Address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA
E-mail: [email protected]
COTA CRM is a product of PINHAN GROUP LLC. pinhangroup.com
Purpose and scope. This Privacy Policy explains how PINHAN GROUP LLC ("the Company", "we", "us") processes personal data in connection with the COTA CRM product, including the website (cotacrm.com), its subdomains, custom domains and the mobile app, under applicable law including the EU General Data Protection Regulation (2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the California Consumer Privacy Act as amended by the CPRA ("CCPA"). For data subjects in Turkey, the notice required by KVKK Art. 10 is set out in the KVKK Privacy Notice; cookies are covered in the Cookie Policy. This policy supplements them.
1. Who we are
PINHAN GROUP LLC is a limited liability company formed in the State of Delaware, USA. Registered address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA. COTA CRM is a product of PINHAN GROUP LLC; the COTAI AI assistant is part of the same product. Privacy contact: [email protected].
Representatives.
- EU representative (GDPR Art. 27): Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].
- UK representative: Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].
- Turkey (KVKK / VERBIS) representative: Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].
2. Scope and roles
COTA CRM is provided as a business-to-business SaaS service to businesses and professionals ("Customers"); it is not directed at consumers. Our role depends on the processing activity:
- We are the controller for: website visitors; people who submit demo, contact or data-request forms; Customer account, billing and support data; account and security data of Customer users (staff); and our marketing communications.
- We are a processor (service provider) for data that a Customer enters or uploads about its own clients, patients, staff and others ("Customer Data"). The Customer is the controller of Customer Data. We process it only on the Customer's documented instructions and under the Data Processing Addendum; we do not use it for our own purposes, sell or share it, or train AI models on it. We generate only aggregated, anonymised service statistics.
If you are a client, patient or customer of a business using COTA CRM, that business is responsible for your data: please contact it first, and refer to its own privacy notice. We forward any such requests we receive to the relevant business without undue delay.
3. Data we collect
| Category | Data | Source |
|---|---|---|
| Website visitors | Strictly necessary session cookies; cookie banner choice; language preference cookie; server access logs (IP address, browser information, request time). Only with your consent, analytics: a random visitor ID (cota_vid), pages viewed, referrer, UTM parameters, language, time zone, screen size, device/browser/operating system. IP addresses are not stored in raw form for analytics; a daily-salted SHA-256 hash is used. | You and your browser, automatically |
| Demo, contact and request forms | Name, e-mail, phone, sector, message, plan of interest, referral code, IP address, user agent, notice/consent timestamps, separate and optional marketing consent | You |
| Customer account and users | Name, e-mail, phone, role and branch, login one-time code (stored hashed, valid for 10 minutes), activity and audit logs (including IP), push notification tokens; invoicing and payment records; support correspondence | The Customer and its users; use of the service |
| Customer Data (as processor) | Personal data entered by the Customer: name, phone, e-mail, address, date of birth, optional national ID number, notes, appointments, purchases and payments, loyalty, vehicle/plate, pet details, before/after photos, body measurements, e-signatures and documents. Depending on the sector it may include special-category data such as health data; the legal basis and any required explicit consent are the Customer's responsibility. | The Customer and its users |
| COTAI (AI assistant) | Your prompts, business context and receipt images (OCR). Phone numbers and e-mail addresses are automatically masked before being sent to the AI provider; names may be pseudonymised. | Customer users |
We do not request special-category data through the website; please do not enter such data in forms.
4. Purposes and legal bases
| Purpose | GDPR / UK GDPR basis | KVKK basis |
|---|---|---|
| Responding to demo and pre-contract requests; opening accounts, providing the service, billing and support | Art. 6(1)(b) contract | Art. 5/2-c |
| Answering contact-form enquiries; security of the site and service, fraud and abuse prevention, service improvement (aggregated) | Art. 6(1)(f) legitimate interests | Art. 5/2-f |
| Analytics cookies and visitor measurement | Art. 6(1)(a) consent (and ePrivacy rules) | Art. 5/1 explicit consent |
| Commercial electronic messages (separate, optional consent) | Art. 6(1)(a) consent | Art. 5/1 explicit consent; Law No. 6563 |
| Tax, accounting and commercial-law obligations; handling data-subject requests; proof of consent; responding to authorities | Art. 6(1)(c) legal obligation; (f) for establishing and defending claims | Art. 5/2-ç, 5/2-e |
You may withdraw marketing consent at any time; withdrawal does not affect earlier processing. Consent is never a condition of using the service.
5. Sources
We obtain data mostly directly from you (forms, account creation), automatically from your browser or device (cookies, server logs) and from the Customer (user accounts and Customer Data). We do not collect Customer Data from the data subjects themselves; it is entered by the Customer.
