This Privacy Policy explains how personal data is processed when you use the pellacrm.com website, the workspaces hosted under pellacrm.com, the Pella CRM web application and the Pella CRM mobile app for iOS and Android, all operated by Pella CRM ("Pella CRM", "we").
Pella CRM is business management software built for multi-branch companies, covering sales, accounting, human resources, document management and internal communication. Some of the data in the system therefore belongs to people who deal with us directly, and a much larger part belongs to the employees and customers of the company that subscribes to us. The legal difference between those two groups is the most important distinction in this policy and is set out in section 2.
This policy is written against Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and its secondary legislation, and against the EU General Data Protection Regulation (GDPR). For the mobile apps it also contains the disclosures required by the Google Play User Data policy and the Apple App Store Review Guidelines.
1.What this policy covers
This policy applies to all of the products and services below, referred to collectively as the “Service”.
- The marketing website at pellacrm.com and the demo request form on it.
- The workspaces allocated to each customer under their own subdomain (e.g. yourcompany.pellacrm.com) and enterprise deployments reached through the customer's own domain.
- The Pella CRM mobile app for iOS and Android.
- The API, notification, search and realtime messaging infrastructure these applications run on.
We are not responsible for the privacy practices of third-party sites reached through links on our website; please review their own policies.
2.Controller and processor: which one we are
Pella CRM processes personal data in two different capacities. Which one applies depends on whose data it is and how it entered the system, and it determines who you should address your rights to.
As a controller: we process data about website visitors, people who request a demo, prospective and existing customer contacts, and anyone who contacts us about billing or support, for purposes and by means we determine ourselves. For that data, we are your counterparty.
As a processor: for the data a customer company enters into its workspace — employee records, customer and lead information, proposals, contracts, documents, messages, tasks and accounting entries — the controller is that company. We process it only on our customer's instructions and only as far as the subscription agreement and our processing commitments require. We do not use it for our own purposes, do not expose it to other customers, do not sell it and do not use it to train artificial intelligence models.
If you are an employee or a customer of such a company and have a request about your own data, you should address it to the company that entered your data. If you contact us directly we will forward your request to that controller and provide reasonable assistance, but we cannot act on our customer's data on our own initiative.
3.Categories of personal data we process
The table below shows where each category comes from and in which capacity we process it. Rows marked “processor” are data a customer company enters under its own responsibility.
| Category | Example data | Source | Our capacity |
|---|---|---|---|
| Contact and enquiry data | Name, company name, email address, phone number, the message you write in the demo form | Directly from you, through the demo request form | Controller |
| Account and authentication data | Username, email, hashed password, session tokens, two-factor secret, last sign-in time | From the user and the workspace administrator | Processor |
| HR and employment records | Date of birth, nationality, national identification number, marital status, military service status, address, emergency contacts, start date, salary, IBAN, social security details | From the customer's HR staff | Processor |
| Customer and lead data | Contact name, title, phone, email, meeting notes, proposal and contract content | From the customer's users | Processor |
| Communication content | Internal messages, comments, feed posts, emails and attachments pulled from a mailbox you connect | From users and from the connected mailbox | Processor |
| Call data | Who called whom, when, and for how long; the audio and video streams exchanged during the call | From the application | Processor |
| Documents and files | Uploaded contracts, invoices, reports, photographs and other attachments | From users | Processor |
| Location data | The single location fix taken when clocking in or out | From the mobile app, only if you grant permission | Processor |
| Security and log data | IP address, browser and device information, request timestamps, in-app activity records (who changed what, when) | Automatically, from server and application logs | Controller / processor |
| Device and notification data | Push notification token, operating system version, app version, device model | From the mobile app | Processor |
| Billing and subscription data | Invoice details, subscription plan, payment status | From the customer contact and the payment provider | Controller |
Card numbers, expiry dates and security codes never reach our servers. They are processed directly by the payment institution; we retain only the outcome of the payment.
4.Sensitive and special category data
Because of what the HR module is for, it can hold data that needs a higher level of protection. We state below exactly which data that is and what concrete measure protects each item.
