Data Processing Addendum

Provider PINHAN GROUP LLC — a limited liability company formed in the State of Delaware, USA
Address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA
E-mail: [email protected]
COTA CRM is a product of PINHAN GROUP LLC. pinhangroup.com

This Data Processing Addendum (the "DPA") is entered into between PINHAN GROUP LLC, a limited liability company formed in the State of Delaware, USA, with its registered address at 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA ("PINHAN GROUP LLC" or the "Processor"), and the business that uses the COTA CRM service (the "Customer" or the "Controller"). It forms an integral part of the Terms of Service (the "Terms") and applies whenever Customer Data includes personal data. It takes effect when the Customer starts using the service or accepts the Terms and requires no separate signature.

Scope. This DPA governs only Customer Data that PINHAN GROUP LLC processes as a processor. Data that PINHAN GROUP LLC processes as a controller (website visitors, demo/contact forms, Customer account, billing and support data) is governed by the Privacy Policy and the KVKK Privacy Notice.

1. Definitions

"Customer Data" means all data that the Customer or its authorised users enter into, or collect through, the service and that is processed on the Customer's behalf.
"Personal Data" means any information within Customer Data relating to an identified or identifiable natural person, including "personal data" under the GDPR, UK GDPR and Turkish Law No. 6698 ("KVKK") and "personal information" under the CCPA.
"Data Protection Laws" means KVKK and its secondary legislation; Regulation (EU) 2016/679 ("GDPR"); the UK Data Protection Act 2018 and UK GDPR; the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended (CCPA/CPRA) and other US state privacy laws; and any other data protection law applicable to the Customer.
"Subprocessor" means a third party engaged by PINHAN GROUP LLC to process Personal Data on its behalf.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data.
"SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner's Office ("ICO"). "KVKK Standard Contract" means the standard contract texts published by the Turkish Personal Data Protection Board under KVKK Art. 9.

Terms such as "controller", "processor", "data subject" and "processing" have the meanings given in the Data Protection Laws.

2. Scope, Roles and Order of Precedence

2.1. For Customer Data, the Customer is the controller (under the CCPA, the "business") and PINHAN GROUP LLC is the processor (under the CCPA, the "service provider"). Where the Customer acts on behalf of another controller (for example within a franchise structure), the Customer is a processor and PINHAN GROUP LLC is a subprocessor, and this DPA applies accordingly; the Customer warrants that it has the necessary instructions and authority from that controller.
2.2. The subject matter, duration, nature and purpose of processing, the types of Personal Data and the categories of data subjects are set out in Annex I.
2.3. On data protection matters, the order of precedence is: (i) the SCCs, the UK Addendum and the KVKK Standard Contract (to the extent they apply); (ii) this DPA; (iii) the Terms and any signed order form or agreement. On data protection matters this DPA prevails over the Terms; the general order of precedence is set out in the Terms.
2.4. The Customer is responsible for establishing a lawful basis for the processing, for providing notices to data subjects, for obtaining any required explicit consents and commercial-message permissions (including İYS registration where applicable), and for its own compliance with the Data Protection Laws.

3. Processing Instructions

3.1. PINHAN GROUP LLC processes Personal Data only on the Customer's documented instructions and for the purpose of providing the service. The Customer's documented instructions are: the Terms and this DPA; the configuration and actions of the Customer and its users in the service; and reasonable additional documented instructions sent by support ticket or e-mail.
3.2. PINHAN GROUP LLC does not use Customer Data for its own purposes, does not sell or share it, and does not use it to train artificial intelligence models. Only aggregated and anonymised statistics may be generated for the security, performance and billing of the service.
3.3. PINHAN GROUP LLC will not process Personal Data other than on instructions unless required to do so by law, in which case it will inform the Customer beforehand unless the law prohibits this.
3.4. PINHAN GROUP LLC will immediately inform the Customer if, in its opinion, an instruction infringes the Data Protection Laws, and may suspend the affected processing until the instruction is amended or confirmed.

4. Confidentiality of Personnel

PINHAN GROUP LLC limits access to Personal Data to personnel and authorised representatives who need it to perform their duties, and ensures that they are bound by a written confidentiality undertaking or a statutory duty of confidentiality. This obligation continues after the processing ends.

5. Security Measures

PINHAN GROUP LLC implements and maintains appropriate technical and organisational measures proportionate to the risk (GDPR Art. 32; KVKK Art. 12). The minimum measures are set out in Annex II. PINHAN GROUP LLC will not make changes that materially reduce the overall level of protection described there. The Customer remains responsible for the security of its user accounts, passwords and permissions and for choosing appropriate settings when configuring the service.