6. Recipients and subprocessors
We share data only with: (i) subprocessors engaged to deliver the service under written data protection obligations (hosting, bot protection and backups, e-mail, SMS, WhatsApp, push notifications, AI providers, etc.); (ii) public authorities and courts where legally required or requested; and (iii) in a merger, acquisition or restructuring, the relevant parties, subject to protection consistent with this policy. The current list of subprocessors, their purposes and locations is on the Subprocessors page. We do not sell or rent personal data and do not disclose it to third parties for advertising.
7. International transfers
Data is hosted primarily in a data centre in Germany (European Union). Because the Company is established in the United States and some subprocessors are located in the US and elsewhere, data may be accessed from or transferred to those countries. Transfers are protected as follows:
- EU/EEA and UK: the European Commission's Standard Contractual Clauses (Decision 2021/914; Module 2 between Customer and the Company, Module 3 between the Company and subprocessors), the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where a subprocessor is certified, and supplementary measures such as encryption and access controls.
- Turkey: the standard contracts published by the KVKK Board under Art. 9 (as amended by Law No. 7499) or other grounds in Art. 9; standard contracts are signed unchanged and notified to the Authority within the statutory period. Explicit consent is not used as the basis for ordinary cross-border transfers.
- United States (CCPA/CPRA): service-provider contract terms.
8. Retention
- Visitor analytics: at most 180 days, then automatically deleted.
- Demo and contact enquiries: up to 2 years after the last contact.
- Marketing consent records: 3 years after withdrawal (Law No. 6563 and its regulation).
- Data-request records: as long as needed to demonstrate compliance and during the statutory limitation period.
- Invoicing and accounting records: for the period required by tax and commercial law.
- Customer Data: for the term of the agreement; after termination the Customer may export its data for 30 days, after which it is deleted, including from backups within 90 days of termination, unless the law requires retention.
Local backups are kept for 7 days and encrypted off-site backups for approximately 30 days.
9. Security
We apply technical and organisational measures including: a separate database per Customer; TLS on all connections; e-mail one-time-code login (stored hashed, valid 10 minutes, 5 attempts); role- and branch-based access control; encryption of secrets and credentials; private storage for photos and files; rate limiting; activity and audit logs; client-side-encrypted off-site backups; and no storage of raw IP addresses in analytics. No system is completely secure. For personal data breaches affecting data for which we are the controller, we notify the competent authorities within 72 hours where required; for Customer Data we notify the affected Customer without undue delay and within 48 hours of becoming aware.
10. Your rights
GDPR / UK GDPR. You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent where processing is based on consent, as well as the right to lodge a complaint with a supervisory authority.
KVKK Art. 11. You may learn whether your data is processed and request information; learn the purpose and whether it is used accordingly; know the third parties to whom it is transferred domestically or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under Art. 7; request notification of such actions to recipients; object to a result against you arising from exclusively automated analysis; and claim compensation for damage caused by unlawful processing.
CCPA/CPRA (California residents). The right to know the categories of personal information collected, their sources, purposes and recipients; to delete; to correct; to opt out of the sale or sharing of personal information (cross-context behavioural advertising); and not to be discriminated against for exercising these rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about individuals. You may use an authorised agent; we may ask to verify your identity.
11. How to exercise your rights; supervisory authorities
Submit requests through the Data Request Form or by e-mail to [email protected]. We respond free of charge within one month under the GDPR (extendable where permitted), 30 days under KVKK and 45 days under the CCPA; we may request additional information to verify your identity.
- Turkey: the Personal Data Protection Board (KVKK Board).
- EU/EEA: the data protection authority of the Member State where you live, work or where the alleged infringement occurred.
- United Kingdom: the Information Commissioner's Office (ICO).
- California: the California Attorney General and the California Privacy Protection Agency (CPPA).
12. Automated decision-making and COTAI
We do not take decisions based solely on automated processing that produce legal or similarly significant effects on individuals, and we do not carry out profiling. COTAI is clearly labelled as an AI system (EU AI Act Art. 50). Its outputs may be inaccurate and should be reviewed by a human. Prompts and business context sent to COTAI are transmitted to the AI provider in use (Anthropic, PBC by default; other providers only if the Customer enables them); phone numbers and e-mail addresses are masked automatically beforehand, and Customer Data is not used to train models.
13. Children
The services are intended for businesses and are not directed at persons under 16 (or under 18 where Turkish rules on consent of minors apply). We do not knowingly collect children's personal data and will delete it promptly if we learn that we have. Customers are responsible for their own legal obligations (such as parental consent) when entering children's data into the service.
14. Cookies
For details of cookies and similar technologies and how to manage your choices, see the Cookie Policy. You can change your choices at any time through the Cookie settings link at the bottom of the page.
15. Changes
We update this policy as the law or our processing changes. The current version is published at this address and the date at the top shows the last update. We will notify account owners of material changes by e-mail or in-service notice.
16. Contact
PINHAN GROUP LLC, 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA · [email protected] · https://pinhangroup.com