Documents that may qualify as special category data under Article 6 of the KVKK — a medical report, a criminal record certificate or similar — only enter the system when a customer uploads them. Such documents may not be processed without the data subject's explicit consent or another lawful basis, and it is the customer company, as controller, that is responsible for that basis existing.
| Sensitive data | Where it lives | Protection applied |
|---|---|---|
| National identification number | Employee record | Written to the database encrypted with AES-256; the encryption key is held outside the database, in the application server's environment configuration. Shown only to users with the HR permission, and only on the relevant screen. |
| Bank account number (IBAN) | Employee record, payroll | Written to the database encrypted with AES-256. Excluded from bulk employee listings and from exports. |
| Salary and payroll data | Employee record, salary history, employee ledger | Gated behind a separate permission; for a user without it the field is not returned at all rather than merely hidden in the interface. |
| Medical reports, criminal record certificates, diplomas, signed contracts | Document store | Files are kept in a directory the web server cannot serve directly; every download is answered by the application only after the requester's session and permission are verified. There is no guessable link that grants access. |
| Mailbox passwords and OAuth tokens | Mail module account record | Stored encrypted, never read back in any interface or API response, and decrypted server-side only while a connection is being opened. |
| User passwords | User record | Never stored in plain text. Kept as a one-way salted hash (bcrypt), so nobody — including us — can recover your password. |
| Location records | Clock-in / clock-out records | Taken only at the moment of clocking in or out and only while the app is in the foreground. No continuous or background location tracking takes place; the capability is disabled at the operating-system level as well. |
For special category data we follow the adequate measures set by the Turkish Personal Data Protection Board: access is granted through a separate permission, access is logged, transfers happen over encrypted channels, and staff with access are bound by confidentiality undertakings.
5.Technical and organisational security measures
We take technical and organisational measures proportionate to the nature of the data, to prevent unlawful processing of and unlawful access to personal data and to keep it safe. The principal measures are below.
- Encryption in transit: all traffic between the website, the web application, the mobile app and the API travels over TLS (HTTPS), without exception. Plain HTTP requests are redirected to the encrypted address and certificates renew automatically. Realtime messaging and notification connections use encrypted sockets too.
- Encryption at rest: high-risk fields such as national identification numbers, IBANs, mailbox passwords and access tokens are written to the database encrypted with AES-256. Database backups are kept in a restricted directory and transferred encrypted when they leave the server.
- Password security: passwords are stored as one-way hashes and cannot be reversed. Sign-in and verification endpoints are rate limited, so repeated failed attempts are blocked. Optional two-factor authentication (TOTP) is supported and can be made mandatory in enterprise deployments.
- Authorisation and access control: the system is role and permission based. Every module and every sensitive field has its own permission, and a user sees only what their permissions cover. Permissions are enforced on the server, not merely hidden in the interface.
- Tenant and branch isolation: each customer's data belongs to its own workspace and queries are filtered at the tenant boundary. In multi-branch deployments the branch is a data boundary as well; reaching another branch's records requires a permission granted specifically for that.
- Mobile device security: the session token is stored in the operating system's secure keystore (iOS Keychain / Android Keystore), marked readable only after first unlock and only on that device, and excluded from device backups. Screenshots and screen recording are blocked at the operating-system level throughout the app.
- File access: uploaded documents are never kept in a publicly served directory. Every file request is answered only after the requester's session and permission for that document are verified.
- Activity logging: record creation, modification and deletion are written to an activity log together with the user and the timestamp. These records are what make it possible to establish who accessed what during an investigation.
- Network security: the application server, the database and the search server run on an internal network that is closed to the outside and reachable only through a reverse proxy. Traffic passes behind a content delivery network with attack and abuse filtering.
- Backups and continuity: the database and uploaded files are backed up automatically every night, backups are rotated, and restores are exercised. Services are monitored every minute and a fault that does not clear itself alerts the operators.
- Change management: every change reaching production goes through version control, and a release is rolled back automatically if its tests or post-deploy health check fail.
- Organisational measures: the number of staff with access to data is limited by job description and all of them are under confidentiality obligations. Access is revoked immediately on a change of role or departure. Written data processing commitments are in place with third-party providers.
No system can promise absolute security. If you believe you have found a vulnerability, please report it to guvenlik@pellacrm.com. We do not pursue legal action against good-faith reports and we triage them the same business day.
