.avif)
.avif)
.avif)
SESTEK is a high-technology company that hasbeen operating since 2000 in the fields of speech and communicationtechnologies, call centre applications and customer service automation. Withits expert and qualified team, SESTEK constantly aims higher and stands outwith its solutions that bring cost advantages and increase efficiency, itsproducts that make life easier for people with disabilities, its financialstrength and its pioneering role in university–industry collaboration.Artificial intelligence, which lies at the heart of the technologies developedby SESTEK, is advancing every day and is having a transformative effect onbusiness processes.
As SESTEK, we aim to improve the customerexperience and deliver added value to organisations through our AI-basedsolutions. This SESTEK AI Usage and Responsibility Guide (hereinafter the “Guide”)sets out, for our customers, business partners and end users (hereinaftercollectively the “Stakeholders”), the principles, limitations,boundaries of responsibility and ethical rules governing the use of our AItechnologies. With respect to the Stakeholders concerned, this Guide isintended to:
2.1. This Guide covers all AI-based productsand services developed or offered by SESTEK. Please contact SESTEK for detailedinformation on the AI Solutions offered by SESTEK.
2.2. Definitions
European Union Artificial Intelligence Act: The European Union regulation that entered into force on 1 August 2024 and whose provisions are being applied in stages, which classifies AI systems according to their level of risk (prohibited practices, high-risk systems, systems subject to transparency obligations and minimal-risk systems) and lays down separate obligations for general-purpose AI models. The Act aims to minimise the individual and societal risks that may arise in the areas of fundamental rights and freedoms, privacy, security and ethics.
ISO/IEC 42001: The set of standards developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) for the management and control of AI systems. ISO/IEC 42001 sets out the criteria for risk management, process control, performance measurement and continual improvement so that AI systems are developed and operated in a safe, reliable, ethical and legally compliant manner. SESTEK holds ISO/IEC 42001 Artificial Intelligence Management System certification; information on the scope and validity of the certificate is provided upon request.
Guidelines and Decisions of the Turkish Personal Data Protection Board: The guidelines and principle decisions published by the Board on AI and biometric data processing activities, in particular the Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence (2021), the Guideline on Matters to Be Considered in the Processing of Biometric Data (2021), the Guideline on Generative AI and the Protection of Personal Data (2025) and the Guideline on Agentic AI (2026).
European Union Guidelines and Opinions: The European Commission’s guidelines on the application of the EU AI Act (on prohibited practices, the definition of an AI system, the transparency obligations under Article 50 and the Code of Practice on the Transparency of AI-Generated Content), together with the opinions of the European Data Protection Board on the processing of personal data in AI models.
OECD AI Principles: The set of fundamental guiding principles established by the OECD and adopted by countries and organisations for the ethical and safe development and use of AI applications. These principles include transparency, fairness and impartiality, accountability, security, respect for human rights, privacy and data protection. Their purpose is to ensure that AI is applied in a way that benefits society.
Applicable Data Protection Law: The body of laws, regulations, communiqués and other rules in force in the countries/regions in which the relevant Stakeholders operate or provide services, which govern the procedures and principles for the processing, storage, transfer and protection of personal data (for example, in Türkiye, the Personal Data Protection Law No. 6698 (“KVKK”); in the European Union, the General Data Protection Regulation (“GDPR”); and other relevant national/international legislation).
3.1. The Guide applies as an annex to, and an integral part of, the licence, sale and service agreements concluded between SESTEK and the Customer and the partnership agreements concluded between SESTEK and the Business Partner (together the “Agreement”).
3.2. Sections 2, 3, 5, 6, 7, 8, 9 and 11 of the Guide constitute binding contractual provisions for the Customer and the Business Partner. The principles set out in Sections 1, 4 and 10 describe SESTEK’s good-faith approach and objectives; they shall not be construed against SESTEK as a guarantee of results, performance or legal compliance, or as an additional undertaking.
3.3. In the event of any conflict between the Guide and the Agreement, the provisions of the Agreement prevail; the Guide supplements the Agreement in matters specific to artificial intelligence.
3.4. The Guide is binding on the Customer and the Business Partner. No direct contractual relationship arising from the Guide is established between End Users and SESTEK, and the Guide does not create rights in favour of third parties. The rights of End Users under applicable law are reserved.
