Privacy Policy

1. Data controller

CoSuite is provided by Eva Soft Bilişim A.Ş. ("Eva Soft", "we"). The data controller for the personal data covered by this policy is Eva Soft Bilişim A.Ş. Address: Work10 İş Hanı, Hacı İlbey Mah. Ali Hikmet Paşa Cad. No:27/C, 10100 Altıeylül / Balıkesir, Türkiye. Email: hello@cosuite.io · Phone: +90 850 308 23 82.

For individuals in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK) applies; the detailed notice is in the KVKK Information Notice. For individuals in the European Economic Area, we also process personal data in line with the General Data Protection Regulation (GDPR).

2. Data we process

To provide the service we process the following data:

• Account and sign-up data: full name, email, phone, business name, country, sector, business type and team size, selected modules; your password is stored only in irreversible (hashed) form.
• Business data entered in the panel: information that you and your team enter into CoSuite, such as customer records, quotes and invoices, bookings, tasks, messages, stock and finance records.
• Payment data: subscription, invoice and payment transaction records. Card data is processed by the payment institution through our payment infrastructure PaymentHub; CoSuite does not see or store your card number.
• Usage and log data: IP address, browser and device information, sign-in times, logs of actions in the panel, error logs.
• Contact form data: the name, email, phone, business details and message you enter in the contact or early access form.
• Data obtained through cookies and similar technologies: see the Cookie Policy. Google Analytics only runs if you give consent.

3. Our role for business data

For data about third parties that you enter in the panel, such as your customers, patients or employees, your business is the data controller; Eva Soft processes this data only on your behalf and on your instructions, to provide the service, as a "data processor". Informing these individuals and having the necessary legal basis (including consent where required) is your business's responsibility.

4. Purposes and legal bases

We process your data for the following purposes, based on the legal grounds in KVKK articles 5 and 6 and, for individuals in the EEA, GDPR article 6:

• Opening the account, providing the service, installing modules and support: conclusion and performance of a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
• Invoicing, accounting, tax and logging obligations under Turkish Law No. 5651: legal obligation (KVKK art. 5(2)(ç); GDPR art. 6(1)(c)).
• Service security, preventing abuse and fraud, improving the service: legitimate interests (KVKK art. 5(2)(f); GDPR art. 6(1)(f)).
• Establishing, exercising and defending legal claims (KVKK art. 5(2)(e); GDPR art. 6(1)(f)).
• Visit measurement with Google Analytics and sending commercial electronic messages: explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). You can withdraw consent at any time.

We do not process special categories of personal data in your account data. Businesses that keep special category data such as health data in the panel (e.g. clinics) are responsible, as data controllers, for processing it in line with KVKK art. 6 (and GDPR art. 9 where applicable); we process such data only as a data processor and with additional security measures.

5. Recipients

We do not sell your data. We share it only as far as necessary for the purposes above, with:

• Hosting (server) provider: the servers the service runs on.
• Payment infrastructure: PaymentHub and its payment institution, to collect payments.
• Email delivery service: for verification, notification and invoice emails.
• e-Invoice / e-Archive services and our accountant: for statutory invoicing.
• Google (Google Analytics): only if you have given cookie consent, for visit measurement.
• The Asist apps you activate: when you activate an Asist app (e.g. SEOAsist, StudioAsist), CoSuite sends it only what it needs to work: business name, language, currency, time zone, country and members' name, email and role. Asist apps are also operated by Eva Soft.
• Competent public authorities: where required by law.

6. International transfers

Service data is hosted on servers located in Türkiye and/or the European Union. When Google Analytics is used, measurement data may be processed on Google's servers abroad (including the USA); this transfer takes place only with your explicit consent and in line with KVKK art. 9 (and, for EEA individuals, Chapter V of the GDPR). Transfers to other service providers with servers abroad rely on the appropriate safeguards set out in KVKK art. 9 (such as standard contracts).

7. Retention periods

• Account data: while the account is active and afterwards for the statutory limitation periods.
• Invoice and payment records: for the period required by tax and commercial law (generally 10 years).
• Usage and log data: about 2 years.
• Business data entered in the panel: kept for 30 days after the account is closed or a business is deleted, then permanently deleted.
• Contact form data: up to 2 years after your request is resolved.

Data whose retention period has expired is deleted, destroyed or anonymised.

8. Security

Data is transmitted over encrypted connections (TLS); each business's data is isolated from the others; team members' access is limited by roles and permissions; secret keys are stored encrypted; access is logged.

9. Your rights

Under KVKK art. 11 you have the right to learn whether your data is processed, request information, request correction or deletion, learn the recipients, object, and claim compensation for damage. Individuals in the European Economic Area may also exercise their GDPR rights: access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent at any time, and lodging a complaint with a supervisory authority.

You can send requests to hello@cosuite.io or in writing to the postal address above. Requests are answered free of charge within 30 days at the latest. Details are in the KVKK Information Notice.

10. Children

CoSuite is a service for businesses; it is not intended for anyone under 18 to open an account.

11. Changes

We may update this policy. The current version is always on this page; we notify account owners of significant changes by email or in the panel.