6.Mobile app permissions and on-device data
The mobile app asks only for the permissions the feature you are using needs. Permissions are requested the first time you use the relevant feature rather than all at once on first launch, and none of them is required to use the rest of the app.
| Permission | What it is used for | If you decline |
|---|---|---|
| Camera | Video calls, and taking photographs for posts and documents | Only video calling and taking photos stop working; the rest of the app is unaffected |
| Microphone | Voice and video calls | You cannot start a call, or you join muted |
| Photos / media | Attaching files to posts, messages and documents | You cannot attach from the gallery; taking a photo is a separate permission |
| Location (while the app is open) | Confirming that a clock-in or clock-out happened at the designated location | Location-verified attendance cannot be used. No location is collected in the background |
| Notifications | Delivering task, message, call and approval notifications | You receive no notifications and see the content when you open the app |
| Bluetooth connection | Routing call audio to a headset or car kit | Audio plays through the device's own speaker |
The app does not access your contacts, call history, SMS messages or other apps on your device. It collects no advertising identifier and contains no advertising, tracking or profiling software.
7.Purposes and legal bases
We process personal data only for the purposes below and on the legal bases shown against them. Processing stops once the purpose falls away.
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to a demo request and preparing an offer | Contact and enquiry data | Necessary for entering into a contract (KVKK art. 5/2-c) and legitimate interest (art. 5/2-f) |
| Providing the Service, managing accounts, giving support | Account data, activity logs | Performance of a contract (art. 5/2-c) |
| Running the modules on the customer's instructions | HR, customer, document and communication data | As a processor, on the legal basis determined by the customer |
| Invoicing, collection and accounting | Billing and subscription data | Legal obligation (art. 5/2-ç) and performance of a contract (art. 5/2-c) |
| Keeping the Service secure and detecting abuse | Security and log data | Legitimate interest (art. 5/2-f) and legal obligation (art. 5/2-ç) |
| Sending notifications | Device and notification data | Performance of a contract (art. 5/2-c); explicit consent for marketing notifications |
| Improving the product and fixing defects | Aggregated usage and error logs | Legitimate interest (art. 5/2-f) |
| Sending commercial electronic messages | Contact data | Explicit consent (art. 5/1) and consent under Law No. 6563 |
8.Sharing and service providers
We do not sell, rent or expose personal data to third parties for advertising, and we do not use it to train artificial intelligence models. We share data only with the categories of provider below, and only as far as delivering the Service requires.
| Provider category | Data they can reach | Purpose |
|---|---|---|
| Hosting and infrastructure provider | All data in the system, to the extent it is stored on the server | Hosting the server, database and file storage |
| Content delivery and network security provider | IP address and request headers | Encrypted transport, attack and abuse filtering |
| Email delivery provider | Recipient address and message content | Delivering notification, verification and information emails |
| Mobile push notification providers | Device push token, notification title and short body | Delivering notifications to the device |
| Voice and video calling infrastructure | The audio/video streams of a call and participant identifiers | Carrying the call |
| Mail integration providers | Messages in the mailbox you connect and its access credentials (an app password, a mailbox password or an authorisation token) | Running the mail module (only if you connect a mailbox) |
| Payment and billing provider | Invoice details and payment status | Collecting subscription fees |
| Legal and financial advisers, competent public authorities | Data limited to the subject of the request | Meeting legal obligations |
Each provider is bound by commitments to process data only on our instructions and only for the purpose of delivering the Service. You can request the current list of providers by writing to kvkk@pellacrm.com. This policy is updated whenever a provider changes.
9.Gmail connections and Google user data
If you connect a Gmail account to the mail module, the connection is made to Google's own IMAP and SMTP servers using an app password you generate in your Google Account. We never ask for, see or store your Google account password; an app password reaches the mailbox only, and you can revoke it at any time from the “App passwords” screen in your Google Account.
This connection uses no Google API. The “Connect with Google” (OAuth) flow for Gmail has been switched off, so no access to your contacts, calendar, Drive files or any other Google service is requested or granted. All the application can see is the messages, attachments and folders in the mailbox you connected.
