Terms of Service

1. Parties and Definitions

1.1. These Terms of Service ("Terms") govern the relationship between KOLEKTO TEKNOLOJİ ANONİM ŞİRKETİ (MERSİS: 0575108963000001, Tax ID: 5751089630, Urla Tax Office; address: Gülbahçe Mah. Gülbahçe Cad. Kuluçka Merkezi Binası No: 1/45 İç Kapı No: 21, Urla / İzmir, Türkiye; "Kolekto") and the Customers and Users of the Kolekto platform.

1.2. Definitions:

• Platform / Service: the multi-tenant business management, human resources and operations software that Kolekto provides through https://kolekto.com.tr and related domains, including all modules, interfaces and support services.
• Customer (Organization): the legal entity or organization that opens an account on the Platform and adds its employees as Users.
• User: a natural person (employee, administrator, invitee) authorized by the Customer to access the Platform.
• Customer Data: all data, documents and content that the Customer and its Users enter into, upload to or create through the Platform (including employee records, customer records, meetings, requests, projects, messages and documents).
• Agreement / Quote: the service agreement, order form or accepted quote signed between the Customer and Kolekto.
• Privacy Notice: the Privacy & Data Protection Notice published at https://kolekto.com.tr/en/privacy.

1.3. These Terms form an integral part of the Agreement between the Customer and Kolekto. The Customer reads and accepts the Terms by signing the Agreement or accepting the Quote that refers to them; Users do so by accepting their invitation and signing in to the Platform. The person signing or accepting the Agreement on behalf of the Customer represents that they are authorized to bind the Customer. If these Terms conflict with the Agreement, the Agreement prevails.

1.4. The Platform is provided only to organizations for their commercial or professional activities; the relationship under these Terms is not a consumer transaction within the meaning of Turkish Consumer Protection Law No. 6502.

2. Scope of the Service and Changes

2.1. Kolekto grants the Customer a non-exclusive, non-transferable right to use the Platform over the internet, limited to the subscription scope and number of users set out in the Agreement.

2.2. The Platform consists of modules such as human resources, leave, expenses, meetings, idea pool, shared space booking, customer management (CRM), projects and work management. Which modules a Customer may use is determined by the Agreement and the organization's settings.

2.3. Kolekto may add, change or remove features to improve the Platform, keep it secure or comply with legislation. Changes that materially restrict the Customer's use are announced at least 30 days in advance by in-app notification and email; in that case the Customer may end its subscription without observing the notice period in 9.1, and fees prepaid for the unused period are refunded. Urgent security fixes may be applied without prior notice.

2.4. Kolekto performs planned maintenance outside business hours where possible and announces it with reasonable notice.

3. Accounts, User Obligations and Acceptable Use

3.1. The Customer is responsible for managing its organization account, administrator privileges and User access, for its Users' compliance with these Terms, and for all activity carried out through its account.

3.2. Users keep their credentials confidential, do not share their accounts, and promptly report any suspected unauthorized access to the Customer and to Kolekto. Kolekto allows the Customer to require two-factor authentication for all of its Users.

3.3. The Customer is responsible for the accuracy of the Customer Data it enters and for having the legal basis required to process it, including informing its employees and customers and obtaining consent where necessary.

3.4. The following are prohibited:

• using the Platform for unlawful or harmful purposes or in a way that infringes third-party rights;
• attempting to access another Customer's data or tenant environment, circumventing security measures, or probing or exploiting vulnerabilities (except security testing authorized in writing);
• uploading malicious software, generating excessive load with automated tools, or disrupting the Service;
• reverse engineering, copying, sublicensing, renting or reselling the Platform or its components as a service to third parties;
• sharing content that harasses, discriminates against or insults other Users.

3.5. In case of a breach of this section, Kolekto may suspend the access of the relevant User or account; where possible it notifies the Customer in advance and restores access once the breach is remedied.

4. Subscription and Fees

4.1. The Platform is provided on a subscription basis. The subscription term, scope, number of users, fees and payment terms are set out in the Agreement or accepted Quote; these Terms do not contain prices.

4.2. Taxes required by law are added to the fees. Invoices are issued for the periods stated in the Agreement and are payable on their due date.

4.3. For overdue payments, Kolekto may suspend the Service after giving the Customer at least 15 days' written notice. Customer Data continues to be retained during suspension.

4.4. Unless the Agreement states otherwise, the subscription renews at the end of each term on the same conditions. Fee changes apply only from the next subscription term and with at least 30 days' notice.

5. Customer Data: Ownership, Export and Deletion

5.1. All rights in Customer Data belong to the Customer. Kolekto processes Customer Data only to provide and secure the Service, meet its legal obligations and carry out the Customer's instructions; it does not sell Customer Data, use it for advertising, or share it with third parties outside the scope of the Agreement.

