Privacy policy

Privacy and licence agreement

Agreement version 1.1 · Store notice dated 9 October 2026

This page publishes the complete RegsUP agreement. Privacy information is in Part B, the applicable country schedules and Schedule 2. Part A contains the separate platform and content licence terms. Publication or reading this page does not constitute acceptance of contractual terms or consent to optional data processing. The separate acceptance requirements in the agreement remain applicable.

Contents

Store-specific information

The descriptions of invoiced bank transfers, platform accounts and regsup_session in the agreement concern the RegsUP platform. For store.regsup.com, the following store-specific information applies. Purchasing one PDF does not include a platform subscription or access to future editions.

Shopify provides this store, cart and checkout. The store settings identify the United States as the customer data hosting location. Shopify processes contact, order, device and usage data; its role depends on the service used. Its own consumer services are explained in the Shopify Consumer Privacy Policy. You can also exercise applicable rights through the Shopify Privacy Portal.

Order and licence information is used to prepare and deliver the purchased PDF through our AWS-based delivery system. Delivery messages use Google Workspace. You receive a copy licensed specifically to you. Delivery follows payment confirmation and order release.

Available payment methods, the provider and the payable amount are shown at checkout. An invoiced bank transfer to Halkbank is a separate payment method and does not describe every Shopify checkout transaction. Merely naming a payment provider in this notice does not mean that method is active.

Store cookies and privacy controls are managed by Shopify; the regsup_session cookie described in B6 belongs to the main platform. Google Analytics is connected through the Google & YouTube app to measure store visits, product views and the purchase journey. Applicable consent requirements and the choices submitted through the store’s privacy controls govern optional processing. Data sharing choices and Google’s privacy information are available here.

For requests concerning Anemon’s processing, contact info@anemoninnovation.com. Controller identity and the registered address are in A1. The rights and safeguards in Part B and the country schedules also apply to store processing.

Shopify Network Intelligence is disabled for this store. Anemon does not use that feature to combine store customer data for cross-merchant advertising or personalisation. Optional marketing requires the applicable separate permission.

RegsUP Platform Use Digital Content Licence and Privacy Agreement

English version and country schedules

Version 1.1 • Document date 8 October 2026 • Document code REGSUP LEGAL 1.1 EN

This Agreement governs use of a RegsUP account, rights in purchased digital content, measures applicable to account or file sharing, and the protection of personal data. Part A contains the contractual terms, Part B the privacy notice, and Part C the country and regional provisions. Schedule 1 governs the order record and specific acceptances; Schedule 2 governs data processing and the provision of information.

This Agreement takes effect for a Customer when accepted under A2. The document date does not replace the Customer’s acceptance date or the service commencement date. Privacy information is provided before the relevant processing begins, independently of contractual acceptance. Prices, user numbers and purchased content are specified in the order record linked to this Agreement.

A Platform and digital content licence terms

A1 Parties and scope

The service provider is ANEMON İNOVASYON VE DİJİTAL TEKNOLOJİLER SANAYİ TİCARET ANONİM ŞİRKETİ, referred to as “Anemon” or “RegsUP”. Its trade registry number is 545226 and its MERSİS number is 0069163435800001. Its address for contractual communications and requests is Mehmet Akif Ersoy Mah. 350. Sokak Profis Sitesi B Blok No: 3 İç Kapı No: 24, Yenimahalle / Ankara / Türkiye. Contractual and privacy enquiries may be sent to info@anemoninnovation.com.

“Customer” means the individual or legal entity placing the order in its own name. “Authorised User” means a natural person assigned a personal account and access rights within the Customer’s purchased scope. A person accepting an order for an organisation must provide evidence of authority. Having an employee account does not, by itself, confer authority to bind the organisation or constitute a personal guarantee.

RegsUP provides a regulatory library, version comparisons, analyses, calendars and notifications, expert questions and answers, digital documents and integrations expressly identified in an order. Purchasing one product does not automatically include other products, new versions or an API licence.

A2 Formation and priority of documents

Before acceptance, the Customer receives the order summary, fees, licence type, user count, term, delivery method and a downloadable version of this Agreement. The contract is formed when an authorised person expressly accepts that specific version. Paid use additionally requires verified payment or agreed access on credit. Merely visiting the website, clicking a link or receiving a file does not constitute acceptance of all terms.

Mandatory law takes priority, followed by the applicable country schedule, a specifically agreed and signed order or supplementary agreement, and this Agreement. An order cannot waive privacy rights or authorise undisclosed processing. Different standard terms in the Customer’s purchase documents are not incorporated without Anemon’s express acceptance.

The accepted text is linked to its version, acceptance time, accepting account and authority, order scope and integrity records. The Customer receives a copy that can be retained. Where law requires writing or a particular signature, a checkbox or email alone is insufficient; the required form must be completed.

Payment is made against an invoice by bank transfer to Anemon’s EUR, USD or TRY account at Türkiye Halk Bankası identified on the invoice. The agreed currency, due date, taxes and any allocation of bank charges apply. Payment in another currency requires agreement on the exchange rate and amount credited. Changes to bank details must be verified through an authenticated Anemon communication channel; a third party’s account-change message alone must not be relied upon.

A3 Per-user licensing and account security

Each account is assigned to one natural person only. That person may use their own computer and mobile device within the technical limits stated in the order. Licensing is measured by the number of people given access, not by devices, IP addresses or simultaneous sessions.