6. Subprocessors

6.1. General authorisation. The Customer gives PINHAN GROUP LLC general authorisation to engage Subprocessors. The current list is published on the Subprocessors page (Annex III).
6.2. Notice of changes. PINHAN GROUP LLC will give the Customer at least 30 days' prior notice of any intended addition or replacement of a Subprocessor, by updating the Subprocessors page and by e-mailing the account owners.
6.3. Objection. Within 30 days of the notice, the Customer may object in writing on reasonable data protection grounds. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected service without penalty, with a pro-rata refund of prepaid fees for the unused period to the extent required by mandatory law. Absence of an objection is deemed acceptance of the change.
6.4. Flow-down and liability. PINHAN GROUP LLC enters into a written contract with each Subprocessor imposing data protection obligations that are in substance the same as those in this DPA, and remains liable to the Customer for the Subprocessor's performance of those obligations.
6.5. Integrations that the Customer configures itself (its own SMTP server, SMS provider, AI key, WhatsApp account and similar) are the Customer's own processors and are not PINHAN GROUP LLC's Subprocessors.

7. Assistance with Data Subject Requests

7.1. Taking into account the nature of the processing, PINHAN GROUP LLC assists the Customer by appropriate technical and organisational measures in responding to requests to exercise data subject rights (information, access, rectification, erasure, restriction, portability, objection, rights relating to automated decision-making, KVKK Art. 11, CCPA rights and similar). The parties acknowledge that the Customer can fulfil most such requests itself using the customer record, export and deletion/anonymisation tools in the panel; where those tools are insufficient, PINHAN GROUP LLC will provide reasonable assistance.
7.2. If a data subject sends PINHAN GROUP LLC a request relating to Customer Data, PINHAN GROUP LLC will forward it to the relevant Customer without undue delay and will not respond on the substance unless instructed in writing by the Customer (it may tell the data subject that the request has been forwarded).

8. Data Protection Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, PINHAN GROUP LLC will provide reasonable information to assist the Customer with data protection impact assessments and prior consultations with supervisory authorities required under the Data Protection Laws.

9. Personal Data Breach

9.1. PINHAN GROUP LLC will notify the Customer of a Personal Data Breach affecting Customer Data without undue delay and in any event within 48 hours of becoming aware of it, so that the Customer can meet its 72-hour notification obligations under GDPR Art. 33 and KVKK Art. 12(5).
9.2. The notice will, to the extent known, describe: the nature of the breach (categories and approximate numbers of data subjects and records concerned); a contact point; the likely consequences; and the measures taken or proposed. Where all information is not immediately available, it may be provided in phases.
9.3. PINHAN GROUP LLC will investigate the cause, take reasonable steps to mitigate the effects, and cooperate with the Customer in notifications to supervisory authorities and data subjects. Unless required by law, PINHAN GROUP LLC will not name the Customer in any third-party or public statement without its written approval. A breach notification is not an acknowledgement of fault or liability.

10. International Transfers

10.1. Hosting. Customer Data is hosted in a data centre in Germany (European Union). PINHAN GROUP LLC (United States) and certain Subprocessors (Annex III) may access or otherwise process that data, which may constitute a transfer under applicable law.
10.2. EU/EEA. For Personal Data subject to the GDPR, Module Two (controller to processor) of the SCCs applies to transfers from the Customer to PINHAN GROUP LLC, and Module Three (processor to processor) applies to transfers from PINHAN GROUP LLC to Subprocessors. The SCCs are incorporated into this DPA by reference with the following elections: Clause 7 (docking clause) applies; Clause 9(a) Option 2 (general written authorisation) applies, with a notice period of 30 days; the optional language in Clause 11 does not apply; Clause 13: the competent supervisory authority is that of the Member State in which the Customer is established; where the Customer is not established in the EU but has appointed a representative under GDPR Art. 27, that of the Member State in which the representative is established, and where there is no representative, the Irish Data Protection Commission; Clause 17: the law of Ireland; Clause 18(b): the courts of Ireland. Annexes I, II and III to this DPA are the annexes to the SCCs. In case of conflict, the SCCs prevail. Where PINHAN GROUP LLC or a Subprocessor is certified under the EU-US Data Privacy Framework, the transfer may additionally rely on that framework.
10.3. United Kingdom. For transfers subject to the UK GDPR, the ICO's International Data Transfer Addendum is incorporated by reference alongside the SCCs above. The parties and contact details required by Table 1 of the Addendum are those in Annex I; the SCC modules and elections in Table 2 are those in Section 10.2; and the appendix information in Table 3 is in Annexes I to III. UK representative: Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].
10.4. Switzerland. For transfers subject to the FADP, the SCCs apply with references to "Member State" understood to include Switzerland so that data subjects in Switzerland may enforce their rights, and with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
10.5. Turkey (KVKK Art. 9). Under KVKK Art. 9 as amended by Law No. 7499, transfers abroad depend on signing the standard contracts published by the Board or on another ground listed in Art. 9. On request of a Customer established in Turkey, PINHAN GROUP LLC will provide the Board's standard contract text unchanged for signature and will support the Customer's notification to the Authority, which must be made within five business days of signature, with the necessary information and documents. PINHAN GROUP LLC does not claim that an adequacy decision exists. In case of conflict, the KVKK Standard Contract prevails over this DPA.
10.6. Supplementary measures. The measures in Annex II (encryption in transit and at rest for backups, access controls) apply to transfers. If PINHAN GROUP LLC considers a public authority's request for access to Personal Data to be unlawful, or to the extent the law permits it to challenge it, it will reasonably review the request and, unless prohibited, inform the Customer.

