Terms of Use and Service Agreement

Effective date: no earlier than 4 October 2026, version 3.16 (published: 10 October 2026; by explicit-approval procedure, see the version note at the end of this page for detail).

1. Parties and Scope

This Terms of Use and Service Agreement (the "Agreement") is entered into between Codeck Yazılım Anonim Şirketi ("İmzala.org", "the Company", "we") and the natural or legal person who uses the İmzala.org platform ("User", "you").

This Agreement governs the terms of use of the digital signature, contract management, Work Certification (Eser Tasdik), and related services offered by İmzala.org. By using the platform, you are deemed to accept these terms. Article 11 applies to later versions: changes that are materially adverse to you are not applied to you without your explicit approval.

2. Description of the Service

İmzala.org offers the following services:

• Signing and approving documents with a digital signature
• Creating and managing document templates
• Bulk signature dispatch
• Sequential signing workflows
• As part of the signing and Work Certification services, use of a timestamp (RFC 3161) produced by timestamp service providers (for example, TÜBİTAK KamuSM); İmzala.org does not sell timestamps (see §19)
• Document archiving and long-term retention
• API integration services (REST API)
• Webhook notification system
• Identity verification services (e-mail, SMS, OTP)
• Work Certification (Eser Tasdik): a record showing that a file existed at a given time and has not since changed; on its own it does not prove authorship and is not a registration)

3. Account Creation and Security

3.1 Creating an Account

• You must be over 18 years of age to create an account
• You must provide accurate, current, and complete information
• If you open an account on behalf of a legal entity, you must be authorised to do so
• Each natural person may create only one individual account (corporate accounts are different)

3.2 Account Security

• You are responsible for the confidentiality of your password
• You are responsible for all activity that occurs on your account
• You must report unauthorised use immediately: [email protected]
• We recommend enabling two-factor authentication (2FA)
• Your passwords are stored as bcrypt hashes; even we cannot access your password in plain text

3.3 Organisation (Corporate) Accounts

On the platform you may create an organisation (a corporate workspace) or join one as a member. With respect to organisation accounts:

• A user who creates an organisation on behalf of a legal entity, or manages an organisation, represents and warrants that they are authorised to represent that legal entity; that user is liable for the consequences of unauthorised representation.
• Organisation administrators (owner / admin roles) are responsible for informing organisation members of this Agreement and the related policies and for ensuring that members act in accordance with these terms.
• Contracts, templates, and data created in an organisation workspace are processed on behalf of the organisation; the scope of members' access to this data is determined by the organisation's administration according to internal roles and permissions.
• Where third-party personal data is processed in the organisation workspace, the allocation of roles in sections 5.3 and 5.4 (data controller: the organisation; data processor: İmzala.org) applies.
• Purchases and subscription transactions on behalf of the organisation are available only to authorised organisation roles (owner / admin).

3.4 Session Duration and "Remember This Computer"

In the İmzala Masaüstü application, you may choose how long your session stays open and whether the second verification step (for example, an SMS code) is asked again on the same computer. With respect to these preferences:

• Session duration choice. You may choose 7, 30, 90, or 365 days from the application's settings; the default is 30 days. This period is a rolling window: your session is renewed and the period restarts each time you use the application. Extending the period requires re-verifying your identity with a second step; shortening it does not require additional verification. In addition, there is a non-extendable absolute upper limit of 365 days from the date the session was first created, after which it definitively ends, regardless of how often the session is renewed.
• "Remember this computer". This option is off by default and is activated only if you select it. When selected, the second verification step (for example, an SMS code) is skipped on subsequent logins on the same computer; your password is always required. This option is not a declaration of explicit consent; it is a usage preference relating to your account.
• User responsibility. We recommend using these preferences only on computers whose access you control; on shared computers you are expected not to select "remember this computer". Your device being protected with an operating-system-level screen lock is part of the safe use of this preference. If your computer is lost or falls into someone else's hands, you must cancel the relevant session and remembered computer from your account panel and change your password.
• Corporate workspaces. Even if you are a member of an organisation, this preference applies only to your own account; it does not affect the sessions of other members of the organisation. It is the organisation administrators' own responsibility to inform their members about this preference under their internal security policies.
• İmzala.org's right of cancellation. To protect the security of your account, for example when we detect that a session key has been reused, we may unilaterally terminate the relevant sessions and remembered-computer records. This authority is used only for security purposes and is limited to the scope granted in this article; your access to the service is not otherwise restricted under this scope, and you can continue using it by logging in again. The suspension or termination of access for breach of contract, security risk, or similar reasons is subject to the separate authority in articles 4 and 10.2 and is outside the scope of this provision.
• Reserved provisions. The preferences in this article do not remove or limit İmzala.org's obligations regarding data subject rights and data security under articles 11 and 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK). The provisions of Turkish Code of Obligations art. 115; the provisions on general terms and conditions under Turkish Code of Obligations art. 20-25 (in particular the "deemed unwritten" rule of art. 21/2 and the interpretation rule of art. 25); and Law No. 6502 on the Protection of Consumers art. 5 and other mandatory provisions in favour of consumers are reserved.

4. Rules of Use

4.1 Acceptable Use

You may use the platform only for lawful purposes and in accordance with this Agreement.

4.2 Prohibited Uses

The following conduct is strictly prohibited:

• Unlawful or fraudulent use
• Sharing false or misleading information/documents
• Uploading content that infringes the rights of others
• Uploading viruses, trojans, or malicious code (uploads may be subject to malware scanning)
• Automated queries that overload the system
• Attempting to bypass security measures
• Unauthorised access to other users' information
• Sending spam or unsolicited content
• Conduct that disrupts the operation of the service
• Exceeding or abusing API rate limits
• Reverse-engineering the platform software; attempting to access, derive, or decompile/disassemble the source code in whole or in part
• Copying, reproducing, renting, sublicensing the platform software, or making it available to third parties

The mandatory exceptions provided for computer programs under article 38 of Law No. 5846 on Intellectual and Artistic Works (including decompilation to the extent strictly necessary for interoperability) are reserved.

4.3 Content Responsibility and Notice-Based Access Restriction

The provider of the documents and content uploaded to the platform is the user who uploaded them. Under Law No. 5651, İmzala.org is not obliged to pre-screen content uploaded by users or to investigate whether it is unlawful.

• Notice channel: if you believe that content on the platform is unlawful or infringes your rights, you may notify us at [email protected] (or [email protected]), stating your claim of infringement and the content concerned.
• Assessment and access restriction: upon a proper notice or a decision of a competent authority, access to content assessed as unlawful may be restricted and/or the relevant account may be suspended.
• Statutory retention and evidentiary integrity are reserved: access restriction does not remove the statutory retention obligations for signed documents (Turkish Commercial Code art. 82) or the other parties' access to the copies that constitute evidence; the content is preserved with its integrity intact for the statutory retention period.

5. Intellectual Property Rights

5.1 Platform Ownership

The İmzala.org platform, its logo, design, software, and content are the property of Codeck Yazılım Anonim Şirketi and are protected by intellectual property laws.

5.2 User Content

• You retain ownership of the documents you upload
• We use your content only to provide the service
• You warrant that your content is lawful
• You represent that you hold all rights necessary

5.3 Third-Party Personal Data and Data Controller Responsibility

Where the User processes the personal data of third parties (contract parties, signers, etc.) through the Platform:

• The User holds the status of "Data Controller" under Law No. 6698 (KVKK) with respect to that personal data.
• The User represents and warrants that it has obtained the necessary explicit consent and/or legal basis from the data subjects, and that it satisfies at least one of the processing conditions in KVKK articles 5 and 6.
• The User accepts that it has duly informed the data subjects in accordance with KVKK article 10.
• The User is solely responsible for the accuracy, currency, and lawfulness of the third-party data entered into the Platform.
• The User accepts and undertakes to hold İmzala.org harmless from any administrative fine, compensation, and expense arising from a breach of these obligations.

İmzala.org, acting as the User's Data Processor, processes this data only for the performance of the service and in accordance with the User's instructions.