Connections previously established with “Connect with Google” are being retired. For as long as we still hold a valid Google authorisation token, Pella CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you disconnect, that token is invalidated by sending a revocation request to Google and is deleted from our records.
| Connection method | Data accessed | Its limits |
|---|---|---|
| Gmail — app password (IMAP/SMTP) | Messages, attachments and folder information in the mailbox you connect; read and starred state; sending messages on your behalf. | Used only to run the mailbox screens inside the application. No Google API is used and no other Google service is reached. |
| Microsoft 365 / Outlook — OAuth 2.0 | Messages, attachments and folder information in the mailbox you connect; sending messages. | Only mailbox permissions (IMAP access and SMTP send) are requested; no other service in your Microsoft account is reached. |
| Other mailboxes — IMAP/SMTP | The server details and mailbox password you enter (stored encrypted), messages, attachments and folder information. | Only the mail server you specify is contacted, and only for your own mailbox. |
Whichever method you connect with, the protections and deletion rules that apply to your mail data are the same; they are listed one by one in the next section.
10.How connected mailbox data is protected, retained and deleted
Data obtained from the mailbox you connect — its access credentials (an app password, a mailbox password or an authorisation token), synchronised messages, attachments and folder information — is stored on our servers located in Germany. The protections that apply to it, over and above our general security measures, are listed one by one below.
- Encryption in transit: all traffic between us and the mail server, and all traffic between you and our servers, is encrypted with TLS 1.2 or above. Unencrypted connections are not accepted; the IMAP connection uses SSL and the SMTP connection uses SSL or STARTTLS.
- Encryption at rest: app passwords and mailbox passwords, along with any authorisation and refresh tokens, are written to the database encrypted with AES-256. The encryption key is held outside the database, in the application server's environment configuration. None of them is ever read back in any interface or API response; they are decrypted server-side only while a connection is being opened.
- Access limits: a connected mailbox and its contents are visible only to the user who connected it. Unless the mailbox is deliberately shared, not even other users at the same company can reach it, and every query is additionally filtered at the tenant boundary, so one customer's data is never visible to another under any circumstances.
- Attachment protection: mail attachments are kept in a directory the web server cannot serve directly. Every download request is answered by the application only after the requester's session and permission have been verified; there is no guessable or shareable file link.
- Human access: our staff do not read your mail. Access is possible only during a support investigation you have expressly asked for, a security investigation, or where the law requires it; such access is logged, and the number of staff who could perform it is limited by job description.
- Use limits: data obtained from your mailbox is not used for advertising, is not transferred to advertising networks, is not sold, and is not used to develop or train artificial intelligence or machine learning models.
- Deletion when you disconnect: the stored access credentials (app password or mailbox password) and the mailbox record are permanently deleted from the database, and where the account was connected with OAuth the authorisation token is additionally invalidated by sending a revocation request to the provider; every synchronised message and attachment is deleted, the attachment files are removed from disk, and the messages' entries are dropped from the search index. This starts the moment you disconnect and completes in the background.
- Deletion when an account or workspace closes: when your user account or your company's workspace is closed, connected mailboxes are deleted the same way. You do not need to make a separate request.
- Backups: deleted data leaves the live system at the moment of deletion; it may remain in the nightly backups until the backup cycle completes (at most 14 days), and it falls out of the backups when that cycle completes. Backups are kept in a restricted directory and are encrypted when they leave the server.
You can remove the connection at any time from the mail settings inside the application. For Gmail you can also delete the app password you issued, from the “App passwords” screen in your Google Account (or, if the account was connected with OAuth earlier, revoke access from “Third-party apps & services”), and for any other mailbox you can change the password on the mail server itself; synchronisation then stops and the stored content is deleted under the rules above. For questions about your mail data, write to kvkk@pellacrm.com.
11.International transfers
Our production servers and database are located in Germany. Where the controller is established in Türkiye, data held in the system is therefore transferred abroad.
In addition, some services — notification delivery, voice and video calling, mail integration and payments — run through providers established abroad. Those transfers are made under Article 9 of the KVKK, where an adequacy decision, standard contractual clauses, a written undertaking or another appropriate safeguard is in place, or under the exceptions the article provides.
If you are subject to legislation or an internal policy that requires data to remain within Türkiye, please contact us so the deployment can be configured accordingly.
12.Retention periods
We keep personal data for as long as the purpose it was collected for requires, and for the minimum periods the applicable legislation prescribes. Once the period expires, data is deleted, destroyed or anonymised.
| Data | Retention |
|---|---|
| Demo request records | 2 years after the request is concluded |
| Content in a customer workspace | For the term of the subscription; 30 days after it ends so you can export, then permanently deleted |
| Contracts, invoices and accounting records | 10 years, as legislation requires |
| Server access logs | 12 months at most |
| In-app activity logs | For the term of the subscription and 1 year after |
| Backups | Rotated, 14 days at most |
| Push notification tokens | Until you sign out on the device or the token expires |
| Commercial electronic message consent records | 3 years after consent is withdrawn |
When data is deleted, backups containing it may persist until the backup cycle completes; during that window the backups are accessible only for disaster recovery.
