyum.app/api/crm/webhooks/meta/data-deletion), and you will be provided with a confirmation code.

Requests are processed within 30 days at the latest.

• Contract data: Contract term + 10 years (statute of limitations under the Turkish Code of Obligations);
• Invoices and financial data: 10 years (Turkish Tax Procedure Code);
• Cookie and tracking data: From the duration of the session to 2 years, depending on the cookie type;
• Consent for commercial electronic communications: Until consent is withdrawn and for 3 years following withdrawal;
• KVKK application records: 10 years;
• Subscription content data: Access is terminated when the Subscription ends; data is retained for 30 days and can be exported during this period; it is permanently deleted at the end of the 30th day. Documents required to be retained under financial regulations are exempt from this deletion;
• Statistical data: May be retained indefinitely after anonymization.

Personal data whose retention period has expired is periodically deleted, destroyed, or anonymized in accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

• Secure data transmission via SSL/TLS encryption;
• Firewall and intrusion detection/prevention systems;
• Regular security updates and patch management;
• Access control and authorization mechanisms;
• Database encryption and secure backup procedures;
• Employee confidentiality agreements and data security training;
• Data breach response plan and notification procedures.

Pursuant to Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed;
• To request information regarding the processing of your personal data if it has been processed;
• To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose;
• To know the third parties to whom your personal data has been transferred, whether within or outside the country;
• To request the correction of your personal data if it has been processed incompletely or incorrectly;
• To request the erasure or destruction of your personal data under Article 7 of the KVKK;
• To request that third parties to whom your personal data has been transferred be notified of any corrections or erasures;
• To object to a decision made solely through the automated processing of your personal data that results in adverse consequences for you;
• To request compensation for damages suffered as a result of the unlawful processing of your personal data.

• Email: Send an email to kvkk@blesyum.com with the subject line “KVKK Application”;
• Mail: Send a certified letter with return receipt requested to the address: Orta Mah. Alparslan Sok. No: 8, 34880 Kartal/Istanbul;
• Notary: Through a notary on behalf of our company.

Your requests will be processed free of charge within 30 days at the latest.

This Privacy Policy may be updated from time to time. The current policy is always published at www.blesyum.com.

• Blesyum Software and Technology Limited Company
• Orta Mah. Alparslan St. No. 8, 34880 Kartal/Istanbul
• Email: hello@blesyum.com | Phone: 0850 307 71 77