5.4 Data Processing Agreement

Where the User processes third-party data through the Platform, this Terms of Use also constitutes a Data Processing Agreement (DPA) under KVKK article 12(2) and GDPR article 28. In this scope, İmzala.org:

• Processes the data only for the purposes documented by the User.
• Takes adequate technical and administrative security measures.
• Informs the User of its sub-processors (infrastructure providers).
• Deletes or returns the data according to the User's instructions when the service ends.
• Informs the User within 48 hours in the event of a data breach.

A separately signed DPA and BAA (Business Associate Agreement, for HIPAA customers) template is available on request for corporate customers: [email protected]

5.5 Licence

We grant you a limited, revocable, non-transferable, non-exclusive licence to use the platform within the scope of this Agreement.

5.6 Persons to be Informed (CC) and User Responsibility

When sending a contract, you may add the e-mail addresses of third parties who will not sign but should be kept informed of the process ("Persons to be Informed" / CC). These persons receive an informational e-mail only at the dispatch and completion stages of the contract. If you use this feature:

• You represent and warrant that you are authorised to add these third-party e-mail addresses and to share the contract's status (including, if enabled, the signed PDF copy) with these persons.
• İmzala.org performs the informational delivery in this scope only as a data processor; the authority to determine who is added and what content is shared rests solely with you.
• Adding a third-party e-mail address, or sharing contract information, without authorisation or unlawfully is the user's responsibility; you accept that you will hold İmzala.org harmless from any claim, administrative fine, compensation, and expense arising from a breach of this obligation.

5.8 Assigning a Signing Party by Name-Matching from the Document

In bulk dispatch with a Field Template, a helper tool is offered that, using the list of people you have defined for a role in the template, determines the recipient for that role based on the printed name found in the document you upload. If you use this tool:

• The matching consists solely of a literal search, in the document text, for the names in the list of people you defined; it is not an identity or authority verification and does not change the legal nature of the signature.
• İmzala.org does not guarantee the accuracy of the match. If the match is not certain, the document is not sent and the decision is left to you; however, verifying that a match that appears certain belongs to the correct person is also your responsibility.
• The final control of which document is sent to whom rests with you at the moment you give dispatch approval. The statement you check at dispatch approval is your representation that you have reviewed the preview and that the documents and recipients are correct.
• A document may contain hidden text that is not visible on screen, and the match may be affected by that text. For documents received from third parties, you must review the recipient in the preview.
• The accuracy and currency of your people lists (for example, removing people who have left an organisation) is your responsibility.
• You are liable for damages arising from sending to the wrong person to the extent you have failed to perform your review obligation above. İmzala.org's liability for gross negligence and wilful misconduct, and the liability that cannot be limited under Turkish Code of Obligations art. 115, are reserved.

This tool is not recommended for documents that may produce a result against an employee (release/discharge letters, termination notices, undertakings with penalty clauses); for these documents it is advisable to designate the recipient individually and to keep identity verification steps active.

5.7 Reference Use

• İmzala.org may use, with the prior written consent of the customer, the trade name and logo of corporate customers only as a reference on its website, promotional materials, and similar channels.
• This consent is not a condition of the service and is always revocable; if consent is withdrawn, the relevant use is discontinued within a reasonable time.
• The name and surname of individual users are not used as a reference without separate, explicit consent under KVKK.

6. Payment Terms

6.1 Pricing

• Visit our pricing page for current fees
• All fees shown on the pricing page and at checkout include VAT; no tax is added on top of the amount you pay. The invoice shows VAT broken out from the total amount
• Fee changes are subject to article 11.8: the fee for a period you have prepaid does not change during that period; a change applies only from the renewal period and only after prior notice
• Promotions and discounts may be time-limited; their terms of use are stated separately

6.2 Payment Methods

• Credit/debit card (PayTR secure payment infrastructure, PCI-DSS Level 1)
• Bank transfer/EFT (for corporate customers)
• Virtual POS (for corporate customers)
• Corporate invoicing (for approved customers, with payment terms)

Your card information (card number, expiry date, CVV) is processed directly on PayTR's secure payment screen (PCI-DSS Level 1); İmzala.org does not collect or store this information. Solely to enable recurring charges (subscription renewal and the transition after a free trial), a payment token generated by PayTR (a card-storage reference) and only the last 4 digits of your card are stored on İmzala.org's systems. This information alone cannot be used to make a payment or to reconstruct your card number.