5.2. As described in the Privacy Notice, Customer Data is kept in Türkiye, in Amazon Web Services data centers in the Istanbul region. Except for the AI features described in 6.5, it is not transferred outside Türkiye.

5.3. During the subscription and for 30 days after termination, the Customer may export Customer Data in a reasonable and common format using the Platform's export tools or by contacting Kolekto.

5.4. Upon termination or expiry, Kolekto deletes or anonymizes Customer Data at the end of the period in 5.3 (or earlier at the Customer's request); copies in backups are deleted automatically at the end of the backup retention period (14 days). Records that must be retained longer by law are kept for the statutory period.

5.5. The Customer may also delete records during the subscription using the Platform's tools; deleted records are removed from backups within the retention periods stated in the Privacy Notice.

6. Third-Party Integrations

6.1. Depending on the Customer's choice, the Platform may connect to third-party services. Use of a third-party service is subject to that service's own terms; Kolekto is not responsible for the availability of third-party services.

6.2. Microsoft 365 connection. The connection is established only with the consent of the Customer's organization administrator, given through Microsoft Entra. With this consent Kolekto:

• reads Users' names and email addresses to match employees;
• reads the organization's name;
• reads only the title, date/time, location, availability/privacy flag and Microsoft Teams link of calendar events to show them on the Platform; it does not read event descriptions or attendee content;
• creates, updates and cancels events with a Microsoft Teams link in the organizer's calendar for Kolekto online meetings created on the Platform.

6.3. Under this connection Kolekto does not access email or files (including OneDrive/SharePoint). Events marked as private are shown on the Platform only as "busy". The data read is processed solely to provide the calendar and meeting features of the Platform.

6.4. The organization administrator may disconnect at any time from the Platform settings or revoke the consent through Microsoft Entra; in either case Kolekto's access to Microsoft 365 ends. When disconnected from the Platform settings, Kolekto deletes the user matches and connection data it holds under the connection.

6.5. AI features. The AI Insights module and the meeting minutes draft run on the AI service of OpenAI, L.L.C. (USA); when these features are used, the following data is transferred outside Türkiye:

• AI Insights: only aggregate measures at organization and department level. All text values such as department, title and customer names are replaced with pseudonyms; no list of people, person names or identifiers are sent.
• Meeting minutes draft: only the written notes, agenda and open actions of the meeting concerned. Person names are replaced with pseudonyms; email addresses, phone numbers, Turkish ID numbers and IBANs are masked. Meetings marked confidential are not sent. Other information typed freely into the notes may not be masked.

6.6. Pseudonym mappings stay in Türkiye; the response is recombined with real names on Kolekto's servers. The AI Insights module can be turned off in the organization settings and the meeting minutes draft in the Meetings management settings. By keeping these features on, the Customer instructs the transfer as data controller; the parties cooperate to keep the transfer compliant with Article 9 of KVKK, and the Customer informs its Users not to type free text containing personal data (for example health information) into meeting notes.

7. Intellectual Property

7.1. The Platform, its software, design, trademarks, documentation and all related intellectual and industrial property rights belong to Kolekto. These Terms grant the Customer only a right of use limited to the subscription term; no other right is transferred.

7.2. Rights in Customer Data belong to the Customer (see 5.1). The Customer grants Kolekto the right to process Customer Data only to the extent necessary to provide the Service.

7.3. Kolekto may use suggestions and feedback the Customer provides about the Platform for product development, without identifying the Customer and without compensation.

8. Service Levels and Limitation of Liability

8.1. Kolekto uses commercially reasonable efforts to provide the Platform continuously and securely: data is transmitted over encrypted connections, tenants are isolated from one another, and regular backups are taken. Target availability and any service credits are set out in the Agreement.

8.2. Kolekto does not guarantee that the Platform will be uninterrupted or error-free. Kolekto is not responsible for outages caused by internet access, the Customer's devices and network, third-party services or force majeure.

8.3. Kolekto is not responsible for the content or accuracy of Customer Data, nor for the lawfulness of the Customer's processing of it.

8.4. To the extent permitted by law, Kolekto is not liable for loss of profit, loss of business, loss of reputation or indirect damages. Kolekto's total liability arising in any subscription year is limited to the fees paid by the Customer to Kolekto in the 12 months preceding the event giving rise to the claim.

8.5. These limitations do not apply to damages caused by willful misconduct or gross negligence, or to liability that cannot be limited by law.

8.6. During events beyond the parties' control (force majeure), such as natural disasters, epidemics, war, terrorism, strikes, general power or internet outages, cyberattacks that could not be prevented despite reasonable security measures, and decisions of public authorities, the affected party's obligations affected by the event are suspended; payment obligations are not covered. If force majeure lasts longer than 30 days, either party may terminate the Agreement by written notice, in which case fees prepaid for the unused period are refunded.