If five employees of a company use the service, five separate Authorised User accounts and licences covering those people are required. Five people using one account simultaneously or in succession is a breach; it does not turn a single-user licence into a five-user licence. Shared departmental accounts, passwords, verification codes, transferred sessions and remote access provided to another person are included in this prohibition.

Even with a five-user package, five people must not share one account; the purchased entitlements must be assigned to separate accounts. If there is no actual licence shortfall, account sharing alone does not justify charging for five additional licences. Security, corrective and, where appropriate, termination measures remain applicable.

Users must protect passwords, recovery codes, access links and personal API keys. The Customer must take reasonable measures to ensure compliant use by users under its control and promptly revoke access for departing personnel. Suspected compromise or unauthorised access must be reported without delay to info@anemoninnovation.com. An attack by a third party without Customer fault does not automatically trigger a contractual penalty.

A user may be replaced by revoking the former user’s rights and registering the replacement. Licences must not become a shared pool used by multiple people through shifts or rotating assignments. Reasonable reassignment following a permanent role change, departure or extended leave may be permitted; the same entitlement must not be assigned concurrently to both people.

A4 Licence scope and duration

Payment does not transfer ownership or intellectual property rights in RegsUP software or content. The Customer receives a non-exclusive right of use, non-transferable except as permitted below, limited to the organisation, Authorised Users, product, version, term and purpose in the order. Group companies, affiliates, dealers and the Customer’s clients are separate entities and are not covered unless expressly included.

For protected content, permitted reproduction is limited to a working copy on an Authorised User’s device, reasonable backups and printouts under A5. No general distribution or communication-to-the-public right is granted; the limited disclosure permission in A5 and statutory exceptions remain available. No right is granted to adapt the content into another product, translate and republish it, or make it publicly available. Any applicable requirement for written intellectual property agreements and separately specified rights must be met for the transaction concerned.

A subscription provides named-user online access and expressly included downloads for its stated term. New access, downloads and updates cease on expiry. Protected content downloaded under a subscription must not remain in active business use after expiry unless the order grants continuing rights; the limited legal archive exception in A13 applies.

Unless the order expressly provides otherwise, a separately purchased PDF carries a perpetual internal-use licence for the named user and the particular version purchased. This does not include new versions, unlimited users, redistribution, perpetual hosting or perpetual re-download services. Re-download and support periods are separately stated in the order summary. This default applies only to new orders under this Agreement and does not retrospectively amend earlier contracts.

A5 Permitted file use

An Authorised User may download licensed files to a secure personal work device, make reasonable personal backups and print them for their own professional use. Shared internal storage is permitted only if everyone with access holds a valid user licence covering that content and access is restricted accordingly.

Making even one protected file available to unlicensed people by email, messaging, shared folder, intranet, document management system, recorded training or screen sharing constitutes distribution or provision of access. A disclosure is not authorised merely because it is free of charge, is made within the same company or occurs only once.

Limited excerpts or printouts necessary for a specific application, audit or dispute may be disclosed to an official authority, accredited technical service, auditor or legal adviser. Disclosure must be limited to its purpose, preserve source and version details, mask personal information where possible and confer no general library access. Unless mandatory law requires otherwise, repeated or commercial distribution of a complete protected document requires a separate written licence. Statutory quotation rights and other mandatory exceptions are unaffected.

A6 Prohibited use and distribution

Without an express written licence, Customers and users must not:

  • Distribute, sell, rent, sublicense or make a protected file or a substantial part available to unlicensed people through a public link.
  • Republish RegsUP content within another paid or free library, regulatory product, training offering, database or commercial service.
  • Remove or alter licence, source, version or ownership information to conceal unauthorised distribution, misattribute content or create a misleading impression.
  • Carry out unapproved automated bulk downloads, bypass access limits, facilitate account sharing or defeat security controls.
  • Upload protected RegsUP content in bulk to third-party AI systems, train models, create persistent knowledge bases or build systems searchable by other people without a separate licence.

Non-waivable statutory rights, including research, interoperability and quotation exceptions, remain available. These restrictions do not prevent obtaining and using legally unrestricted official texts from independent sources.

A7 Official sources and RegsUP rights

Official legislation, public legal facts and third-party materials remain subject to their own legal status. RegsUP does not claim exclusive copyright merely because it makes them available. Freedoms under Article 31 of Türkiye’s Law on Intellectual and Artistic Works (FSEK) and their equivalents elsewhere remain available; international organisations’ source conditions must also be respected.

RegsUP software, marks, original commentary, legally protectable translations, editorial analyses, original selection and arrangement, and database investments protected by applicable law belong to Anemon or the relevant rights holder. Protection depends on each element’s eligibility and Anemon’s actual rights. AI involvement alone does not establish copyright or exclusive ownership.

Rights in Customer data remain with the Customer or the original rights holder. The Customer grants Anemon only the purpose- and time-limited permission necessary to provide, back up and secure the service and perform expressly agreed operations.

A8 Licensed copy and lawful investigation

You receive a copy licensed specifically to you. This licence does not claim ownership of official source text.

Account and session records, access times, technical client information, IP information obtained by the server, downloads, licence codes and file hashes may be examined where necessary and proportionate for licence protection and security. Part B and Schedule 2 explain data and retention criteria; service-specific notices precede the relevant processing. This clause does not permit covert device surveillance, biometric monitoring or unrestricted access to Customer systems.