6.3 Subscription and Renewal

• Subscriptions renew automatically
• Fees continue to be charged unless you cancel
• If you stop automatic renewal (cancellation), the service continues until the end of the paid period and no pro-rata refund is made. Where a consumer exercises the termination right under Law No. 6502 art. 52, article 6.4 applies.
• Unused credits carry over to the next month (subject to the package terms)

6.4 Right of Withdrawal and Refund Policy

Refund requests: [email protected], [email protected], or our postal address. Once your withdrawal notice reaches us, all amounts collected are refunded to the payment instrument you used to purchase, within 14 days at the latest (Regulation art. 12/3 and art. 12/4). On early termination during a subscription period, the fee for the remaining period is refunded without deduction within 15 days at the latest after the termination takes effect (Law No. 6502, art. 52/5). Detail: Distance Sales Agreement and Pre-Contract Information Form.

6.5 Free Trial (Card Required)

On certain subscription plans, a 7 (seven)-day free trial may be offered before you purchase the service on a paid basis. The free trial requires a valid credit/debit card to be registered. The trial terms are as follows:

• No fee is charged during the trial. The trial lasts 7 days.
• Automatic charge on day 7: if you do not cancel the trial before the 7-day period ends, the full period (monthly) fee of the plan you selected is automatically charged to your card at the end of day 7, and your paid subscription begins. The exact amount and exact date to be charged are clearly shown to you before you confirm the trial.
• Cancel at any time: you may cancel the trial at any time within its period, in a single step, from your account panel or the cancellation link in the e-mail sent to you. If you cancel within the period, no fee is charged and you are not moved to a paid subscription.
• Waiver of withdrawal and refund of the TRY 1 charge: because the service features become available to you immediately during the trial (performance of the service has begun), your waiver of the right of withdrawal is separately confirmed when you confirm the trial (see the consent list below). Notwithstanding this, if you have not used the service at all (zero usage) and you cancel the trial within 14 days, the TRY 1 amount charged for verification (if not already refunded) is refunded in full.
• Deletion of your card information: if you cancel the trial or delete your account, the payment token (card-storage reference) kept for recurring charges is deleted from our systems.

Before the free trial is started and the PayTR secure payment screen is opened, the following consents are obtained separately and not pre-checked:

1. Pre-Contract Information Form (Distance Contracts Regulation, art. 5)
2. Distance Sales Agreement
3. Waiver of the right of withdrawal: explicit consent that performance of the service begins immediately during the trial period
4. Card-storage consent (mandate): storage of the payment token for the TRY 1 verification and recurring charges
5. Recurring renewal consent: the automatic charge on day 7 and subsequent periodic renewals

These provisions apply together with 6.3 (Subscription and Renewal) and 6.4 (Right of Withdrawal and Refund). Once the trial converts to a paid subscription, the 14-day right of withdrawal and the 30-day satisfaction guarantee in 6.4 begin to run from the date the paid subscription starts (the day-7 charge).

7. Service Level and Warranty

7.1 Service Availability

• 99.9% uptime target (excluding planned maintenance)
• Planned maintenance is announced at least 48 hours in advance
• Live uptime: status.imzala.org
• For unplanned outages, credit compensation applies to corporate SLA customers

7.2 Technical Support

• E-mail support: 24/7 ([email protected])
• Phone support: weekdays 09:00-18:00 (+90 850 309 51 26)
• Live chat: chat.imzala.org (Chatwoot)
• Priority support for corporate customers