9. Termination

9.1. The Customer may end its subscription by observing the notice period stated in the Agreement. If no period is stated, at least 30 days' written notice suffices.

9.2. Either party may terminate the Agreement immediately if the other party materially breaches these Terms or the Agreement and fails to remedy the breach within 15 days of written notice.

9.3. If Kolekto discontinues the Platform or a module entirely, it gives at least 90 days' notice, allows the Customer to export its data during that period, and refunds fees prepaid for the unused period of the discontinued service.

9.4. Upon termination, access for the Customer and its Users is closed; Customer Data is exported and deleted in accordance with Section 5. Fees accrued up to the termination date remain payable.

10. Privacy and Data Protection (KVKK)

10.1. The processing of personal data is explained in the Privacy & Data Protection Notice (https://kolekto.com.tr/en/privacy), which forms an integral part of these Terms.

10.2. Under Law No. 6698 on the Protection of Personal Data ("KVKK"): for website visitors, contact-form submissions and account holders, the data controller is Kolekto. For employee, customer and business data that the Customer enters into the Platform, the data controller is the Customer; Kolekto processes this data as a data processor, on the Customer's instructions and under the Agreement.

10.3. As data controller, the Customer is responsible for informing its Users and data subjects, establishing the required legal bases, and responding to data subject requests. Kolekto assists the Customer in meeting these obligations through the Platform's tools and reasonable support, and forwards User requests to the Customer.

10.4. Except for the AI features in 6.5, Kolekto does not transfer Customer Data abroad; it does not share Customer Data with third parties and discloses it only upon a duly made request from a legally authorized public authority, in which case it informs the Customer to the extent permitted by law.

10.5. If Kolekto becomes aware of a security breach affecting Customer Data, it informs the Customer without undue delay and within 48 hours at the latest, with the information then known about the nature of the breach, the categories of data affected and the measures taken. Kolekto supports the Customer in the notifications it must make under KVKK and the decisions of the Personal Data Protection Board (including notification to the Board within 72 hours).

10.6. Kolekto binds its employees who access Customer Data to confidentiality, takes the technical and organizational measures required by Article 12 of KVKK, and answers the Customer's reasonable requests for information about these measures. Kolekto uses Amazon Web Services data centers in the Istanbul region for hosting and the OpenAI service in 6.5 for AI features; it informs the Customer at least 30 days before it starts using a new infrastructure or service provider that will process Customer Data. If the Customer objects, it may end its subscription without observing the notice period in 9.1, and fees prepaid for the unused period are refunded.

11. Changes to the Terms and Notices

11.1. Kolekto may update these Terms. The current version is published at https://kolekto.com.tr/en/terms, with the effective date shown at the top.

11.2. Changes that materially affect the Customer's rights are announced to the organization administrator by email and in-app notification at least 30 days before they take effect. Unless the Customer expressly accepts them, these changes do not apply during the current subscription term and take effect from the start of the next subscription term. Changes required by law, court or administrative decision apply from their effective date; if the Customer does not accept them, it may end its subscription without observing the notice period in 9.1, and fees prepaid for the unused period are refunded. Changes that do not narrow the Customer's rights take effect on publication.

11.3. Notices to Kolekto are sent to info@kolekto.com.tr or to the postal address in 1.1; notices to the Customer are sent to the organization administrator's registered email address or by in-app notification. Notices within the scope of Article 18(3) of Turkish Commercial Code No. 6102, such as notices of default, termination or rescission, are given through a notary public, registered mail with return receipt, or registered electronic mail (KEP).

12. Governing Law and Jurisdiction

12.1. These Terms are governed by the laws of the Republic of Türkiye.

12.2. To the extent permitted by law, the Courts and Enforcement Offices of İzmir (Central) have jurisdiction over disputes arising from these Terms.

12.3. In disputes, Kolekto's system and transaction records constitute evidence under Article 193 of Code of Civil Procedure No. 6100; the Customer's right to submit counter-evidence is reserved.

12.4. If any provision of these Terms is held invalid, the remaining provisions remain in effect. Kolekto's failure to exercise a right does not constitute a waiver of that right.

13. Contact

KOLEKTO TEKNOLOJİ ANONİM ŞİRKETİ

Gülbahçe Mah. Gülbahçe Cad. Kuluçka Merkezi Binası No: 1/45 İç Kapı No: 21, Urla / İzmir, Türkiye

Tax Office / ID: Urla / 5751089630 · MERSİS: 0575108963000001

Email: info@kolekto.com.tr · Web: https://kolekto.com.tr