11. Special Categories and Health Data

11.1. Depending on the Customer's sector and the fields it enables (dental, clinic, physiotherapy, dietitian, psychology, beauty treatments and similar), Customer Data may contain health data or other special-category or sensitive Personal Data. Customers should enable and enter only the fields they genuinely need.
11.2. The Customer is responsible for having a valid legal basis and the data subjects' explicit consent (or another condition under applicable law) for such processing, for any obligations arising under health-care legislation, and for adequate measures under KVKK Art. 6.
11.3. PINHAN GROUP LLC maintains the security measures in Annex II for such data and processes it only to provide the service. Photographs (for example before/after photographs) are not processed for unique identification.

12. AI Processing (COTAI)

12.1. When the COTAI feature is used, prompts, relevant business context and (for expense OCR) receipt images are sent to the AI provider. Phone numbers and e-mail addresses are automatically masked before sending; names may be pseudonymised.
12.2. Customer Data is not used by PINHAN GROUP LLC, nor by AI providers through PINHAN GROUP LLC's account, to train models. The default provider and, where enabled, alternative providers are listed as Subprocessors (Annex III).
12.3. The Customer may disable COTAI or, where available, choose the provider; if it uses its own provider key, that provider is the Customer's own processor (Section 6.5). COTAI output is labelled as AI-generated and is not used to make decisions producing legal effects on individuals; human review of output is the Customer's responsibility.

13. Deletion or Return

13.1. For 30 days after the end of the service relationship, the Customer may export Customer Data from the panel.
13.2. After that period, Customer Data is deleted, and copies in backups are destroyed no later than 90 days after termination, except where the law requires retention, in which case the data is kept and processed only for that purpose.
13.3. On the Customer's written request, PINHAN GROUP LLC will confirm in writing that deletion has been completed.

14. Audits

14.1. PINHAN GROUP LLC will, on request, make available the information necessary to demonstrate compliance with this DPA. This is provided first through written documentation, security descriptions, existing reports and completed security questionnaires.
14.2. If that information is insufficient, or a supervisory authority so requires, the Customer (or an independent auditor bound by confidentiality) may audit PINHAN GROUP LLC's processing operations on-site on 30 days' written notice, within reasonable scope and duration, without disrupting PINHAN GROUP LLC's operations or other customers' data, and at the Customer's own cost. Audits are limited to once per year unless a Personal Data Breach has occurred or the law or a supervisory authority requires otherwise. The auditor must sign a confidentiality undertaking and may use the information only to assess compliance with this DPA.

15. CCPA and Other US State Privacy Laws

To the extent Personal Data is processed under the CCPA/CPRA or other US state privacy laws, PINHAN GROUP LLC acts as the Customer's "service provider" (or "processor") and agrees that it:

(a) processes Personal Data only for the specific business purposes of providing the COTA CRM services described in the Terms on the Customer's behalf;
(b) does not sell or share Personal Data (including for cross-context behavioural advertising);
(c) does not retain, use or disclose Personal Data for any purpose other than those business purposes, or outside the direct business relationship with the Customer;
(d) does not combine Personal Data with personal information it receives from other sources or collects from its own interactions with individuals, except as the law permits for business purposes;
(e) certifies that it understands these restrictions and will comply with them;
(f) will notify the Customer if it determines that it can no longer meet its obligations under the applicable law; the Customer may take reasonable and appropriate steps to stop and remediate unauthorised use;
(g) will assist the Customer in responding to consumer requests as set out in Section 7 and will bind its Subprocessors to terms consistent with this Section.