7.3 Data Security

• TLS 1.2 / 1.3 end-to-end encrypted communication
• AES-256 off-site backup encryption
• RSA-2048 digital signature (KMS)
• 4-layer backup (Velero + PostgreSQL dump + VM snapshot + off-site mirror)
• Primary data centre: Türk Telekom İstanbul Gayrettepe (Tier 3, Türkiye), via Turhost; off-site encrypted backups are temporarily held in the EU during the migration process
• WAF + DDoS protection: Cloudflare
• Antivirus: ClamAV malware-scanning infrastructure (being rolled out in phases)
• Current compliance: Law No. 5070, KVKK (Law No. 6698), GDPR, PCI-DSS SAQ A
• Certification roadmap: ISO 9001 (2026 Q3), ISO 27001:2022 (2027 Q1), SOC 2 Type II (2027 Q4). These certifications have not yet been obtained as of the current date

7.4 Subcontractors

İmzala.org may use subcontractors and service providers in areas such as infrastructure, hosting, e-mail / SMS delivery, payment, and similar functions in performing the service. Even so, İmzala.org remains responsible for the service being provided in accordance with this Agreement (Turkish Code of Obligations art. 116). Sub-processors who process personal data are subject to the sub-processor regime whose current list is published at /alt-isleyenler; the basis for each sub-processor (a data processing agreement, or, for data-centre providers that only provide server hosting and network connectivity, the provider's standard service agreement together with İmzala.org's own technical and administrative measures) is stated on that page. İmzala.org is liable for the acts of its subcontractors and sub-processors as if they were its own acts, under Turkish Code of Obligations art. 116.

The services of some business partners we promote or direct you to through the Platform (for example, SMS and İYS services) are subject to the relevant institution's own terms. İmzala.org may receive a revenue share from these referrals; this does not constitute an approval or recommendation of the services of those institutions.

7.5 Support-Purpose Account Access

• Support staff access your account and the content in it only at your request or where necessary to resolve an issue required for the service to be provided, and only to the extent necessary for that purpose.
• Actions taken during such access are logged; staff with access authority are bound by confidentiality obligations (NDA).
• Content and personal data seen during support are not copied, are not processed beyond the support purpose, and are not shared with third parties.

8. Limitation of Liability

8.1 General Limitations

To the extent permitted by law, İmzala.org is not liable for indirect, incidental, special, punitive, or consequential damages (including loss of profit, loss of data, or loss of reputation).

8.2 Maximum Liability

In every case, our total liability shall not exceed the fees paid by you in the preceding 12 months.

8.3 Digital Signature Disclaimer

İmzala.org is not liable for the following:

• The digital signature applied through the platform not being accepted for transactions subject to an official form (Law No. 5070, art. 5/2)
• The counterparty or official authorities not recognising the digital signature as equivalent to a Qualified Electronic Signature (QES) or to a wet-ink signature
• Third parties not recognising the digital signature or requesting additional verification
• The digital signature being assessed by courts as evidence at the court's discretion under Code of Civil Procedure art. 199 / art. 202
• The user being asked to provide a wet-ink signature or a QES (smart card / USB token) for the relevant transaction
• The signature not being recognised as an eIDAS Qualified Electronic Signature (QES) in EU and cross-border transactions (see §18)

The User represents that it uses the service knowing and accepting that the digital signature and a QES produce different legal consequences, and that it is the User's own responsibility to determine the type of signature required for the relevant transaction.

8.4 Exceptions

The limitations of liability do not apply to gross negligence, wilful misconduct, or situations that cannot be legally limited (such as under Law No. 6502 on the Protection of Consumers, art. 83).

9. Indemnification

You agree to indemnify us against any claim, damage, and expense arising from:

• Your breach of this Agreement
• Your breach of the law
• Your infringement of third-party rights (including the KVKK article 10 privacy-notice obligation)
• Misuse of the platform
• Problems arising from your content

10. Termination of the Agreement

10.1 Termination by the User

• You can close your account at any time using the "Delete my account" feature
• Account deletion: e-mail confirmation (24 hours) → 30-day recovery period → permanent deletion
• Your period to download your data before deletion: for as long as the account is active, plus a 30-day grace period
• Refunds within the right of withdrawal (14 days) and the satisfaction guarantee (30 days) are as set out in 6.4

