Acceptable Use Policy

1. Purpose and scope

1. This Acceptable Use Policy (the "Policy") sets out the purposes for which, and the limits within which, the COTA CRM service (the "Service") provided by PINHAN GROUP LLC (the "Company") may be used. The Policy forms an integral part of the Terms of Service; capitalised terms not defined here have the meaning given in the Terms.
2. The Policy applies to the business or professional using the Service (the "Customer"), to every person the Customer authorises to use it (a "User"), and to anyone who uses or accesses business pages built with the Service (mini-sites, online booking, online stores, customer portals, custom domains and similar).
3. The Customer is responsible for the acts and omissions of its Users and of those using its business pages as if they were its own. A breach of this Policy does not relieve the Customer of liability to third parties or under applicable law.

2. Unlawful and prohibited content

No data or content entered into, stored in, published through or sent via the Service may:

• violate applicable law, orders of competent authorities, public order or public morals, or constitute or incite a criminal offence;
• involve fraud, deception, impersonation of a person, organisation or authority (including phishing), forged documents, fake reviews or fake promotions;
• contain hate speech, discrimination, harassment, threats, or glorification or promotion of violence or terrorism;
• contain child sexual abuse material or any content that harms minors;
• advertise or sell unlawful or regulated goods and services (narcotics, weapons, illegal betting and gambling, counterfeit or stolen goods, unlawful trade in data, and similar);
• infringe the personality rights, privacy, reputation or intellectual property rights of third parties;
• be defamatory, insulting or amount to unfair competition against any person, organisation or the Company;
• contain malware, malicious code or links leading to them.

3. Messaging rules

A Customer that sends SMS, WhatsApp, e-mail or push notifications ("Messages") through the Service agrees to the following:

1. Prior consent. Commercial Messages may be sent only with the recipient's prior and valid consent. The channel, date and scope of each consent must be recorded in a form capable of proof.
2. Law No. 6563 and İYS. For recipients in Turkey, Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communications and Commercial Electronic Messages apply. The Customer is responsible for registering with the Message Management System (İYS), uploading and keeping recipient consents up to date, and checking İYS records before sending any commercial message.
3. Transactional versus commercial Messages. Informational Messages tied to an existing service relationship (appointment confirmations and reminders, order or payment information) must be kept separate from commercial Messages (campaigns, discounts, promotions, loyalty offers). Marketing content must not be added to transactional Messages; any content of a commercial nature is subject to the rules on commercial Messages.
4. Opt-out. Every commercial Message must offer the recipient a free and easy way to opt out. Opt-out requests must be honoured without delay and, for recipients in Turkey, within three (3) business days at the latest; elsewhere within the period required by applicable law. No commercial Message may be sent to a recipient who has opted out.
5. Sender identification. Each Message must clearly identify the Customer by trade name or name and provide contact details; the sender name, subject and content must not mislead the recipient.
6. List sourcing. Messages must not be sent to purchased, rented, scraped or otherwise unlawfully obtained recipient lists. The Customer may message only its own customers and persons who have given consent.
7. Platform and operator rules. For WhatsApp Business Cloud API, the Customer must comply with Meta's WhatsApp Business and commerce policies and its template and quality rules; for SMS, with the rules of the relevant operators and SMS providers. The consequences of any blocking, restriction or quality downgrade imposed by a platform or operator rest with the Customer.
8. No misleading content. Messages must not contain misleading subject lines, false urgency, untrue promotions or discounts, concealment of identity, or content sent in the name of a third party without authority.
9. No nuisance. The Customer must observe contact-hour and quiet-hour restrictions wherever the law requires them and must not subject recipients to excessive or persistent Messages.

4. Security and technical abuse

The following are prohibited:

• scanning, probing or testing the Service, servers or network for vulnerabilities without authorisation;
• circumventing or attempting to circumvent authentication, authorisation checks, role and branch restrictions, quota and plan limits, or the isolation of data between Customers (tenant isolation), or attempting to access another Customer's data;
• scraping or systematically harvesting data from the Service, its APIs or business pages by automated means;
• load, stress, performance or denial-of-service (DoS/DDoS) testing without the Company's prior written permission;
• uploading, distributing or executing malware, viruses, worms, ransomware or similar code;
• sharing, selling, transferring or attempting to obtain user accounts, passwords, one-time codes or access keys;
• reverse engineering the Service, attempting to access its source code, disabling security mechanisms, or bypassing bot protection or rate limits.

Vulnerability reporting. Anyone who discovers a security vulnerability in the Service must report it to [email protected] without exploiting it, accessing or disclosing data, and before any public disclosure, allowing a reasonable period for remediation (responsible disclosure). The Company will not pursue legal action against a reporter who acts in good faith, causes no harm and follows these principles, and will use reasonable efforts to assess and remedy the report.