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms (including the cap set out there). This limitation does not apply to liability that cannot be limited under applicable law, including liability to data subjects under the SCCs. Each party is liable to data subjects and supervisory authorities in proportion to its responsibility, and rights of recourse against the other party are reserved.

17. Term

This DPA remains in force for as long as the Customer uses the service and PINHAN GROUP LLC processes Customer Data. Sections 4, 9, 13, 14 and 16 survive the end of the processing until Customer Data has been deleted. PINHAN GROUP LLC may update this DPA to reflect changes in the Data Protection Laws or new standard contracts issued by competent authorities; material changes are notified 30 days in advance in the manner provided in the Terms.

Annex I - Parties and Description of Processing

A. Parties

Role	Party
Controller / data exporter	The Customer: the business that opened the COTA CRM account. Name, address and contact details are those in the account registration; the contact person is the account owner.
Processor / data importer	PINHAN GROUP LLC, a limited liability company formed in the State of Delaware, USA, 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA; contact: [email protected].

B. Description of processing

Item	Description
Categories of data subjects	The Customer's clients and prospects; the Customer's staff and panel users; signers of documents; vehicle owners; pet owners; other individuals the Customer records.
Categories of Personal Data	Name, phone, e-mail, address, birth date; national ID number (optional field); notes and custom fields; appointments, purchases, payments and loyalty records; vehicle/plate data; pet data; before/after photographs; body measurements (weight, BMI, body fat, etc.); e-signatures (including verification of the signer by national ID number and one-time password) and documents; for staff: name, e-mail, phone, role/branch, login one-time password (hashed), activity/audit logs (including IP address), push notification tokens.
Special categories / sensitive data	Depending on the Customer's sector and the fields it enables, possibly health data (for example clinic, dental, physiotherapy, dietitian, psychology and beauty treatments). Photographs are not processed for unique identification. Additional safeguards: Annex II and Section 11.
Frequency	Continuous, for the duration of the service.
Nature of processing	Hosting, storage, recording, organisation, display, transmission (for example sending SMS/e-mail/WhatsApp/push messages as directed by the Customer), backup, deletion, and support access.
Purpose	Providing the COTA CRM services to the Customer under the Terms (CRM, appointments, POS, packages/credits, quotes, stock, loyalty, commissions, e-signature, customer portal, online store, messaging, COTAI, reporting and similar), security and support.
Retention	For the duration of the service; on termination Section 13 applies (30-day export; deletion within 90 days including backups).
Transfers to Subprocessors	To the Subprocessors in Annex III, limited to the subject matter, nature and duration of the processing above; purpose and location for each Subprocessor are stated in Annex III.

C. Competent supervisory authority

As determined under SCC Clause 13 and Section 10.2; for Customers established in Turkey, the Personal Data Protection Board; for the UK, the ICO; for Switzerland, the Federal Data Protection and Information Commissioner. EU representative: Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].

Annex II - Technical and Organisational Measures

Data separation: each Customer's data is held in its own separate database.
Encryption in transit: TLS is used for all connections.
Authentication: e-mail one-time-password (OTP) login; the OTP is stored hashed, valid for 10 minutes and limited to 5 attempts.
Access control: role-based and branch-based access control; the scope of data access (own records, branch, whole business) is restricted per user.
Protection of secrets: secrets and credentials are stored encrypted.
File storage: photographs and files are held in private (not publicly accessible) storage.
Abuse protection: rate limiting; bot protection on public booking and store pages.
Traceability: activity and audit logs are kept.
Backups: encrypted off-site backups; local backups are kept for 7 days and off-site backups for approximately 30 days. Backups are encrypted client-side before upload.
Data minimisation: raw IP addresses are not stored in website analytics (daily salted hash); analytics is enabled only with consent. Telephone numbers and e-mail addresses are masked before data is sent to AI providers.
Subprocessor management: contractual obligations under Section 6.
Incident management: notification within 48 hours under Section 9.

PINHAN GROUP LLC makes no representation that it holds any security certification or independent audit report.

Annex III - Subprocessors

The current list of Subprocessors, their locations and transfer safeguards is published at https://cotacrm.com/legal/subprocessors?lang=en. The general authorisation and the change procedure are set out in Section 6.