10.2 Termination by the Company

We may suspend or terminate your account in the following cases:

• Breach of the Agreement
• Unlawful use
• Non-payment (30-day delay)
• Creating a security risk
• Causing harm to other users

10.3 After Termination

• Signed documents are retained, anonymised, for the statutory period (10 years, Turkish Commercial Code art. 82)
• Personal data is processed in accordance with the Privacy Policy and the KVKK Privacy Notice
• Unpaid fees are collected

10.4 Permanent Discontinuation of the Service or a Module (End of Life)

• If İmzala.org decides to permanently discontinue the entire service or a significant module, it will notify affected users at least 3 (three) months in advance by e-mail and through the platform.
• Between the notice date and the discontinuation date, your ability to download your documents and data using the platform's download and export tools is preserved.
• A proportional refund is made for paid periods and unused credits that can no longer be performed due to the discontinuation.
• Statutory retention obligations (10.3) are not affected by the discontinuation.

11. Changes to the Terms

11.1 When we make changes

We update these Terms only when one of the following occurs:

• (a) a change in legislation, a decision of a competent authority, or a court judgment,
• (b) a change in the scope or technical operation of the service, or in the infrastructure we use, arising from a technical necessity or an obligation originating from parties from whom we obtain services,
• (c) taking measures against security, fraud, or misuse risks,
• (ç) a change in the terms of third parties from whom we obtain services, or in our cost structure,
• (d) correcting errors, contradictions, or ambiguities in the text. Such corrections do not change the substance of rights and obligations; any provision that remains ambiguous is in every case interpreted in favour of the consumer.

We do not amend these Terms for any reason other than those above.

11.2 We obtain your explicit approval for materially adverse changes

If a change materially and adversely affects the rights and obligations you have under this Agreement, we notify you by e-mail or through the platform before the change takes effect and request your explicit approval through the platform. Unless you give your approval, the change does not apply to you and the previous version continues to apply. We record your approval together with the version of the text, the text's digest value (hash), a summary of the change, and the date of approval. The main matters deemed to be materially adverse changes are: fees and payment terms, the essential features and scope of the service, credit and quota rules, limits of liability, the term and termination of the Agreement, and dispute resolution. Whether a change is materially adverse to you is not left to İmzala.org's discretion; in case of doubt, the change is deemed materially adverse and the approval procedure in this article applies.

11.3 When it takes effect

Materially adverse changes are not applied during a subscription period you have prepaid. Such changes take effect at the earliest in the new period that begins after the end of your current period. For credit packages you have purchased, the terms in effect at the time of purchase continue to apply unchanged until the credits are exhausted.

11.4 If you do not wish to approve

You are not obliged to approve a materially adverse change. If you do not approve, you may end your subscription through the platform, without being subject to conditions more burdensome than the method used to conclude the Agreement, and without giving a reason. In that case, we refund the fee for the prepaid, unused period without deduction within fifteen days of your termination notice taking effect. No penalty, deduction, or additional fee is charged to you for not approving. Until you approve, the only consequence is that you cannot use the new or changed parts that are the subject of the change; the parts of the service provided under the version you approved remain available to you. Your termination and refund rights under this article apply in this case as well. Your termination rights under Law No. 6502 and article 22 of the Subscription Agreements Regulation, according to the type of your subscription agreement, are reserved in every case: for indefinite-term subscriptions or subscriptions with a term of one year or longer, at any time without giving any reason and without paying a penalty; for fixed-term subscriptions shorter than one year, for each change we make to the terms. These rights are independent of whether the change is materially adverse to you. In a termination made through this route as well, the unused portion of the amount you paid is refunded without deduction within fifteen days of the termination notice taking effect, under Regulation art. 25/3. Your termination request is fulfilled within seven days at the latest of reaching us (Regulation art. 24).

11.5 Other changes

We notify you, by e-mail or through the platform, of changes that do not have a materially adverse effect on you (corrections of spelling and wording, explanatory additions, updates to contact and company information, changes in your favour) a reasonable time before they take effect. No further approval is required for these changes.