13.Deleting your account and your data
You can ask us to delete your account and your data at any time. How the request is handled depends on the kind of account you have.
- If your user account was created for you by a company: the account belongs to your employer, so you should send your deletion request to your employer's workspace administrator first. The administrator can deactivate or delete your account from inside the application. If you write to us directly at kvkk@pellacrm.com we will forward the request to your employer.
- If you own the workspace or are the customer contact: write to kvkk@pellacrm.com from the email address associated with your account and ask for your workspace and everything in it to be deleted. After we verify your identity we complete the deletion within 30 days at the latest, and we give you a reasonable window to export your data first.
- If you only submitted a demo request: writing to kvkk@pellacrm.com is enough and your record is deleted immediately.
Once a deletion is carried out, records that legislation requires us to keep (invoices and accounting documents, for example) continue to be stored for the statutory period, for that purpose only and with restricted access. Deleted data leaves the backups as the backup cycle completes.
14.Your rights and how to use them
Under Article 11 of the KVKK and the corresponding provisions of the GDPR you have the following rights.
- To learn whether your personal data is being processed and, if so, to request information about it.
- To learn the purpose of the processing and whether the data is used in line with that purpose.
- To know the third parties, in Türkiye or abroad, that your data is transferred to.
- To request that incomplete or inaccurate data be corrected, and that the correction be notified to the third parties it was transferred to.
- To request erasure or destruction of your data once the conditions for processing it have disappeared.
- To receive your data in a structured, machine-readable format, or have it transmitted to another controller you designate (data portability).
- To object to a result to your detriment arising from analysis carried out solely by automated systems.
- To claim compensation for damage suffered as a result of unlawful processing.
- To withdraw consent at any time where processing relies on it. Withdrawal does not affect the lawfulness of processing carried out before it.
You can send your request to kvkk@pellacrm.com, or in writing. Requests are answered free of charge within 30 days at the latest; where the response entails a separate cost, the fee set by the Personal Data Protection Board may be charged. If your request is refused you retain the right to complain to the Turkish Personal Data Protection Board, or to your local supervisory authority where the GDPR applies.
15.Cookies and similar technologies
Our marketing website uses only the cookies strictly necessary for it to work; there are no advertising, profiling or cross-site tracking cookies. The application uses strictly necessary cookies and browser local storage to keep your session and your interface preferences.
Which cookie does what, how long it is kept and how to turn it off is set out in a separate document as a table: the Cookie Policy.
The mobile app uses no cookies; session information is held in the device's secure keystore.
16.Children's data
Pella CRM is business software and is not directed at anyone under 18. We do not knowingly collect data from people under 18.
If we learn that we hold data about someone under 18 without the necessary legal basis, we delete it without delay. Please tell us at kvkk@pellacrm.com if you become aware of such a case.
17.Automated decision-making and profiling
The Service makes no fully automated decisions about people that produce legal effects or similarly significantly affect them.
The reminders, daily checklists and advisory alerts in the application are assistive tools that run on rules the user defines; the decision is always the user's.
18.What we do in the event of a data breach
If we establish that personal data has been unlawfully obtained by others, we investigate without delay and take the technical measures needed to limit the effects.
For data we process as a controller, we notify the Turkish Personal Data Protection Board as soon as possible and in any case within 72 hours, and we notify the affected people as soon as possible.
For customer data we process as a processor, we notify the customer without delay and provide the information and support they need to meet their own notification obligations.
19.Changes to this policy
We may update this policy as legislation or our Service changes. The current version is always published on this page and the last-updated date appears at the top.
Where a change is material, we inform our customers by email or an in-app notice a reasonable time before it takes effect.
20.Contact
For any question or request about this policy, the processing of your data or the exercise of your rights, use the details below.
- Legal name: Pella CRM
- General enquiries: info@pellacrm.com
- Data protection requests: kvkk@pellacrm.com
- Security reports: guvenlik@pellacrm.com
Questions about this document: info@pellacrm.com
Other legal documents: Terms of Service · KVKK Information Notice · Cookie Policy