3.5. SESTEK may update the Guide in line with technological and legal developments. Amendments affecting the obligations of the Customer or the Business Partner, or the allocation of liability, are notified to the Customer or the Business Partner in writing. Where a written objection is raised within thirty (30) days of such notification, the current version of the Guide continues to apply in respect of the relevant Agreement; the termination provisions of the Agreement are reserved. Amendments enter into force upon publication on SESTEK’s website.
4.1. Compliance with the principles set out below shall be assessed within the framework of national legislation and internationally recognised standards (e.g. the OECD AI Principles and ISO/IEC standards). The limits of SESTEK’s responsibility under these principles are set out in Section 7.
4.2. SESTEK adopts the following ethical and security principles in the provision of the AI Solutions. The legal nature of these principles is set out in Clause 3.2.
Fairness and Impartiality: Means that the data sets and models trained, tested and used within the scope of the AI Solutions produce equal results for different groups, without placing individuals in various classifications or categorisations. SESTEK aims to carry out continuous monitoring and to proactively develop and improve its processes in order to minimise algorithmic bias within the scope of the AI Solutions.
Accuracy: Means that the data used in the development, training and testing of the AI Solutions is accurately identified, analysed and classified, so that the system can produce reliable and consistent outputs. Given the effects that the AI Solutions may have on the fundamental rights and freedoms of individuals, ensuring data accuracy is of critical importance.
Transparency and Explainability: Means that the inputs and outputs of the AI Solutions, their operating logic and their effect on results are understandable, and that these matters are clearly communicated to the Stakeholders. SESTEK aims to design the AI Solutions in a manner that ensures transparency and explainability and to make the necessary improvements in this respect.
Protection of Personal Data: Means that, throughout the lifecycle of the AI Solutions, including their training, testing and use, data subjects are informed of the processes in which personal data is processed and transferred and are able to exercise their rights in relation to data processing. SESTEK operates the processes required for compliance with applicable data protection law within the scope of the AI Solutions. Data processing roles and the rules governing data transfers are set out in Section 6.
Security: Means the regular testing of AI systems and the implementation of cybersecurity measures in order to minimise the risks that may arise in relation to the AI Solutions and to prevent possible or unexpected harm. Within the scope of the AI Solutions, SESTEK attaches importance to protecting the availability, integrity and confidentiality of information and aims to comply with the relevant national and international standards in this respect.
Administrative and Technical Measures: Within the scope of the AI Solutions, data is processed in models and data sets on a purpose-limited basis throughout the development, training, testing and use processes, in other words throughout the product lifecycle, and the necessary technical measures, in particular masking, are applied to ensure data security.
Oversight of Automated Decision-Making Mechanisms: Human intervention is intended within the scope of the AI Solutions offered by SESTEK. This principle means that human oversight is in place so that outputs generated within the scope of the AI Solutions do not contain misleading, biased or erroneous content. SESTEK aims for human intervention or a manual approval mechanism in solely automated decision-making processes within the scope of the AI Solutions and carries out its development work accordingly.
Auditability, Rollback and Metadata Management: Means that metadata documenting model and processing information in relation to AI outputs is recorded and can be audited where necessary. Within the scope of the AI Solutions, SESTEK ensures the accuracy and reliability of the models, training data and AI outputs, and develops AI Solutions that allow erroneous or biased results to be rolled back once detected. Such mechanisms are provided to the extent technically and operationally feasible, and no guarantee is given that all risks will be eliminated.
Data Transfers: Means that the data trained, tested, developed and used within the scope of the AI Solutions is kept in the country in which the Customer (or, for sales made through a Business Partner, the end customer) is established, unless otherwise agreed in the Agreement. Where data needs to be transferred abroad, the transfer is carried out in accordance with the rules set out in Section 6 and the provisions of the relevant legislation, in particular data protection law.
5.1. The AI Solutions offered by SESTEK are intended for decision support; the final decision always rests with a human. In other words, the AI Solutions offered by SESTEK are designed to allow human oversight and intervention. SESTEK attaches the utmost importance to the protection of the fundamental rights and freedoms of individuals. Accordingly, the AI Solutions offered by SESTEK are developed and used in a manner that prevents harm to the fundamental rights and freedoms, privacy and security of individuals.