11.6 Changes that may take effect immediately

Changes arising from legislation, a decision of a competent authority or a court, and technical and security measures aimed at protecting the security of your account and the service, may take effect immediately. This authority is not used for provisions on fees, limits of liability, the term and termination of the Agreement, or dispute resolution. We notify you of such changes as soon as possible; the period rule in 11.3 and your termination and refund rights in 11.4 are reserved.

11.7 Product updates

We continuously develop the service; we make updates to the interface, flows, and technical details. These updates are not subject to the notice and approval procedures in this article as long as they do not materially and adversely reduce the essential features of the service you purchased. If an update, whatever it is called, materially and adversely reduces the essential features of the service you purchased or the quota and credit rights granted to you, it is deemed a change to the terms of the Agreement and articles 11.2 and 11.4 apply.

11.8 Fees

The fee for a subscription period you have prepaid does not change during that period. Fee changes apply only from the renewal period and are notified to you before renewal. After the notice, you may choose not to renew.

11.9 No retroactive effect

Changes do not have retroactive effect. Transactions you completed, contracts you created, and digital signatures you applied before a change are governed by the version in effect on the date of the transaction. The version of these Terms currently in effect is published on this page. We keep previous versions in an archive, together with their version numbers and effective dates, and share them with you on request sent to [email protected].

12. Force Majeure

We are not liable for service interruptions arising from natural disasters, war, terrorism, strikes, regulatory measures, large-scale internet outages, epidemics, or other events beyond our control.

13. Governing Law and Competent Courts

This Agreement is governed by the laws of the Republic of Türkiye. The İstanbul (Çağlayan) Courts and Enforcement Offices have jurisdiction over disputes.

In consumer disputes, within the monetary limits under Law No. 6502, the Consumer Arbitration Committees and Consumer Courts have jurisdiction.

14. Contact Information

15. Signature Data and Security Standards

15.1 Categories of Data Processed

İmzala.org processes the following data during the digital signing process:

• Handwritten signature image (PNG bitmap): the visual record of the signature the user draws in the signature field. The only signature data stored is the raster image; dynamic biometric parameters such as pressure, speed, acceleration, angle, or a coordinate time series are not recorded.
• Transaction metadata: signature timestamp, IP address, user agent (for evidentiary integrity under Code of Civil Procedure art. 202 / Law No. 5070, art. 5).
• Identity-verification evidence: e-mail / SMS OTP confirmation (no biometric factor is used unless the optional face / liveness verification is enabled).

15.2 Security Standards

• TLS 1.2 / 1.3 end-to-end encrypted communication
• AES-256-GCM at-rest backup encryption
• RSA-2048 server digital-signature key (KMS, OpenBao Transit)
• SHA-256 hash algorithm
• A timestamp (RFC 3161) issued by TÜBİTAK KamuSM, an electronic certificate service provider under Law No. 5070 (not an eIDAS qualified timestamp)
• PAdES B-LTA long-term archival signature level

15.3 Data Deletion and Retention

• The signature image and signed documents are retained for the statutory retention period of the relevant contract (Turkish Commercial Code art. 82, 10 years).
• When you close your account, personal data is deleted or anonymised in accordance with the rules stated in the KVKK Privacy Notice.
• Optional biometric identity verification (face / liveness verification) is carried out only with separate explicit consent; the processing, security, and retention conditions are described in KVKK Privacy Notice §2.5.

16. Legal Notices and Disclaimer

17. Transactions Subject to an Official Form and Security Agreements (Law No. 5070, art. 5/2)

18. Cross-Border Transactions (EU / eIDAS Notice)

19. Declaration of Electronic Certificate Service Provider (ESHS) Status

20. Confidentiality (Trade Secrets and Confidential Information)

Each party treats as confidential information the commercial, technical, and financial information (including price quotes, integration information, and business processes) disclosed to it by the other party in connection with the service relationship that is marked confidential or that should reasonably be regarded as confidential by its nature; each party protects this information with at least the care it applies to its own confidential information, does not share it with third parties without the other party's consent, and uses it only for the purpose of the service relationship.

