Privacy policy
Last updated: [date of approval]
1. Who we are
Kolekt is operated by [Legal name of the company, e.g. "… B.V."], registered with the Dutch Chamber of Commerce under number [Chamber of Commerce (KvK) number], located at [Registered address], the Netherlands ("Kolekt", "we", "us"). We are the controller of the personal data described in this policy.
For any question about your personal data, or to use one of your rights, write to info@kolekt.com.
2. Which services this policy covers
| Service | Address | What it does |
|---|---|---|
| Kolekt website | kolekt.com | Information about Kolekt and contact, sign-up and demo request forms. |
| Kolekt Certificates | certificates.kolekt.com | A marketplace where companies buy verified waste recovery certificates from waste operators, who document their work with proof documents. |
| Waste Footprint Calculator | footprint.kolekt.com | Calculates the waste footprint of a person or an organisation and lets you reserve certificates to close it. |
| Kolekt Simulator | sim.kolekt.com | Models extended producer responsibility (EPR) and waste management costs per country. |
The Kolekt mobile app, Kolekt Pay and admin.kolekt.com have their own privacy notice and are [not / also] covered by this policy.
3. What we collect and why
3.1 In every service
| Data | Why we use it | Legal basis |
|---|---|---|
| Your account: name, email address, organisation, country and a password, which we only store as a one-way hash. | To create your account, let you log in and contact you about it. | Contract |
| Codes and links we send to confirm your email address or reset your password. | To check that the address is yours. | Contract |
| Technical data: IP address, browser type and the time of a request. | To keep the service running and secure, and to block abuse such as repeated login attempts. | Legitimate interest |
| Messages you send us. | To answer you. | Legitimate interest |
We do not sell your data, and we do not use it for advertising.
3.2 Kolekt Certificates
| Data | Why we use it | Legal basis |
|---|---|---|
| Buyers. Orders, amounts, reservations and the certificates issued to you. Card and bank details are entered on Stripe's payment page and never reach us; we keep Stripe's reference to the payment. | To take your order, receive payment and issue your certificate. | Contract; legal obligation (bookkeeping) |
| The name of your organisation on each certificate you buy. | A certificate is a public claim: anyone with its number or QR code can open it and check who it was issued to. | Contract |
| Your public buyer page: logo, website and description, and the certificates you choose to publish there. | To show your recovery results publicly. Nothing is published until you switch it on, per certificate, and you can switch it off at any time. | Consent |
| That you previewed an order: the moment, the material and tonnes, and your organisation and country. | Shown to the operators whose tonnes the preview included, so they can see demand for their material. They do not see your name or email address. | Legitimate interest |
| A request to see an operator's proof document: your name, email address and organisation. | Shown to that operator, who decides whether to grant access. | Contract |
| Operators. Company details, a contact person's name, title, email address and phone number, registration, tax and VAT numbers, registered address, bank details, identity and company documents (KYC), site locations, photos and logo. | To verify who you are before you can sell, to pay you, and to present your company to buyers. Your company page, photos, logo and the sites you place on the map (their name, type and position) are public once you are approved; contact and bank details are never public. | Contract; legal obligation; legitimate interest (preventing fraud) |
| Proof documents (invoices, weight tickets and similar). They can contain names and details of people at your suppliers and customers. | To verify the tonnes behind every certificate. Buyers and the public only ever see a copy in which prices, bank details and personal names are covered. | Contract; legitimate interest (a certificate must be verifiable) |
| People at the suppliers and customers of our operators. The name, job title, email address, phone number and address of a contact person, as printed on the proof documents operators upload. We get them from those documents, not from you. | To record who an operator trades with, to check what the operator entered against the document, and to invite that company to Kolekt Certificates. If you do not want to hear from us, reply to the invitation or write to info@kolekt.com and we will not contact you again. | Legitimate interest |
| Page views of a certificate offer, counted per operator. | To show an operator how often its offer was viewed. The viewer is not identified or stored. | Legitimate interest |
| How you heard about us, which we ask when you register. | To learn which channels bring people to Kolekt. | Legitimate interest |
| Requests you made in the Waste Footprint Calculator to reserve certificates (see 3.3). | So our certificates team can follow up and, if you wish, open a buyer account for you. | Legitimate interest |
3.3 Waste Footprint Calculator
| Data | Why we use it | Legal basis |
|---|---|---|
| Your answers to the calculator (for example household size and habits, or your organisation's staff, buildings and products) and the resulting footprint. | To calculate your footprint and, with an account, save it. | Contract |
| Certificate reservations: the gaps you chose, the kilograms and the estimated price. | To pass your request to Kolekt Certificates, which is part of Kolekt (see 3.2). | Contract |
| A result you share by link. | The result, including any name you typed, is inside the link itself. Anyone you give the link to can read it. | Your choice to share |
You can delete your account and everything saved with it yourself, on your profile page.