5.2. Human oversight in the AI models and/or systems developed by SESTEK is carried out with regard to the following:
5.3. Within the scope of the AI Solutions provided, the Customer and the Business Partner are obliged to take the following into account:
5.4. The Customer and the Business Partner may not use the AI Solutions for the following purposes, nor allow third parties to use them for such purposes:
Where a prohibited use is identified, Clause 7.7 applies.
6.1. Roles: In respect of End User data processed through the AI Solutions, the Customer is the data controller and SESTEK is the data processor acting on the Customer’s instructions. The details of the data processing relationship between the parties are governed by the Agreement and the data processing terms annexed to it. SESTEK ensures that Sub-processors act in accordance with the Agreement.
6.2. Customer’s Data Protection Obligations: The Customer is responsible for fulfilling the obligation to inform data subjects under Applicable Data Protection Law; for ensuring that the conditions for processing are met and, where required, that explicit consent is obtained; for structuring explicit consent and the privacy notice as separate steps in accordance with Principle Decision No. 2026/347 of the Turkish Personal Data Protection Board dated 18 February 2026; and for responding to data subject requests (including objections to results arising from analysis carried out exclusively by automated systems). SESTEK provides reasonable support under the Agreement for the fulfilment of these obligations and designs the AI Solutions so as to allow the notice and consent steps to be implemented separately.
6.3. Special Categories of Data and Biometric Data: When using AI Solutions that process biometric data, such as voice biometrics, the Customer is responsible, taking into account that biometric data constitutes a special category of personal data, for ensuring that the conditions for processing (including explicit consent) are met, for carrying out a proportionality assessment, for offering an alternative verification method and for complying with the Board’s guidelines and principle decisions on the processing of biometric data.
6.4. Input Warranty: The Customer warrants that it has the legal basis required for the Input it provides to the AI Solutions (including voice recordings and personal data) to be transferred to SESTEK and processed for the purposes of the Agreement, and that the Input does not infringe the rights of third parties.
6.5. Use of Customer Data: SESTEK processes Input and Output solely for the provision of the services under the Agreement, for ensuring the security of the services and for the other purposes set out in the Agreement. Input and Output may be used for the training or development of SESTEK’s general models only where expressly agreed in the Agreement and subject to the agreed conditions (for example, using anonymised data).
6.6. Rights in Output: SESTEK does not claim any rights in the Output generated by the Customer through the AI Solutions; unless otherwise provided in the Agreement, the right to use the Output belongs to the Customer. No warranty is given that the Output will be original, that similar output will not be generated for other users from similar input, or that the Output will not infringe third-party rights; it is for the Customer to assess whether the Output is protected under intellectual property law.
6.7. Data Location and Cross-Border Transfers: Unless otherwise agreed in the Agreement, data processed within the scope of the AI Solutions is kept in the country in which the Customer (or, for sales made through a Business Partner, the end customer) is established. Where, at the Customer’s election or under the Agreement, data needs to be transferred to Third-Party Providers or to SESTEK located outside that country, the transfer is carried out through the mechanisms provided for in the cross-border transfer provisions of Applicable Data Protection Law (in Türkiye, Article 9 of Law No. 6698; in the European Union, Chapter V of the GDPR), such as an adequacy decision, standard contractual clauses or other appropriate safeguards; the country of destination and the Third-Party Provider are notified to the Customer. The party responsible for putting the transfer mechanism in place is determined in the Agreement and the data processing terms annexed to it.
6.8. Third-Party Providers: Whether the models of Third-Party Providers (for example OpenAI, Google Gemini, Microsoft Azure AI) are used within the scope of the AI Solutions, and which provider is used, is at the Customer’s discretion and is determined in the Agreement. SESTEK uses the Third-Party Providers accessed through its own corporate accounts under enterprise or API terms of use which provide that Input and Output are not used by the provider for model training or development; where a provider does not satisfy this condition, SESTEK notifies the Customer and the decision to continue using that provider rests with the Customer. Where a Third-Party Provider is used through accounts belonging to the Customer, the relationship with the provider, the account terms and responsibility for the provider’s use of data rest with the Customer, and SESTEK uses such accounts solely on the Customer’s instructions and for the provision of the services under the Agreement.
