Acceptable Use Policy

This Acceptable Use Policy (the "Policy") sets out how the EnaFeedback software and its related services (the "Service") may be used. The Policy forms an integral part of the End User License Agreement.

This English text is a translation. In case of conflict, the Turkish version prevails.

1. Who this applies toCopy Anchor Link

The Policy applies to:

• the organization using the Service (the "Customer")
• the Customer's admin panel users and field staff ("Users")
• people who use the Service's visitor interface through a QR code, NFC tag or display ("Visitors")

The Customer is responsible for Users' compliance with this Policy.

2. Unlawful and harmful contentCopy Anchor Link

The following may not be uploaded to the Service as feedback, comments, attachments, content pages, surveys, poster templates or notification text:

• content that violates Turkish law or the law of the place where it is used
• content that contains insults, threats, harassment, hate speech or discrimination
• any content relating to the abuse of children
• content that infringes third parties' intellectual property rights, personality rights or privacy
• malware, phishing or fraudulent content and links

3. Personal dataCopy Anchor Link

3.1. The Customer must have a legal basis under Turkish Personal Data Protection Law No. 6698 for the personal data it collects with the Service, and must inform data subjects.

3.2. The Customer must set up forms and surveys so that they do not collect more data than needed. In particular:

• Without a legal basis, no question or prompt may be designed to collect special categories of personal data (health, religion, ethnic origin, biometric data, etc.) through free-text fields, survey questions or attachments.
• Visitor forms should remind visitors, in a suitable place, not to enter information such as health details or national ID numbers.
• National ID numbers, bank or card details and passwords may not be requested through the Service.

3.3. Personal data in the Service may not be shown to unauthorized people, used outside the Service's purpose, or combined with other sources to profile data subjects.

3.4. The staff feedback module is not a human resources or whistleblowing system and should not be used as one.

4. Identity and authorizationCopy Anchor Link

• No one may act as if on behalf of another person, organization or ENA Innovation.
• Personnel codes, quick sign-in keys (passkeys) and admin panel accounts may not be shared.
• Cleaning logs, control logs or check-in/check-out records may not be created on behalf of another staff member or without actually being at the location.
• Users should be given only the roles they need for their work.

5. QR codes, NFC tags and postersCopy Anchor Link

• QR posters, NFC tags and live displays may be placed only where the Customer has the right to use the space.
• Placing stickers over another organization's QR codes, or altering codes in a way that misleads visitors, is prohibited.
• Posters and content pages may not link to pages that ask visitors for payment details, passwords or identity data.
• External link tiles should point only to trustworthy addresses for which the Customer takes responsibility.
• Anyone who notices a QR code or NFC tag being misused can report it to the Customer or to support@enainnovation.com.

6. Notifications and communicationsCopy Anchor Link

• The email and SMS channels are for Service-related notifications such as ticket status, personnel codes and alerts.
• These channels may not be used to send commercial electronic messages (advertising, campaigns, promotions) without the consent required by Turkish Law No. 6563 on the Regulation of Electronic Commerce and related legislation.
• Contact details left by visitors may be used only to communicate about their feedback.

7. Abuse of system resourcesCopy Anchor Link

• No one may try to exceed the Service's rate limits or bypass them with automated tools.
• Visitor forms and hygiene ratings may not be filled with fake, automated or bulk submissions, and reports may not be artificially manipulated.
• Load testing, denial-of-service (DoS) testing and scraping of the Service are prohibited.
• AI features may not be used to process text unrelated to the Service's purpose.

8. Security testingCopy Anchor Link

Anyone wishing to research security vulnerabilities may act only within the scope and rules of the Responsible Disclosure Policy. Scans, penetration tests and unauthorized access attempts outside that policy are prohibited. If the Customer wants security testing of its own environment, it must first obtain written permission via support@enainnovation.com.

9. Reporting violationsCopy Anchor Link

If you believe this Policy has been violated:

Requests about a feedback record belonging to an organization should first be sent to that organization. ENA Innovation forwards such requests it receives to the organization concerned.

10. EnforcementCopy Anchor Link

10.1. Depending on the severity of the violation, ENA Innovation may:

• warn the Customer and ask for the violation to be remedied
• remove or block access to the content concerned, together with the Customer or on its instruction
• temporarily stop the use of the account, feature or location concerned
• suspend access to the Service
• terminate the agreement under the End User License Agreement

10.2. If the security of the Service, other customers or third parties is under serious and imminent threat, ENA Innovation may act first and inform the Customer afterwards.

10.3. For content in Customer Data, ENA Innovation acts on the Customer's instructions unless the law requires otherwise. Decisions of competent authorities are reserved.

10.4. ENA Innovation has no obligation to review content in the Service in advance.

11. ChangesCopy Anchor Link

ENA Innovation may update this Policy. Material changes are notified to the Customer at least 30 days before they take effect.

This Policy is published in Turkish and English. In case of conflict, the Turkish version prevails.