Multiple IP addresses, devices or sessions do not alone establish use by multiple people. A licensed copy alone does not prove a particular person’s fault. Assessment considers consistent combined records, the Customer’s explanation, possible account compromise, licensed-user lists and, where necessary, independent expert examination. Penalties and permanent termination must not be based solely on an automated score.

Where there are concrete indications, the Customer must reasonably cooperate in explaining relevant licence allocations and records limited to the alleged breach. On-site or remote audits require agreement on scope, timing, confidentiality and data minimisation, or an order of a competent authority. General access to other projects, trade secrets or employees’ private data cannot be demanded.

A9 Breach notice and correction

RegsUP must notify the Customer at its contractual contact address of the event, account or content, relevant period, a reasonable summary of supporting records and the required correction. Normally, five business days are allowed for an explanation and correction. Business days exclude weekends and public holidays in Türkiye, subject to mandatory local periods.

For public-link distribution, ongoing bulk downloads, verified compromise or a serious data-security risk, the affected account, link or download function may be restricted immediately, temporarily and proportionately to prevent further harm. Reasons and an objection channel must be provided without delay. Other licensed users retain access unless restriction is necessary to address the risk.

Correction may include closing or separating a shared account, stopping unauthorised access, removing shared links, deleting unauthorised copies under the Customer’s control and calculating unlicensed use. Buying a licence later does not automatically extinguish an earlier breach; any settlement scope must be recorded in writing.

A10 Licence shortfall and damages

Anemon may claim the licence fee corresponding to proven unauthorised use and duration. The calculation uses the net unit price applied to the Customer for the same product or an additional-user price disclosed and accepted in the order. A subsequently introduced higher tariff cannot be applied retrospectively.

For time-based user licences: E = number of unlicensed natural persons in each period × the accepted net additional-user price for that period × the proportion of the licence term during which use is proven. Changes in users or prices require separate calculations. For a separately purchased PDF, E is the applicable net per-user PDF licence fee for each proven recipient using that same version outside the purchased scope. The same person, product and period are counted once. Unknown internet users must not be billed on an assumed basis.

For example, if a one-user account was used by five people for three months and the accepted net annual additional-user price was EUR 390, E = 4 × 390 × 3/12 = EUR 390. This is an illustration, not evidence of price or duration. If valid rights for five users were already purchased, sharing one account alone does not create E.

Payment does not authorise past distribution or grant a future licence. Anemon may also claim proven damages and reasonable costs where statutory requirements, including fault and causation, are met. Licence fees, contractual penalties, intellectual property remedies and damages must not produce double recovery for the same loss; applicable crediting and election rules apply.

A11 Separately accepted contractual penalty for merchant Customers

This clause applies only if a Customer having merchant status under applicable law separately accepts it under Schedule 1 in writing or a legally equivalent signed form, with a specified amount or calculation formula. It does not apply to consumers. It does not take effect without the order’s user, price and duration details and the separate acceptance.

If intentional account sharing or distribution of protected content by the Customer is proven, or the Customer continues or repeats a breach of the same nature despite the notice and cure period in A9, a contractual penalty C equal to E calculated under A10 is payable for that breach. C is additional to stopping the breach and paying E; it does not buy a right to continue. If E is zero, C is also zero under this formula; correction, termination and proven-damage rights remain available.

Separate penalties do not accrue for every login, download or day within the same course of events. A continuing breach is treated as one event; an independently repeated breach after written notice and correction may be assessed separately. The penalty for one event must not exceed the accepted net annual licence fees for the affected products or users; for a PDF, it must not exceed the total net licence fees for the proven unauthorised recipients.

Mandatory judicial review, reduction or invalidity rules and requirements for proving loss exceeding the penalty remain applicable. Anemon’s unilateral notice does not create an indisputable final debt. In the A10 example, if all conditions and the separate acceptance are met, E is EUR 390 and C is EUR 390, totalling EUR 780 before applicable tax treatment. Other losses require their own legal basis and no double recovery.

A12 Legal remedies and evidence

Depending on the facts, Anemon may seek prevention or cessation of infringement, removal of content, preservation of evidence, interim relief, payment and damages. Intellectual property remedies, including under FSEK, require protected subject matter, ownership, an actionable act and all other legal conditions. A criminal complaint is considered only where concrete facts support suspicion of an offence; a payment dispute alone is not characterised as a crime.

Both parties may submit lawful electronic records, accepted contract versions, hashes, signatures, time information, correspondence and other evidence. RegsUP records are not agreed to be exclusive or conclusive evidence. The Customer retains rights to contrary evidence, expert examination and judicial challenge. Court costs and legal fees are governed by applicable law and the competent authority’s decision.

A13 Termination and subsequent file handling

Anemon may terminate the affected service or, where necessary, this Agreement by reasoned notice if a remediable material breach remains uncorrected within A9’s period, or serious intentional distribution or comparable circumstances make continuation unreasonable. Termination must be proportionate. If an erroneous finding is corrected, restrictions are lifted and service loss is remedied where appropriate.

Use, sharing and access must stop for protected content under an expired or validly revoked licence. The Customer must delete active copies under its control within ten business days, reasonably request unauthorised recipients to stop access and delete copies, and provide written confirmation of its actions through an authorised representative. No false guarantee of independent third parties’ conduct is required.

