Privacy policy
What personal data we handle, why, who receives it and how you can use your rights.
Effective 2026-11-07 · Version 1
Who we are
Rutba CRM is operated by Rutba. You can reach us about privacy at no-reply@rutbacrm.com.
- Country of registration: Türkiye
We play two different roles. For people who visit this site, ask for a demo or hold an account, we decide how data is used and we are the controller. For the customers of a company that uses Rutba CRM, that company is the controller and we process the data on its instructions, as set out in the data processing agreement.
What we collect
- Visitors: the pages you read, your browser and device type, and your internet address in our security logs. Analytics run only if you accept them.
- Demo and rights requests: your name, email, company and what you write to us.
- Account holders: name, email, password in hashed form, language, security settings, the companies you belong to and what you do in them.
- Billing: the package, period and amount. Card details go directly to the payment provider and never reach us.
- Data companies place in the service: contacts, messages, orders, deals, tasks, files and, for clinics, coordination notes.
Why we use it, and our basis
- To provide the service you asked for: performing our contract with you or your company.
- To keep the service secure, prevent abuse and fix faults: our legitimate interest in running a safe service.
- To answer enquiries and demo requests: your request, and your consent where it is required.
- To measure how this site is used: your consent, which you can withdraw at any time.
- To keep accounting and legal records: our legal obligations.
We do not sell personal data. We do not use the data companies place in the service for our own marketing.
Who receives it
We use the providers listed on the subprocessors page for hosting, email, messaging, payments and optional AI features. Each receives only what it needs. We may also disclose data when the law requires it.
Where it is stored
The service is hosted in Germany. Some providers work in other countries. When data leaves the country it was collected in, we rely on the safeguards the applicable law requires.
How long we keep it
We keep account data while the account is active. After a company closes its account, we delete or anonymise its data within 90 days, unless the law requires us to keep it longer. Backups are overwritten within 30 days. Financial records are kept for the period tax law requires.
Your rights
Depending on where you live, you can ask to see your data, receive a copy, correct it, delete it, restrict or object to its use, and withdraw consent. These rights are given by laws such as the Saudi Personal Data Protection Law, the Turkish Law on the Protection of Personal Data and the European General Data Protection Regulation.
Use the data rights page or write to no-reply@rutbacrm.com. We answer within 30 days, and we tell you if we need longer and why. If you are the customer of a company that uses Rutba CRM, we pass your request to that company, because it decides what happens to your data.
You can also complain to your data protection authority.
Sensitive data
Clinics may record health information about their patients in Rutba CRM. The clinic is responsible for that information and for having a lawful basis to record it. We encrypt those notes and never send them to an AI provider.
Children
The service is for businesses and is not meant for anyone under 18.
Changes
We keep every published version of this policy. We show the date a version takes effect at the top of this page, and we announce important changes on the updates page.