5. Personal data and special-category data

1. The Customer is the controller of personal data it enters into the Service (see the Data Processing Addendum). Every processing activity must rest on a lawful basis under Turkish Law No. 6698 (KVKK), the GDPR and other applicable law, and data subjects must be properly informed.
2. Only the minimum data necessary for the purpose may be collected and recorded; data must be deleted or anonymised when the purpose ends.
3. Health data and other special-category personal data may be entered only where explicit consent or another processing condition provided by law exists. Unnecessary recording of such data, accumulation of health information in free-text fields, and use for incompatible purposes are prohibited.
4. A Turkish national ID number (T.C. kimlik no.) may be requested and recorded only where there is a genuine need, such as a legal obligation or identity verification.
5. Personal data of children may be processed only with the consent of the legal guardian or where another condition provided by law is met.
6. Unlawfully collecting, selling, transferring or disclosing other persons' personal data through the Service is prohibited.

6. Use of COTAI (AI assistant)

1. COTAI must not be used to generate unlawful, harmful, misleading, discriminatory or harassing content, content described in Section 2, or malicious code, or to bypass security controls.
2. COTAI outputs must not be used without human review for automated decisions that produce legal effects on individuals or similarly significantly affect them (for example refusal of service, discriminatory pricing, or health, credit or employment decisions).
3. Do not enter into COTAI special-category or health data, national ID numbers, passwords or payment instrument details that are not necessary for the purpose.
4. COTAI is an AI system and its outputs may be inaccurate or incomplete. The Customer must verify outputs before relying on or sharing them, and must not present them as legal, financial, medical or other professional advice.

7. Intellectual property and third-party rights

1. The Customer warrants that content it uploads to or publishes through the Service (text, images, logos, photographs, document templates, music, fonts and similar) is its own or that it holds all rights and permissions needed to use it.
2. Content that infringes the copyright, trade marks, patents, trade secrets or personality rights of third parties must not be uploaded. The Customer must obtain the necessary permissions from persons who appear in photographs on its business pages.
3. The names and logos "COTA CRM" and "COTAI" and the Company's software and documentation must not be copied, altered or presented as the Customer's own, and no impression of affiliation with or endorsement by the Company may be created without authority.
4. Rights holders may report alleged infringements to the Company using the method in Section 10.

8. Resource use and fair use

1. The Customer must stay within the user, branch, storage, API and other quota limits stated in its plan and Order Form. Exceeding a quota may be subject to additional fees or a plan upgrade.
2. E-mail, SMS and similar message packages may be used only for the Customer's own business. Reselling or transferring packages, or bulk sending on behalf of other businesses, is prohibited.
3. Excessive or abnormal use that unreasonably degrades the performance of the Service or shared infrastructure for other customers breaches fair use. In such cases the Company may restrict use, apply rate limits, or require the Customer to adjust its usage.

9. Monitoring and enforcement

1. Investigation. Where a breach of this Policy is suspected, or on a third-party complaint, a platform or operator notice, or a request from a competent authority, the Company may, within the limits of applicable law and its confidentiality obligations, review records, logs and relevant content to the extent necessary to establish the breach. The Company accesses Customer Data only for this purpose and only as far as necessary.
2. Measures. Depending on the nature and seriousness of the breach, the Company may (a) issue a warning, (b) remove or disable the relevant content, business page or Message sending, (c) suspend all or part of the Service, or (d) terminate the agreement on the terms set out in the Terms. In serious or urgent cases these measures may be applied without prior notice; where possible, notice will be given afterwards.
3. Cooperation with authorities. The Company cooperates with competent authorities on lawful court orders and requests from prosecutors or regulators and, to the extent the law permits, may disclose the information required.
4. No obligation to monitor. The Company has no general obligation to monitor, review or verify the lawfulness of Customer Data or of Messages sent by the Customer. A decision not to remove or review content does not mean the content is acceptable. The lawfulness of content and Messages is the sole responsibility of the Customer.
5. Enforcement measures do not limit the Company's other rights and remedies or the Customer's indemnification obligations.

10. Reporting abuse

1. Complaints and reports of content, Messages or conduct that breach this Policy should be sent to [email protected].
2. Reports should include, as far as possible: the reporter's name and contact details; the rule or right allegedly breached; a clear description of the content, page, address (URL) or Message concerned, with screenshots and the date and time where available; the basis of the claim and, for intellectual property reports, evidence of ownership of the right; and a statement that the report is made in good faith and is accurate.
3. The Company will review reports within a reasonable time and apply such measures as it considers necessary under Section 9. Persons who knowingly make false or bad-faith reports are responsible for them.

11. Changes

The Company may update this Policy to reflect changes in law, platform and operator rules, or the Service. Material changes will be notified to account owners by e-mail and/or in-service notice at least 30 days before they take effect, and the current text will be published on the Site with the date shown at the top of the page. Urgent changes required by law or security may take effect immediately. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy; the Customer's rights of cancellation and termination under the Terms are unaffected.

Contact

PINHAN GROUP LLC, 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA — [email protected]. Corporate site: pinhangroup.com.