Copies necessary for legal retention, the integrity of completed type-approval or audit files, or an existing dispute may remain in a closed archive, with the basis documented and access limited to authorised persons. This exception does not permit daily use, new projects, redistribution or access by unlicensed persons. Backup copies are removed in the ordinary secure deletion cycle and must not be returned to active use meanwhile.

Termination does not automatically end a separately paid perpetual PDF licence; a valid ground relating to that licence is required. Accrued debts and valid claims survive. There is no blanket forfeiture of all unused fees or waiver of refunds: refunds and credits depend on the order, termination grounds and mandatory law.

A14 Confidential information and expert services

Non-public technical files, designs, test reports, questions, quotations, credentials and trade secrets must be used only for the service and contractual purpose. Disclosure is limited to employees, experts, advisers and providers with a need to know and appropriate confidentiality duties. Trade secrets remain protected while they retain that status; other confidential information remains protected for five years after termination. Part B and statutory periods additionally apply to personal data.

Information lawfully known beforehand, made public without fault, independently developed or lawfully received from an authorised third party is excluded. Mandatory official requests permit only necessary disclosure; the information owner must be notified beforehand unless prohibited.

Experts receive the context necessary to answer the question after confidentiality review. Attachments are accessible only to authorised Customer users, assigned experts and necessary operations personnel. Sharing a question or answer with other members requires separate publication permission, off by default; attachments are not automatically included. Anonymous publication requires removal of identity, re-identifying details and trade secrets. Organisational permission does not replace a lawful basis for third-party personal data.

A15 Nature of the service and liability

RegsUP editorial material, analyses, expert opinions and any AI outputs are not official decisions, legal representation or a guarantee that a vehicle will receive type approval. The Customer must verify the regulatory version, jurisdiction, technical scope and official sources relevant to its decision. Anemon remains obliged to exercise professional care and assess reported material errors within a reasonable time.

In contracts between merchants, to the extent legally permitted, Anemon’s aggregate contractual liability for ordinary negligence is limited to the net fees paid or payable for the affected service in the twelve months before the event. Indirect loss, lost opportunities and hypothetical profits are assessed within these limits; no exclusion prohibited by applicable law results.

Intentional misconduct, gross negligence, death or personal injury, fraud, non-excludable data-protection liability and mandatory consumer rights are unaffected. Customer liability for unlawful uploads or unauthorised distribution likewise requires applicable conditions of fault, loss and causation; Anemon’s own fault is not shifted to the Customer.

A16 Changes notices governing law and language

New terms do not retrospectively apply to accepted orders. Material changes to an ongoing service require clear notice at least thirty days before taking effect. New obligations or penalties require the applicable express acceptance and form. Updating the Agreement alone does not authorise a new purpose for consent-based processing.

Ordinary notices are sent to the registered contractual email and, where available, the account notification area. Special legal notice and form requirements for default, termination and similar actions must also be satisfied. Sending an email alone does not constitute valid legal service in every country.

Turkish law governs, subject to mandatory conflict-of-laws rules and applicable country schedules. Where a jurisdiction agreement is lawful between merchants or public legal entities and separately accepted in the required form under Schedule 1, the Courts and Enforcement Offices of Ankara have jurisdiction. Mandatory exclusive jurisdiction, consumer remedies, compulsory mediation and interim-relief rules remain applicable. Recognition and enforcement abroad remain subject to local requirements.

Invalidity of one provision leaves the remainder effective as far as possible; an invalid term is not automatically rewritten in Anemon’s favour. Choice of law or court does not restrict complaints to a competent data-protection authority.

The Turkish, English, German and Spanish versions have the same clause structure and contractual scope. The version accepted in the order is the contract language for that order. If meanings differ, the accepted version prevails subject to mandatory interpretation rules; another language version cannot impose an undisclosed additional obligation. Mandatory local-language and information rights remain protected.

B Privacy policy and personal data notice

B1 Controller and processor roles

Anemon, identified in A1, is the controller for account administration, its business relationships, security, licence protection and website measurement for its own purposes. Privacy requests may be sent to info@anemoninnovation.com. Activities requiring a local representative, data protection officer or contact must not take place until that role and the contact notice required under Schedule 2 are in place.

Anemon may act as a processor where it processes third-party data uploaded for the Customer’s own purposes solely on the Customer’s documented instructions. Such processing requires a separate Data Processing Addendum covering subject matter, duration, data types, security, subprocessors, breach assistance, return and deletion. This notice is not itself that addendum or an international transfer agreement.

B2 Information and sources

Account and organisation administration involves names, business emails, organisation, role, language, membership and permissions. Authentication involves password hashes, sessions and multi-factor authentication records; storing passwords in plaintext is not required. Orders may involve product, licence, billing, tax, payment status and delivery information. Payment is by invoice and transfer to Anemon’s EUR, USD or TRY accounts at Türkiye Halk Bankası. The bank is an independent controller for its banking and legal obligations. Anemon processes sender details, amount, currency, date, payment description and transaction reference needed for reconciliation. This payment method does not require card numbers or security codes to be provided to RegsUP.

Service use may generate followed regulations, reminder and calendar preferences, notes, questions, expert answers, attachments, document and version preferences, support correspondence, licence records and download history. Technical records may include necessary timestamps, IP information, browser or operating system details, security events and access results. Data specific to an unused feature is not collected merely because that feature exists.

