Privacy Policy

Last updated: 10 October 2026

This Privacy Policy explains how Çobaner Medya İletişim Ltd. Şti. (brand CBN Tech, İstanbul, Türkiye – “CBN”, “we”) processes data when an organisation (the “Customer”) uses the SMS by CBN application for Bitrix24 (the “Application”). It applies together with the License Agreement.

1. Roles

For personal data contained in the Customer's Bitrix24 account and in the messages it sends (for example recipients' names and phone numbers), the Customer is the data controller and CBN acts as a data processor that processes the data only to provide the Application and on the Customer's instructions. For the contact details of the Customer's users who contact our support team, CBN is the data controller.

2. Data we process

• Bitrix24 installation data: portal address, member ID, language, installation date and the OAuth access/refresh tokens issued by Bitrix24 to the Application.
• SMS Provider accounts: account name, provider, user name, API password or token, sender IDs, balance and connection status. Passwords and tokens are stored encrypted (AES-256-GCM) and are never shown again in the interface.
• Messages: recipient phone number, message text, sender ID, related CRM item (type and ID), provider message ID, sending and delivery status, timestamps and error codes.
• Bulk campaigns and lists: campaign settings, CRM filters, and saved recipient lists (CRM item ID, name, company/title and phone number).
• Users and permissions: Bitrix24 user IDs, names and departments of users who open the Application or are named in access rules.
• Logs: event logs and technical logs of requests to Bitrix24 (kept for 7 days) used for troubleshooting and security. Credentials and tokens are excluded from these logs.
• Support requests: the subject, message and contact details entered on the Support page, plus the portal address, application version and account status (never passwords or API keys).

The Application only reads the CRM data needed for the features the Customer uses (for example phone numbers of the contacts selected for a bulk message). We do not use any data for advertising or profiling and we do not sell data.

3. Purposes and legal bases

We process data to provide the Application (sending SMS, collecting delivery reports, showing statistics, enforcing permissions), to secure and maintain the service, to provide support and to comply with legal obligations. Processing for the Customer is based on our contract with the Customer (KVKK art. 5/2-c; GDPR art. 6(1)(b) and art. 28); support and security processing is based on our legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).

4. Recipients

• SMS Providers chosen by the Customer (Netgsm, Verimor, Mutlucell, İleti Merkezi or Kobikom) receive the recipient phone number, message text and sender ID in order to deliver the message, and return delivery reports.
• Bitrix24 receives message statuses and, if the Customer enables it, timeline entries on CRM items.
• Hosting provider: the Application runs on virtual servers leased by CBN; the provider has no access to the application data beyond operating the infrastructure.
• CBN's own Bitrix24 CRM stores support requests so that our team can answer them.
• Authorities, where required by law.

Some of these recipients, such as Bitrix24, may process data outside Türkiye under their own terms. Where personal data is transferred abroad we rely on the safeguards required by KVKK and, where applicable, GDPR.

5. Retention and deletion

• Data is kept while the Application is installed, so the Customer can see message history and statistics.
• Technical request logs are deleted after 7 days; event logs are limited to the most recent 5,000 entries.
• When the Application is uninstalled, Bitrix24 tokens are deleted immediately. If the Customer chooses to delete application data when uninstalling, all of its data is deleted immediately; otherwise it is deleted automatically 30 days after uninstallation.
• Database backups taken before software updates are kept on the same access-restricted server and deleted automatically after 30 days.
• The Customer may request earlier deletion at any time by e-mail.

6. Security

We use HTTPS for all connections, encrypt provider credentials at rest, separate each Customer's data, verify every request from Bitrix24 and the Application interface with signed tokens, limit staff access with individual accounts and two-factor authentication, and keep audit logs of administrative actions.

7. Rights

Individuals whose data is processed in a Customer's Bitrix24 account should first contact that Customer as data controller; we will assist the Customer in responding. You may also contact us directly to exercise your rights under KVKK art. 11 or GDPR (access, rectification, erasure, restriction, objection and portability) and you have the right to lodge a complaint with the Personal Data Protection Authority (KVKK) or your local supervisory authority.

8. Changes

We may update this policy. The current version is always available at sms.cbntech.com.tr/legal/privacy; material changes will be announced in the Application.

9. Contact

Çobaner Medya İletişim Ltd. Şti. (CBN Tech), İstanbul, Türkiye
E-mail: destek@cbntech.com.tr · Phone: +90 507 696 54 86