6.9. Sector-Specific Requirements: The Customer is obliged to specify in the Agreement the conditions required by the sector-specific regulations to which it is subject (including the regulations of the Banking Regulation and Supervision Agency (BDDK), the Capital Markets Board (SPK), the Information and Communication Technologies Authority (BTK), the Social Security Institution (SGK) and similar regulatory authorities) in respect of the deployment model, data location, backup and use of Third-Party Providers for the AI Solutions. SESTEK cannot be held liable for sector-specific requirements not specified in the Agreement.
7.1. SESTEK’s liability is limited to the AI Solutions developed by SESTEK itself and is subject to the scope, service levels and limitations of liability set out in the Agreement. SESTEK cannot be held liable for the manner in which the Customer or the Business Partner uses the AI Solutions, for the data sets and Input provided by the Customer or the Business Partner, or for any ethical, security or impartiality issues arising from them.
7.2. Integrations with third-party software, platforms or services carried out by the Customer or the Business Partner at its own election are the sole responsibility of the party carrying out the integration. SESTEK cannot be held liable for security vulnerabilities, errors or interruptions arising from such integrations.
7.3. Third-Party Providers included by SESTEK in the AI Solutions are subject to Clauses 6.8 and 6.9. SESTEK has no liability for interruptions, errors or security incidents arising from the services of Third-Party Providers.
7.4. The AI Solutions are based on probabilistic models; no warranty is given that the Output will be accurate, complete, up to date or fit for a particular purpose. The Customer is solely responsible for any use of the Output without human oversight and independent verification, and for the decisions it takes in reliance on the Output.
7.5. The Customer and the Business Partner shall, upon first written demand, indemnify SESTEK for any loss or damage suffered by SESTEK, including third-party claims brought against SESTEK, administrative fines and reasonable legal and defence costs, arising from the use of the AI Solutions in breach of the law or the Guide, from the unlawfulness of the Input, or from a breach of the information and data protection obligations set out in Sections 6, 8 and 9.
7.6. The limitations of liability in this Section apply to the extent permitted by mandatory law; the provisions on wilful misconduct and gross negligence, and the non-waivable rights granted to consumers and natural persons under applicable law, are reserved.
7.7. Suspension. Where it is established that the Customer or the Business Partner uses the AI Solutions in breach of Clause 5.4 or otherwise unlawfully, where a serious threat arises to the security of the products and services under the Agreement or of third parties, where the Guide or the AI Declaration is materially breached, or where so required by applicable law, a decision of a competent authority or SESTEK’s AI governance criteria, SESTEK may, upon notice to the Customer or the Business Partner and in proportion to the breach, temporarily suspend or disable the relevant AI Solution or feature. Where immediate action is required, notice is given at the time of suspension or as soon as possible thereafter. Use is restored once the breach has been remedied. Suspension does not affect the payment obligations of the Customer or the Business Partner under the Agreement, nor SESTEK’s rights of termination and compensation under the Agreement.
8.1.1. The Customer undertakes to use the AI Solutions in accordance with the applicable national and international legislation (including, without limitation, personal data protection, intellectual property, consumer protection and the regulations specific to the sector in which it operates), the Agreement and SESTEK’s instructions for use, and solely for the stated purposes and use cases. The Output may not be used in a manner that violates the fundamental rights and freedoms of individuals, discriminates, causes material or non-material harm, or serves any other unlawful purpose. The Customer undertakes not to use the AI Solutions in a manner that infringes the intellectual property rights or trade secrets of third parties and not to provide Input that may lead to such infringement. All legal, administrative and criminal liability arising from use in breach of this Clause rests solely with the Customer, and SESTEK cannot be held liable for out-of-scope use or for any resulting damage or sanctions.
8.1.2. Roles under the EU AI Act. Where the AI Solutions fall within the scope of the EU AI Act, SESTEK fulfils the obligations incumbent on it as provider. The Customer, as deployer, is obliged to use the AI Solutions in accordance with the instructions for use, to assign human oversight to competent personnel, to ensure that the input data under its control is relevant in view of the intended purpose, to keep logs, to support the development of AI literacy among its staff, and to fulfil its deployer obligations, in particular under Articles 26 and 50 of the Act, in accordance with the Act’s implementation timeline. Where the Customer places the AI Solutions on the market under its own name or trademark, makes a substantial modification to them or changes their intended purpose, the status of provider and the related obligations pass to the Customer pursuant to Article 25 of the Act.