Sources include the user, organisational invitations or assignments, instructed integrations, order and payment providers, and technical service events. Collection occurs through electronic forms and email, automated records and, where necessary, non-automated contracts or invoices. When data is obtained indirectly, the required source information and notice are provided within the applicable period.

B3 Purposes and legal bases

The basis is assessed for each activity and individual. The following mapping applies under Türkiye’s Personal Data Protection Law (KVKK) and, where applicable, the GDPR; Part C addresses other jurisdictions.

  • Accounts and services: Necessary steps to enter into or perform a contract with the individual rely on KVKK Article 5(2)(c) and GDPR Article 6(1)(b). This does not automatically apply to an employee who is not personally a contractual party. Necessary business-account administration is assessed under balanced legitimate interests, KVKK Article 5(2)(f) and GDPR Article 6(1)(f).
  • Invoices and required records: Data genuinely required by tax, commercial or accounting law relies on KVKK Article 5(2)(a) or (ç). GDPR Article 6(1)(c) is used only with a legal basis satisfying Article 6(3); a Turkish obligation alone is not automatically an EU-law basis.
  • Security and licence protection: Preventing unauthorised access, separating organisations and protecting service integrity relies on balanced legitimate interests. Necessary legal-claim records rely on KVKK Article 5(2)(e), the relevant GDPR basis and any applicable special-category conditions. This does not justify unlimited monitoring of all activity.
  • Communication and support: The individual’s pre-contractual request or contractual performance applies where appropriate; other business communication relies on necessary and proportionate legitimate interests. Marketing requires the separate permissions required by electronic communications and data-protection law.
  • Optional measurement and choices: Non-essential analytics requires separate consent under KVKK Article 5(1), GDPR Article 6(1)(a) and applicable electronic communications rules. Refusal does not block core services, and consent can be withdrawn easily.

Failure to provide mandatory account or invoice details may prevent the service or fulfilment of a legal obligation. Optional profile, marketing and analytics information is not mandatory. A new incompatible purpose requires prior information and, where necessary, a new legal basis.

B4 Recipients and organisational access

Amazon Web Services (AWS) provides the platform hosting infrastructure. Data may be disclosed, within necessary duties, to Anemon personnel; infrastructure, hosting, backup, security, email, payment and technical support providers; assigned experts; legal and accounting advisers where needed; and competent public authorities. Schedule 2 identifies recipient categories. Where recipient identity, country or other particulars must be disclosed, they are provided in the service-specific notice before processing. Contracted processors must not use data for their own purposes; providers acting as independent controllers are identified as such.

Organisation administrators may view membership, organisational work records and licence assignments within their permissions. This does not authorise monitoring private life or unrestricted reading of messages. User-selected calendar exports, API connections or file disclosures may transfer data to the chosen recipient; the scope is explained before the operation.

Anemon does not sell personal data for data trading or share it for cross-context behavioural advertising. Analytics providers are used on terms consistent with this commitment. A business transfer permits only necessary disclosure with suitable confidentiality safeguards and a valid legal basis, not unrestricted use for new purposes.

B5 International transfers

Hosting, backups, email, analytics or expert access may involve transfers outside Türkiye. A server in Europe does not exclude support access from another country. Recipient legal entities, countries, purposes and safeguards are disclosed in the service-specific notice under Schedule 2 before the transfer. Information about, or a protected copy of, applicable safeguards can be requested through the contact address.

Transfers from Türkiye must meet the current KVKK Article 9 regime; transfers from the EEA, UK, Switzerland and other countries must also satisfy their own rules. EU standard contractual clauses alone do not meet Türkiye’s requirements, and contractual acceptance does not replace separate consent or localisation duties. Occasional-transfer exceptions must not become the general basis for routine infrastructure use. A transfer must not begin before the necessary mechanism is in place.

B6 Cookies and similar technologies

Essential session and security technologies support the service. The regsup_session cookie is issued for twelve hours on normal login or seven days with “remember me”; security measures, logout or revocation may end it earlier. The browser record regsup.analytics-consent.v1 stores the analytics choice until changed by the user, cleared with browser data or requested again. The preference record does not itself perform analytics.

Google Analytics measures public-site use only with separate optional consent. Authenticated workspaces, account recovery and invitation flows are excluded. Form or question content, Customer files and account identities are not included in analytics events. Measurement does not mean that all underlying data is anonymous.

Users may accept, refuse or change their choice through “Privacy choices”. Withdrawal stops subsequent optional measurement and removes accessible relevant first-party cookies. Existing provider records remain subject to retention and individual-rights rules. Before consent, the technology’s name, provider, purpose, duration and transfer information are supplied. Changes to purpose or provider scope affecting consent require renewed consent where applicable law requires it.

B7 AI sensitive information and children

Before an AI feature is used, the user is informed of the content to be sent, provider, processing location, retention, subprocessors and whether model training is involved. Opening an account alone does not authorise sending confidential Customer files to an external model. Anemon does not use Customer content for general model training or permit providers to do so. External-model features are not enabled until provider terms and safeguards meet that restriction.

Users must not upload sensitive or special-category personal data, identity-document copies or unnecessary third-party information in questions. If such processing is necessary, a separate procedure, lawful basis and additional safeguards are required; uploading alone does not supply them. The service is for adult professionals and is not directed to children. Identified child data is handled under the relevant local rules.

