COTSystem privacy policy

Each organization that uses COTSystem decides what it records about its own customers, leads and contacts, and is the controller of that data; CoThrusters processes it on the organization’s behalf and only on its instructions. CoThrusters is the controller of the account data of the people who sign in to COTSystem and of the data on these public pages.

• Account data: name, email address, phone number, language, time zone, role and sign-in and security records of the people who use COTSystem.
• Business data an organization enters or imports: contacts, clients, leads, opportunities, quotations, contracts, tasks, notes, files and invoices.
• Communications an organization connects: emails, WhatsApp, SMS and social media messages, calls and, only when switched on and announced, meeting and call recordings and their transcripts.
• Data from platforms an organization connects (for example Meta, Google, Microsoft or LinkedIn), described below.
• Technical data: server logs, IP address, browser and device type, kept for security and to keep the service running.

When an organization connects its Facebook page, Instagram account, ad account or WhatsApp Business account to COTSystem, we receive, on that organization’s behalf: the answers people give in its lead forms, the comments and messages sent to its page or account, the WhatsApp messages exchanged with its number, and the performance figures of its ads. We use this data only to show it to that organization inside COTSystem and to carry out what the organization asks (reply, follow up a lead, report on a campaign). We do not sell it, we do not use it for advertising or profiling of our own, and we do not share it with anyone except the service providers listed below. It is deleted when the organization disconnects the account, when the organization deletes it, or when you ask for it to be deleted (see the data deletion page).

• To provide COTSystem to the organizations that subscribe to it (performance of a contract, or the organization’s instructions for the data it controls).
• To keep accounts and data secure, prevent abuse and fix faults (legitimate interest).
• To meet legal obligations, such as invoicing and tax records (legal obligation).
• Where the law requires consent, such as recording a call or sending marketing emails, the organization asks for it and COTSystem records it (consent).

We do not sell personal data, and we do not use the data of organizations or their customers to train artificial intelligence models.

We use service providers bound by data processing agreements: hosting and file storage, sign-in, transactional email delivery, artificial intelligence and speech-to-text (only for the features an organization switches on), and the communication providers an organization connects (such as email, WhatsApp or telephony). Each receives only what it needs for its task.

When a provider processes data outside the European Economic Area, we rely on an adequacy decision or on the European Commission’s standard contractual clauses, with additional safeguards where needed.

Account data is kept while the account is active. Each organization sets how long its business data is kept, within the limits the law allows; when it is deleted or the subscription ends, the data is erased or anonymised, except what the law requires us to keep (for example invoices). Security logs are kept for a limited period.

You may ask for access to your data, its correction or deletion, to restrict or object to its processing, and for a copy in a portable format. If your data was recorded by an organization that uses COTSystem, contact that organization first: it can answer your request directly in COTSystem, and we help it. You may also complain to a data protection authority; in Portugal, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

Data is encrypted in transit and the organizations’ data is kept apart from each other. Access is limited by role and recorded in an audit log, sign-in can require a second step, and secrets such as connection keys are stored encrypted.

COTSystem uses only the cookies it needs to work: the sign-in session, the chosen organization and the language. We use no advertising or tracking cookies.

We may update this policy. The date at the top shows the latest version; important changes are announced inside COTSystem.

For any question about privacy or to exercise your rights, contact CoThrusters, the organization that runs COTSystem, or the organization that recorded your data.