Live Chat Privacy Notice

1. Data Controller

W3 Bilişim Teknolojileri ve Yazılım Hizmetleri Limited Şirketi — Kartal Tax Office 7881052037, MERSİS 0788-1052-0370-0001, Trade Registry 381250-5. Address: Cevizli Mah. Mustafa Kemal Cad. Hukukçular Tower Sitesi A Blok No: 66A D:111 Kartal / Istanbul. E-mail: hello@w3.net.tr. Phone: +90 532 476 9667.

This notice covers the live chat on OpencartExtra.com only. Data you send through the quote form, by e-mail or on WhatsApp is covered by the Privacy Policy and the KVKK Notice.

2. You Are Talking to an AI Assistant

The live chat is answered by an artificial intelligence assistant working on behalf of our team, not by a person. The assistant introduces itself with a name and a title; that persona represents the service area your request belongs to, not an individual employee.

The assistant analyzes your request, breaks it into sub-tasks, estimates the effort and can issue a proforma invoice. It cannot make binding commitments beyond the written quotation. No decision producing a legal effect on you is taken solely by automated means: requests above our internal effort threshold, complaints and anything concerning an existing project are handed to a human colleague, and every conversation can be continued with our team by e-mail.

You may leave the chat at any time and write to hello@w3.net.tr instead. Please do not type passwords, admin credentials, card numbers or identity documents into the chat; our team never asks for them there.

3. Personal Data Processed

Identity and contact: the name, e-mail address, phone number and company name you type into the conversation.

Customer transaction: your store address (URL), your OpenCart version, the content of the conversation (all messages in both directions), the scope items and hours analyzed, the quotation and proforma invoice issued, and your statement that a payment has been made.

Transaction security: a salted, irreversible hash of your IP address, your browser identification (user agent), the page the chat was opened from, the referring address and UTM campaign parameters. Your IP address is not stored in its raw form.

Technical usage: the number of tokens the conversation consumed and its cost, kept for capacity and cost control.

4. Purposes

Understanding your request, asking the discovery questions, estimating the effort and preparing a written quotation and proforma invoice.

Contacting you about your request, sending the proforma and the reminders asking whether you would like to continue.

Handing requests the assistant cannot price to our technical team.

Security of the service (bot protection, abuse prevention and rate limiting), cost control, statistics and quality improvement. Statistics are produced in aggregate, without identifying individuals.

5. Legal Grounds

Under KVKK art. 5/2: establishment and performance of a contract (b/c) for the quotation, the proforma and the delivery of the service; legal obligation (ç) for the accounting and tax records that follow an invoice; establishment and protection of a right (e); and legitimate interest (f) for security, abuse prevention, cost control and improvement of the service.

You are not obliged to give your name, e-mail address or store address. We can still discuss your request without them, but we cannot issue a quotation or a proforma invoice.

6. Retention

Conversation transcripts are kept for 12 months from the date of the conversation. At the end of that period the message contents are erased and only the conversation's non-identifying statistics remain.

Lead records are kept for 24 months from creation; the identifying fields — name, e-mail, phone, company and store address — are then anonymized. Records belonging to a live contract or an ongoing project are kept for the statutory limitation periods.

Invoices, proforma invoices and their accounting records are kept for the periods required by tax legislation. Delivered notification e-mails are removed from the queue after 3 months, and the signed links they contain expire earlier.

This cleanup runs automatically every day.

7. Transfers, Including Abroad

So that the answer can be generated, the content of your messages is transferred to the Gemini API service of Google LLC (United States); under its commercial terms this content is not used to train models. Only the conversation itself is transferred — your IP address is not.

The first message of a conversation may be put through a bot check to prevent automated abuse; this check is provided by Cloudflare, Inc. (United States), which processes your IP address and browser signals for that purpose alone.

Notification and reminder e-mails are delivered over Google Workspace (Google Ireland Ltd. / Google LLC).

Where necessary, data may also be shared with our financial adviser and legal counsel, and with the competent public authorities where the law requires it. International transfers are made under KVKK art. 9 with the safeguards required by the Personal Data Protection Board.

8. Cookies and Local Storage

Opening a chat sets a single ocd_chat_* cookie for the page you are on: ocd_chat_general for the general chat, and ocd_chat_hosting, ocd_chat_opencart-development, ocd_chat_technical-support, ocd_chat_maintenance or ocd_chat_custom-projects on the service pages. Each one is httpOnly, has a lifetime of 7 days and carries nothing but a signed conversation identifier; each service page therefore keeps its chat in its own cookie without overwriting the others, and you can return to the same conversation. These cookies are technically necessary and serve no advertising purpose.

The conversation identifier is also written to your browser's local storage under a separate key for each page context — the general chat and each service page — in the form ocd:chat:<language>:<context>, so the panel can restore the chat for that page when you reload. Clearing your browser data removes it.

Bot protection may set its own short-lived cookie. Details are in the Cookie Policy.

9. Security

The conversation cookie is signed, so nobody can open someone else's conversation with a guessed identifier. The number of chats and messages is limited per visitor and per conversation, the first message may pass a bot check, and account details are never written into a message: bank information is shown on a separate card issued together with the proforma invoice.

The assistant is instructed to give no technical support, no code and no legal or financial advice, and never to ask for a password, a card number or an identity document.

10. Your Rights and How to Exercise Them

Under KVKK art. 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties at home or abroad to whom it is transferred, to request rectification, erasure or destruction, to request that these actions be notified to those recipients, to object to a result produced against you solely by automated analysis, and to claim compensation for damage caused by unlawful processing.

You may submit your application in writing to the address above, through a registered electronic mail address, or to hello@w3.net.tr together with information identifying you and, where you have one, the OCD-YYYY-NNNN reference of the conversation. Applications are concluded free of charge within 30 days at the latest.