This Agreement does not authorise solely automated decisions having legal or similarly significant effects on individuals. Licence-breach, penalty and permanent account-closure assessments include human review and an opportunity to challenge.

B8 Retention deletion and security

Data is kept no longer than required by its specific purpose or legal obligation. Accounts are retained for the active relationship and closure; questions and attachments for completing the service and necessary legal defence; invoices for statutory periods; security logs for documented risk assessment; and consent and acceptance evidence for necessary proof of duties or rights. Schedule 2 provides starting events, objective criteria and disposal principles. Where law requires a definite period, it is disclosed before processing.

Immutability, hashes or audit status do not justify indefinite personal-data retention. Once the purpose ends, data is deleted, destroyed or genuinely anonymised. A narrowly necessary set may be held with restricted access for a dispute; ordinary disposal resumes when the justification ends. Backup deletion cycles and reapplication of deletion requests after restoration are addressed separately.

Anemon applies risk-appropriate authorisation, organisational separation, secure sessions, password protection, access records and backups. No absolute security guarantee is made; statutory duties remain. Data breaches are handled under the applicable reporting thresholds, periods and procedures, with clear information and recommended protective measures for affected individuals where required.

B9 Rights requests and consent

Depending on applicable law, individuals may learn whether data is processed, obtain information and access, correct or delete data, restrict or stop processing, request portability, object, withdraw consent and complain to a regulator. Part C explains scope and exceptions. Processing for direct marketing stops following an objection. Withdrawal does not invalidate earlier lawful processing.

A request may initially identify the applicant, contact address, relevant account or transaction and requested action. Legally required additional information and proportionate identity checks are handled securely. Identity-document copies are not routinely required. Being an organisation administrator does not authorise obtaining all of another person’s personal data.

Requests are answered without undue delay and within the applicable statutory period. Refusal or restriction must explain reasons, remedies and deadlines. Rights are free except for narrow legally permitted fees or excessive-request exceptions. Acknowledging Part B is not blanket consent to marketing, analytics, sensitive-data processing or international transfers; required choices are separate and purpose-specific.

C Country and regional schedules

C1 Application of schedules

Application depends on location, target market, Anemon’s activities, data flows and the law’s scope, not citizenship or interface language alone. More than one regime may apply. Activities requiring a representative, registration, local notice, localisation or transfer procedure are undertaken only after those conditions are met. Mandatory rights in unlisted countries remain protected.

C2 Türkiye

Part B explains purposes and bases under Law No. 6698 (KVKK). Individuals may obtain processing information, learn whether use matches its purpose and identify domestic or foreign recipients; request correction, deletion or destruction where conditions are met and notification to recipients; object to adverse results based solely on automated analysis; and seek compensation for unlawful processing.

Requests follow KVKK and its application rules, including email from the registered address to info@anemoninnovation.com or written delivery to A1’s address. Additional published secure channels may be used. A reasoned response is provided as soon as possible and within thirty days. Prior application to the controller and the Board complaint periods of thirty days after learning the response and, in all cases, sixty days after the application remain applicable.

International transfers require an applicable adequacy decision or safeguards and other statutory conditions. Where Turkish standard contractual clauses are used, notification is made within five business days of signature. Where legal conditions are met, breaches are notified to the Board within seventy-two hours of awareness, and affected individuals as soon as possible under the applicable rule.

C3 European Union and European Economic Area

The GDPR applies when its material and territorial conditions are met. Access, rectification, erasure, restriction, portability, objections to legitimate-interest processing and safeguards against solely automated significant decisions are provided under their legal conditions. Objection to direct marketing is absolute. Requests are normally answered within one month; reasons for any necessary two-month extension are notified within that first month.

Individuals may complain to the competent supervisory authority in the member state of habitual residence, work or the alleged infringement. Required Article 27 representative and Article 37 DPO details are provided through the notice under Schedule 2. Indirect collection follows Article 14’s timing and exceptions.

Transfers outside the EEA require an appropriate adequacy decision or Chapter V safeguards, necessary transfer assessment and supplementary measures. This Agreement does not replace them. Mandatory consumer rules on unfair terms, jurisdiction, digital conformity and withdrawal remain; A11 does not apply to consumers. Any required separate express request for immediate digital delivery, acknowledgment of loss of withdrawal rights and durable-medium confirmation must be obtained separately; general acceptance is insufficient.

C4 United Kingdom

Where applicable, the UK GDPR, Data Protection Act and electronic communications rules apply as amended and in force. Information, access, correction, erasure, restriction, portability, objection and withdrawal rights are provided under their conditions. Response periods and permitted pauses or extensions follow current UK law. Complaints may be made to the ICO.

Required UK representative details are provided under Schedule 2. Restricted transfers require applicable adequacy arrangements, the UK IDTA or appropriate UK Addendum and necessary data-protection assessment. EU clauses alone do not automatically satisfy all UK requirements. Consumer, penalty and enforcement provisions remain subject to mandatory local law.

C5 United States of America

Applicable law is determined by state, business thresholds, data type and individual status. Where the CCPA as amended by the CPRA applies, a B2B relationship does not itself exclude the individual.

