Address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA
E-mail: [email protected]
COTA CRM is a product of PINHAN GROUP LLC. pinhangroup.com
A "subprocessor" is a third party engaged by PINHAN GROUP LLC to process personal data on a Customer's behalf in providing the COTA CRM service. This page is Annex III to the Data Processing Addendum. Customer Data is primarily stored in a data centre in Germany (European Union); the other subprocessors below are involved only for the stated purpose and to the extent necessary.
1. PINHAN GROUP LLC subprocessors
| Subprocessor | Purpose | Data categories | Location | Transfer safeguard |
|---|---|---|---|---|
| Hosting provider (data centre) | Application servers, databases and file storage; primary storage of all data | All Customer Data | Germany (EU) | Storage within the EU; SCCs / KVKK standard contract for access from outside the EU |
| Cloudflare, Inc. | Bot protection (Turnstile) on public booking and store pages; encrypted off-site backups (R2) | Bot protection: visitor connection data (IP etc.); backups: Customer Data (encrypted client-side before upload) | Global / USA | SCCs; EU-US DPF where certified |
| Resend (Plus Five Five, Inc.) | Delivery of transactional and package e-mails | Recipient e-mail address, name, message content | USA | SCCs; DPF where certified |
| NetGsm İletişim ve Bilgi Teknolojileri A.Ş. | SMS delivery (platform account) | Recipient phone number, message content | Turkey | KVKK standard contract; SCCs for EU/UK-origin data |
| İleti Merkezi | SMS delivery (if the Customer chooses it) | Recipient phone number, message content | Turkey | KVKK standard contract; SCCs for EU/UK-origin data |
| Meta Platforms (WhatsApp Business Cloud API) | WhatsApp messages; only if the Customer connects its WhatsApp account | Recipient phone number, message content | USA / EU | SCCs; DPF where certified |
| Anthropic, PBC | COTAI AI assistant (default provider); API data is not used for model training | Prompts, business context, expense receipt images (phone numbers and e-mail addresses masked) | USA | SCCs; DPF where certified |
| Google LLC (Gemini), OpenAI | Alternative AI providers; only if enabled or used with the Customer's own key | Prompts, business context (masked) | USA | SCCs; DPF where certified |
| Expo (650 Industries, Inc.) | Mobile push notifications | Push token, notification content | USA | SCCs; DPF where certified |
| Let's Encrypt (ISRG) | TLS certificates | No personal data beyond domain names | USA | Not required (no personal data transferred) |
| Google Fonts / public CDNs (jsDelivr, cdnjs) | Serving fonts and scripts on public pages | IP address only | Global | SCCs; DPF where certified |
"SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 (together with the UK International Data Transfer Addendum for UK transfers). "DPF" means the EU-US Data Privacy Framework, which can be relied on only where the relevant subprocessor is certified. For transfers from Turkey, the standard contract published by the Personal Data Protection Board under KVKK Art. 9, or another ground in Art. 9, is used.
2. Customer-configured providers (not PINHAN GROUP LLC subprocessors)
Providers that the Customer connects using its own account or key are the Customer's own processors. They are not PINHAN GROUP LLC's subprocessors, and the Customer is responsible for its contracts with them.
| Provider type | Description |
|---|---|
| Own SMTP server | The server the Customer configures for sending e-mail |
| Own SMS provider | An SMS service the Customer connects under its own contract/account |
| Own AI key | An AI provider used with the Customer's own API key |
| Own WhatsApp account | The Customer's own WhatsApp Business account |
3. Change notification and objection
- At least 30 days before a new subprocessor is added or an existing one is replaced, this page is updated and an e-mail is sent to account owners.
- Within 30 days of the notice, the Customer may object in writing, on reasonable data protection grounds, by e-mailing [email protected]. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected service under Section 6.3 of the Data Processing Addendum.
- If no objection is made in time, the change is deemed accepted.
Last updated: 2026-10-19