3.4 Kolekt Simulator
| Data | Why we use it | Legal basis |
|---|---|---|
| Your organisation's website, the countries you use, your trial time and your subscriptions. Payments are handled by Paddle, which sees your payment details; we do not. | To give you access to the countries you chose and to remind you before a subscription ends. | Contract |
| The parameters you enter and your saved simulations. | To run and keep your simulations. | Contract |
| Login events, sessions and pages used, with IP address, browser and an approximate country derived from the IP address on our own server. | To secure accounts, prevent misuse of free trials and understand how the simulator is used. | Legitimate interest |
| Feedback you send from within the simulator. | To improve the simulator. | Legitimate interest |
| Usage statistics through Google Analytics. | To understand which parts of the simulator are used. Only with your permission (see the cookie policy). | Consent |
| Names, roles and public profile links of professionals active in extended producer responsibility, taken from public sources with the help of AI, in the country pages. | To show who the relevant organisations and contacts are in each country. If you are listed and want to be corrected or removed, write to us. | Legitimate interest |
3.5 Kolekt website
When you use a form on kolekt.com we receive your name, email address and message, and for a sign-up or demo request also your organisation and country. We use them to answer you (legitimate interest, or steps before a contract). The forms are protected by Google reCAPTCHA, and videos on the website are served by YouTube; see the cookie policy.
4. Automated reading of documents
In Kolekt Certificates, uploaded proof documents are read by an AI model (Google Gemini) to fill in the form for you, to compare the document with what you entered, to point out signs of editing and to find what has to be covered in the copy that buyers see. A Kolekt employee reviews documents before they count. For an operator that has passed an audit, a document that passes every check can be approved without that review; you can always ask us to have a person look at a decision.
The same reading also takes from each document the details of the supplier or customer it names - the company and its contact person, as described in section 3.2 - and the prices and quantities on it. The prices are visible only to Kolekt administrators.
5. Who receives your data
We use these service providers. They process data on our instructions only.
| Provider | For | Where |
|---|---|---|
| Microsoft Azure | Hosting, databases and file storage for Certificates, the Calculator and the Simulator. | Netherlands; backup copies of files in Ireland |
| Twilio SendGrid | Sending account and order emails. Opens and clicks are not tracked. | United States |
| Google (Gemini API) | Reading proof documents in Certificates (section 4). | [to be confirmed] |
| Google (Analytics, reCAPTCHA, Fonts) | Statistics in the Simulator (with consent), protection of forms, and the font used on the sites. | United States |
| OpenStreetMap Foundation | The map tiles on the operator pages of Certificates and the maps in the Simulator. Your browser loads them directly, so the Foundation receives your IP address. | United Kingdom |
| Squarespace | Hosting kolekt.com and its forms. | United States |
Stripe (Certificates) and Paddle (Simulator) handle payments and are responsible for the payment data you give them under their own privacy policies. Paddle sells the Simulator subscription to you as reseller.
Independent audit firms that audit an operator for Kolekt Certificates see that operator's company details and its proof documents as uploaded.
Other users see what is described in section 3: for example, the public sees issued certificates and approved operator pages, and operators see the organisation and country behind an order preview. We share data with authorities only when the law requires it.
6. Transfers outside the EEA
Some providers above are based in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
7. How long we keep it
Periods marked [proposed] still have to be confirmed.
| Data | Kept for |
|---|---|
| Accounts | As long as your account exists. When you delete it, or ask us to, it is removed within 30 days, except for what is listed below. |
| Orders, payments and invoices | 7 years, as Dutch tax law requires. |
| Issued certificates, and the proof documents and operator details behind them | As long as the certificate can be checked, and at least 7 years [proposed]. A certificate is a public claim and must stay verifiable. |
| Operator identity and company documents (KYC) | While you are an operator, and 5 years after [proposed]. |
| Security and usage logs | 12 months [proposed]. |
| Simulator: email address and trial use after you close your account | Kept to prevent a free trial from being used twice [proposed: 2 years]. |
| Messages to us | 2 years after the conversation ends [proposed]. |
8. Your rights
You have the right to:
- see the personal data we hold about you and get a copy of it;
- have it corrected, or deleted when we no longer need it;
- have its use restricted, or receive it in a format you can take elsewhere;
- object to what we do on the basis of legitimate interest;
- withdraw a consent at any time, without affecting what happened before.
Write to info@kolekt.com. We answer within one month. If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
9. Security
Connections are encrypted, passwords are stored only as one-way hashes, files are kept in private storage that is not publicly reachable, and proof documents shown to buyers are rebuilt from images, so covered details cannot be recovered from them.
10. Children
Our services are not meant for anyone under 16, and we do not knowingly collect their data.
11. Changes to this policy
When we change this policy we update the date at the top. If a change affects you materially, we tell you by email or in the service before it takes effect.