The following information is not subject to the confidentiality obligation:

• Information that was already public before disclosure or that later becomes public without breach
• Information the receiving party lawfully knew before disclosure
• Information lawfully obtained from a third party without a confidentiality obligation
• Information the receiving party can prove it developed independently of the other party's information
• Information required to be disclosed by legislation or a decision of a competent authority (the other party is given prior notice where legally possible)

The protection of personal data is not governed by this article but by the Privacy Policy, the KVKK Privacy Notice, and the data-processing regime in articles 5.3 / 5.4; in the event of a conflict, the data-protection provisions prevail.

21. Final Provisions

21.1 Severability

If any provision of this Agreement is held invalid or unenforceable, the validity of the other provisions is not affected; the invalid provision is deemed replaced by a valid provision closest to its purpose. The provisions of Law No. 6502, art. 5 concerning unfair terms in consumer transactions are reserved.

21.2 Waiver

A party's failure to exercise, or delay in exercising, a right under this Agreement shall not be construed as a waiver of that right.

21.3 Assignment

The User may not assign the rights and obligations arising from this Agreement to third parties without İmzala.org's written consent. İmzala.org may assign the Agreement, in the event of a merger, demerger, acquisition, or restructuring, to a successor company, provided the User's rights and safeguards under this Agreement are not reduced and the User is notified; in that case the User's termination rights (10.1) are reserved.

21.4 Notices

• Official notices to İmzala.org may be made in writing to the address in article 14 or through the registered e-mail (KEP) address ([email protected]).
• İmzala.org sends notices to the user to the e-mail address registered on the account and/or through in-platform notification channels; keeping the registered e-mail address current is the user's responsibility.
• The form requirements under Turkish Commercial Code art. 18/3 for notices of default, termination, and rescission between merchants are reserved.

21.5 Entirety and Order of Precedence

Together with the referenced Privacy Policy, KVKK Privacy Notice, Distance Sales Agreement, Data Processing Agreement (DPA), Developer and API Terms of Use, SLA, and related policy pages, this Agreement forms the entire agreement between the parties. If you use the API or the SDKs, that use is additionally subject to the Developer and API Terms of Use; those terms do not narrow your rights under these Terms of Use, and in the event of a conflict these Terms of Use prevail. In the event of a conflict between provisions:

• The mandatory provisions of Law No. 6502 take precedence in every case; in consumer transactions, the Distance Sales Agreement and the Pre-Contract Information Form are additionally special provisions.
• On data-protection matters, the KVKK Privacy Notice, the Privacy Policy, and (to the extent in effect) the DPA govern.
• If a separate agreement has been signed with a corporate customer, the special provisions of that agreement take precedence over these general terms; if that agreement contains negotiated data-processing provisions, those govern on data-protection matters.
• In other cases, these Terms of Use apply; the SLA is a special provision only with respect to service-level commitments.

22. Statement of Acceptance

You represent that you have read and understood this Agreement and accept to be bound by its provisions as in effect in this version. In particular, you confirm that you understand and accept that the digital signature applied from the browser on İmzala.org is an electronic signature within the meaning of Law No. 5070, that it is not a secure electronic signature, that additional verification steps (phone, Turkish ID number check) strengthen its evidentiary value but do not turn it into an advanced or secure electronic signature, that it is under no circumstances a Qualified Electronic Signature (QES), the exceptions for transactions subject to an official form (Law No. 5070, art. 5/2), the lack of cross-border (eIDAS) recognition, the ESHS status declaration, that the handwritten signature image does not constitute biometric data, and that optional biometric identity verification is processed only with separate explicit consent.

Translation version: 3.16-en.1. Source: Turkish version 3.16.

Translation change (3.16-en.1, 10 October 2026): translation of Turkish version 3.16. The §7.3 compliance line and the v3.16 version note were translated; no other part of the translation changed.

Translation change (3.15-en.1, 4 October 2026): translation of Turkish version 3.15. The addition to §21.5 (Developer and API Terms of Use) and the v3.15 version note were translated; no other part of the translation changed. The Developer and API Terms of Use are published in Turkish.