8.2.1. SESTEK designs the AI Solutions so as to allow End Users to be informed that they are interacting with an AI system and provides the technical functions required for this purpose; upon request, it provides the flow and channel support necessary for such disclosure to be made. SESTEK’s current personal data protection policy relating to its own activities is available at https://www.sestek.com/legal/privacy-policy
8.2.2. In its interactions with End Users within the scope of the AI Solutions, the Customer is obliged to disclose clearly and understandably, at the start of the interaction and in a manner appropriate to the nature of the channel (audibly on voice channels), that the product or service used is AI-supported. Example: “This conversation is supported by artificial intelligence.” It is not sufficient for the disclosure to appear only in contractual or policy documents. The disclosure explains that the system operates in an automated or semi-automated manner and that the output is generated by artificial intelligence.
8.2.3. The channel and content of the disclosures to be made for transparency and data protection compliance purposes are determined by the Customer, provided that the minimum requirements in Clause 8.2.2 are met.
8.2.4. In AI Solutions that generate synthetic voice, text or other content, SESTEK provides the technical means to mark the Output as artificially generated in a machine-readable format; the Customer may not disable such marking. The labelling and disclosure of such Output, in particular content that realistically represents real persons, objects or events (deepfakes), in accordance with Article 50(4) of the EU AI Act and other applicable law is the responsibility of the Customer.
The Customer’s other obligations within the scope of the AI Solutions are set out below. Accordingly, the Customer:
9.1. The Business Partner is obliged to use and offer the AI Solutions provided by SESTEK solely in accordance with the instructions for use determined by SESTEK, the Agreement and applicable law.
9.2. The Business Partner is obliged to ensure transparency towards its own customers and, where necessary, End Users as to the fact that the service offered is AI-supported, in accordance with the rules in Clause 8.2, and to make the necessary disclosures.
9.3. Where the Business Partner identifies a security vulnerability, personal data breach, erroneous or biased output or unlawful use within the scope of the AI Solutions, it is obliged to notify SESTEK immediately and in any event within forty-eight (48) hours of identification.
9.4. Where the Business Partner falls within the scope of the EU AI Act by reason of the geography in which it operates or its target market, it is responsible for fulfilling the obligations imposed on it by the Act according to its role. Where the Business Partner merely resells the AI Solutions, the distributor obligations under Article 24 of the Act apply; where it offers the AI Solutions under its own name or trademark, makes a substantial modification to them or combines them with its own components, the status of provider and all related obligations rest with the Business Partner pursuant to Article 25 of the Act.
9.5. The Business Partner is obliged to provide the Guide to its own customers and to reflect the provisions of Sections 5, 6, 7 and 8 of the Guide in its agreements with its own customers with at least the same scope and level of protection. The Business Partner is responsible for the consequences of any failure to fulfil this obligation.
9.6. The Business Partner may not give, on behalf of SESTEK or in a manner binding on SESTEK, any undertaking or warranty as to performance, accuracy, security or legal compliance that is not contained in SESTEK’s official product documentation. The consequences of any such undertaking rest solely with the Business Partner.
9.7. Integration, customisation, installation and support services carried out by the Business Partner itself are the sole responsibility of the Business Partner. Service levels committed by the Business Partner to its own customers are not binding on SESTEK.
10.1. SESTEK identifies, analyses, assesses and monitors legal, social and technical risks within the scope of the AI Solutions. Risk assessments remain a focal point throughout the product lifecycle of the AI Solutions. Risks that may arise in relation to the AI Solutions are identified, assessed and managed within the framework of AI-related legislation, relevant standards such as ISO/IEC 42001, and the applicable guidelines and regulations.
10.2. SESTEK regularly updates the AI Solutions and carries out performance and security checks.
10.3. This Guide is updated in line with technological and legal developments in accordance with the procedure set out in Section 3, and its current version is published on SESTEK’s website.
11.1. Stakeholders may submit notifications and support requests relating to the AI Solutions through the contact details available on SESTEK’s website, the e-mail address privacy@sestek.com or the relevant support channels.
11.2. Stakeholders who notice an error, bias or security risk in the AI Solutions are expected to notify SESTEK without delay; the notification obligations of the Customer and the Business Partner are set out in Clauses 8.3 and 9.3.
©2026 SESTEK. All rights reserved.