Applicable rights include knowledge and access, correction, deletion, a portable copy, opting out of sale or sharing, limits on certain sensitive-data uses and freedom from discrimination for exercising rights. Where sale, sharing or targeted advertising occurs, applicable universal opt-out signals, including GPC, are honoured under local law. Anemon’s policy is not to sell personal data or share it for cross-context behavioural advertising.

For California, actual categories, purposes, sources, recipients and sale/sharing practices for the preceding twelve months are disclosed through collection-time and annual notices under Schedule 2. The ordinary forty-five-day period and lawful extensions apply to verifiable access, deletion and correction requests; shorter obligations, including applicable opt-out handling, are not postponed to that deadline. Authorised-agent requests and other states’ appeal or review rights follow local law. Penalties, liability limits and forum selection cannot override mandatory state rules.

C6 People’s Republic of China

This schedule applies where mainland China’s PIPL applies; it does not cover the separate regimes of Hong Kong, Macao or Taiwan. Clear notice identifies the personal information handler, contact, purposes, methods, categories, retention and rights. Applicable rights to know, decide, restrict or refuse, access or copy, correct and delete are provided.

Consent-based processing requires voluntary informed consent; legally required separate consents are distinct from general acceptance. The overseas recipient’s name and contact, purpose and method, data categories and means of exercising rights are disclosed beforehand, with separate transfer consent where required. Sensitive information and information about children under fourteen attract additional conditions; the platform is not offered for children’s use.

As applicable, a local representative or dedicated entity, impact assessment, security assessment, Chinese standard contract or certification is provided. Current CAC exemptions are assessed for the actual flow; exemption from a transfer procedure does not automatically remove notice and security duties. Flows subject to local storage or important-data restrictions are not routed to general overseas infrastructure before compliance. GDPR clauses alone are not a Chinese transfer mechanism.

C7 Switzerland

Where the FADP applies, identity, purposes, recipients and transfer countries are disclosed. Access, correction, personality protection and conditional data delivery or portability rights are provided. Any required Swiss representative is identified. Transfers follow Swiss adequacy rules, recognised contractual safeguards and necessary adaptations. Individuals may contact the FDPIC and retain judicial remedies.

C8 Canada

Applicable PIPEDA and provincial rules require meaningful consent, reasonable purposes, limited collection and access/correction. Service consequences of withdrawal are explained beforehand. PIPEDA access requests are normally answered within thirty days; extensions require a legal basis. Complaints may be made to the OPC or competent provincial authority.

Overseas processing remains subject to provider contracts and accountability; possible lawful access by foreign authorities is disclosed. Service directed to Québec or other provinces with additional rules must meet local notice, language, assessment and transfer requirements and is provided accordingly.

C9 Brazil

Where the LGPD applies, individuals have applicable rights to confirm processing, access, correct, anonymise/block/delete unnecessary or unlawful data, portability, sharing information, consent-related rights and protections concerning automated decisions. Simple confirmation and access are provided immediately as legally required; comprehensive information for the relevant requests is supplied within fifteen days. Other requests follow their applicable periods.

Required encarregado contact details are provided under Schedule 2. Transfers rely on mechanisms recognised by the LGPD and current ANPD rules; an EU document does not automatically suffice. ANPD and consumer remedies remain available.

C10 Australia

Where the Privacy Act and Australian Privacy Principles apply, Anemon provides clear notice, necessary collection, purpose limits, security, access and correction. Overseas disclosures comply with APP 8 and accountability rules, and reasonably identifiable destination countries are disclosed. Complaints may first be submitted to info@anemoninnovation.com and, where appropriate, escalated to the OAIC. Non-excludable Australian Consumer Law guarantees remain.

C11 Japan

For APPI-covered processing, purposes are specified and disclosed. Access, correction and legally qualified requests to stop use or disclosure are handled. Foreign transfers require prior information and consent unless a valid exception or equivalent-protection arrangement applies. Information on the destination’s protection system and recipient safeguards is supplied. PPC remedies and continuing safeguard obligations remain.

C12 South Korea

Where PIPA applies, categories, purposes, retention, recipients and remedies are disclosed under local rules. Access, correction, deletion and suspension rights are provided subject to applicable conditions. Overseas transfers require a permitted basis and the required notice of recipient, country, timing/method, purpose, retention and consequences of refusal. Local representation and PIPC notifications are provided where required. A single general checkbox does not replace all consents.

C13 Singapore

Applicable PDPA duties include purpose notification, necessary consent or valid exceptions, withdrawal, access/correction, retention limits and security. Business-contact exceptions are not automatically extended to other account or behavioural data. Overseas transfers receive comparable protection. Required DPO public contact details are provided under Schedule 2; complaints may be made to the PDPC.

C14 India

Applicable data-protection and information-technology laws in force apply. The DPDP Act and DPDP Rules 2025 apply according to each provision’s official commencement schedule. As provisions commence, their information, consent, access-to-information, correction/deletion, grievance and nomination rights are provided within their legal scope.

Applicable transitional rules, notice language, child-data and overseas-transfer restrictions are checked before the service is offered. Grievance and required local contact details are provided under Schedule 2. Statutory procedures apply from their respective commencement dates.

C15 United Arab Emirates

The activity’s location and nature determine whether federal personal-data law or a separate regime such as DIFC or ADGM applies. Notice, lawful bases, access/correction/deletion or restriction, security and transfer conditions are met under the relevant regime. Required officer and authority details are provided under Schedule 2. Federal rules are not assumed to apply identically to free zones or exempt sectors.

