Privacy Policy

1. Who we are

Data controller: Bonalead, Türkiye.

Contact / KVKK requests: privacy@bonalead.com.

2. Whose data we process

• Platform users — consultancy staff who log in (name, email, password hash, activity logs).
• Prospective students / leads — individuals entered by our consultancy customers. For this category the consultancy is the controller and Bonalead acts as processor.

3. What data we collect

• Identity & contact: name, phone number, email address.
• Education profile: academic history, target programs/countries, language-test results, passport type, and consultation notes.
• Documents: files uploaded for applications (e.g. passport, transcript, diploma).
• Communications: WhatsApp messages and — where enabled and consented to — voice call recordings and their transcripts.
• Lead-source data: information received when a student submits a Meta Lead Ads form.
• Technical data: log and device information needed to operate and secure the service.

4. Sources

We receive data (a) entered directly by consultancy staff, (b) submitted by students via Meta Lead Ads, and (c) exchanged via the WhatsApp Business Platform (messages and calls).

5. How and why we use it (legal bases)

We process personal data to operate the CRM and pipeline; capture and respond to leads; enable messaging and calls with students; record and transcribe calls where consent is given, to keep an accurate record of the consultation; and to secure the service.

Legal bases (KVKK Art. 5–6 / GDPR Art. 6): performance of the consultancy–student relationship, legitimate interests, compliance with legal obligations, and — for call recording and sensitive data — explicit consent.

6. WhatsApp & Meta platform data

Data obtained through the WhatsApp Business Platform and Meta Lead Ads is used only to provide the consultancy–student communication and lead-management features described here. We do not sell this data, use it for advertising, or share it except as set out in Section 7. Our use complies with Meta's Platform Terms and Developer Policies.

7. Who we share it with

We do not sell personal data.

• Infrastructure providers processing data on our behalf: cloud hosting and object storage (EU region) and speech-to-text transcription providers, all under data-processing agreements.
• Meta Platforms, for the WhatsApp/lead functionality you use.
• Authorities, where required by law.

8. International transfers

Data is stored within the EU/EEA. Where any transfer outside Türkiye/EEA occurs, it is protected by appropriate safeguards (e.g. standard contractual clauses) and, where required by KVKK, your explicit consent.

9. Retention

We keep personal data only as long as needed for the purposes above or as required by law, after which it is deleted or anonymized. Call recordings and transcripts are retained for 12 months unless you request earlier deletion.

10. Security

We apply technical and organizational measures including encryption in transit, access controls, workspace-level data isolation, and encrypted storage of sensitive credentials.

11. Your rights

Under KVKK Art. 11 and, where applicable, GDPR, you may request access to, correction of, deletion of, or a copy of your personal data, object to or restrict processing, and withdraw consent at any time. To exercise these rights, contact privacy@bonalead.com. For student data, requests may be routed to the relevant consultancy as controller.

12. Children

The service is intended for use by consultancies and adult prospective students. Where a student is a minor, data is processed with the appropriate guardian consent obtained by the consultancy.

13. Changes

We may update this policy; material changes will be posted on this page with a new "Last updated" date.

14. Contact

Bonalead — Türkiye — privacy@bonalead.com