Schedule 1 Order record and specific acceptances

This schedule specifies mandatory order information and separate acceptance wording. The order is created on paper or in an electronic form satisfying legal requirements, provided to the parties and linked to the Agreement version. Transaction-specific details are determined for each order.

Record Required information
Customer and representation Full name, country, address, registry or tax details; representative’s name, role and authority
Product and content Service type; regulation or content name; exact RegsUP version and file or product identifier
Users and duration Named-user count; allocation method; access, use, re-download and support periods
Price and payment Net product and additional-user prices; currency, taxes and payment schedule
Acceptance and schedules Version 1.1; accepted language; document hash; acceptance time; signature or acceptance record and applicable country schedules

General acceptance: “I accept the order record, Part A of version 1.1 of the RegsUP Platform Use Digital Content Licence and Privacy Agreement, the applicable Part C provisions and schedules. If acting for an organisation, I confirm that I have authority for this transaction.”

Specific user-licence explanation: “I understand that an account belongs to one natural person only; successive use by other people in the same organisation is also account sharing; and transferring protected files to unlicensed people may constitute unauthorised use. User numbers, net additional-user and PDF-user prices, and durations are specified in the order record provided to me.”

Separate signed merchant acceptance of the penalty: “A11 and the calculation of E in A10 have been separately presented to me. I accept the contractual penalty C = E in the circumstances defined in A11, subject to its caps and crediting rules.” This statement is recorded separately with the names, capacities, acceptance date and legally required signatures of the Customer’s and Anemon’s authorised representatives. A record unlinked to the relevant order’s users, unit price and duration, or lacking required form, does not trigger A11. Negotiation that did not actually take place is not deemed to have occurred.

Separate jurisdiction acceptance: “As parties legally eligible to agree jurisdiction, we accept the jurisdiction of the Courts and Enforcement Offices of Ankara for disputes under A16, subject to mandatory exceptions.” Party identities, authorised representatives, date and required signatures are recorded.

Privacy notice delivery: “Part B, the applicable country provisions and the service-specific processing notice have been provided to me.” This is not consent or a waiver of rights. Analytics, marketing, question publication and transfers requiring separate consent are not approved collectively.

Schedule 2 Data processing and information duties

E2.1 Service-specific information

Part B explains general purposes, categories, bases and rights. Where the service requires further disclosure of recipient identity, processing or access country, a definite retention period, transfer safeguard or local contact, Anemon provides clear information in a service-specific notice that can be retained before collection or transfer. Information required upfront is not reduced to information available only on request. Notice version and delivery time are recorded; processing does not begin without the mandatory disclosures and safeguards.

Activity Recipient category and information to be provided
Infrastructure and security AWS hosting and any backup or security providers; data types, primary and backup processing countries, support access and transfer safeguards
Communication and delivery Email and delivery providers; addresses, message and delivery records, processing countries and retention
Optional analytics Google Analytics; contracting entity, technologies, measurement scope, durations, countries and applicable transfer safeguards
Commerce and payment Invoice-based transfer to Anemon’s EUR, USD or TRY account through Türkiye Halk Bankası; the bank is an independent controller; necessary invoice, reconciliation and any accounting-service information
Experts and AI Assigned experts and enabled model providers; accessed content, countries, retention and restrictions on training use
Local contacts Identity and public contact details of representatives, DPOs or grievance contacts required by applicable law

These categories do not mean that every provider receives every Customer’s data. Access is limited to the feature used and necessary information. Provider changes are assessed for purpose and transfers, with required advance notice and consent or another lawful basis.

E2.2 Retention criteria

Data category Starting event and retention-ending criterion
Account and authorisation Starts on account creation; limited to active service, closure and necessary resolution of rights or claims
Questions answers and attachments Starts when the work is created; service completion, valid Customer instructions and necessary legal-defence periods govern
Licence delivery and acceptance evidence Starts with the transaction; limited to the applicable period for proving licence rights and contractual claims; minimum necessary evidence is retained
Invoices and financial records Starts on document issuance or the statutory accounting period; disposal is assessed after mandatory tax and commercial retention expires
Security and technical records Starts with the event; limited to documented risk and incident-investigation needs; routine logs are not retained for a claim-limitation period without justification
Support and communication Starts with receipt; resolution, follow-up and necessary protection of the relevant right govern
Analytics and preferences Starts with permitted measurement or preference recording; deletion or genuine anonymisation follows the disclosed duration and end of purpose

Periods or criteria consider data type, purpose, mandatory retention and the limitation period for an actual relevant claim. Once the purpose ends, data is deleted, destroyed or anonymised under applicable disposal duties. Legal holds cover only relevant records, are documented and end when no longer necessary. Backups have restricted access and a defined secure deletion cycle; valid deletion requests are reapplied after restoration. Requests about rights or retention may be sent to info@anemoninnovation.com.

E2.3 Notice and consent are separate

Providing a service-specific notice does not grant general permission for data sales, marketing, optional analytics, AI training, question publication or international transfers. Every purpose requiring consent is presented separately and consent can be withdrawn; contract acceptance does not replace those choices. Where a country schedule requires it, actual categories and recipients for the preceding twelve months and collection-time disclosures are additionally supplied.