Privacy policy
Last updated: October 1st, 2026
- Who we are
- Which services this policy covers
- What data we collect and why
- Automated reading of documents
- Who receives your data
- Transfers outside the EEA
- How long we keep it
- Your rights
- Security
- Children
- Changes to this policy
1. Who we are
Kolekt is operated by KOLEKT B.V., registered with the Dutch Chamber of Commerce under number 91328829, located at Duinlustweg 48, 2051 AB Overveen, the Netherlands ("Kolekt", "we", "us"). We are the controller of the personal data described in this policy.
For any question about your personal data, or to use one of your rights, write to info @ kolekt (.com).
2. Which services this policy covers
| Service | Address | What it does |
|---|---|---|
| Kolekt website | kolekt.com | Information about Kolekt and contact, sign-up and demo request forms. |
| Kolekt App, Pay and Dashboard | operator.kolekt.com & App stores | For tracing materials and payments by waste operators. |
| Kolekt Accounts | accounts.kolekt.com | Is the central user account management system for Kolekt’s applications |
| Kolekt Certificates | certificates.kolekt.com | A marketplace where companies buy verified waste recovery certificates from waste operators, who document their work with proof documents. |
| Kolekt Simulator | sim.kolekt.com | Models extended producer responsibility (EPR) and waste management costs per country. |
| EPR Wizard | epr.kolekt.com | Helps design Extended Producer Responsibility EPR regulations. |
| Waste Footprint Calculator | footprint.kolekt.com | Calculates the waste footprint of a person or an organisation and lets you reserve certificates to close it. |
| Investment Optimiser | invest.kolekt.com | Calculates the investment budget needed, and optimal investment options for national waste streams |
3. What data we collect and why
3.1 In every service
| Data | Why we use it | Legal basis |
|---|---|---|
| Your account: name, email address, organisation, country and a password, which we only store as a one-way hash. | To create your account, let you log in and contact you about it. | Contract |
| Codes and links we send to confirm your email address or reset your password. | To check that the address is yours. | Contract |
| Technical data: IP address, browser type and the time of a request. | To keep the service running and secure, and to block abuse such as repeated login attempts. | Legitimate interest |
| Messages you send us. | To answer you. | Legitimate interest |
We do not sell your data, and we do not use it for advertising.
3.2 Kolekt Certificates
| Data | Why we use it | Legal basis |
|---|---|---|
| Buyers. Orders, amounts, reservations and the certificates issued to you. Card and bank details are entered on Stripe's payment page and never reach us; we keep Stripe's reference to the payment. | To take your order, receive payment and issue your certificate. | Contract; legal obligation (bookkeeping) |
| The name of your organisation on each certificate you buy. | A certificate is a public claim: anyone with its number or QR code can open it and check who it was issued to. | Contract |
| Your public buyer page: logo, website and description, and the certificates you choose to publish there. | To show your recovery results publicly. Nothing is published until you switch it on, per certificate, and you can switch it off at any time. | Consent |
| That you previewed an order: the moment, the material and tonnes, and your organisation and country. | Shown to the operators whose tonnes the preview included, so they can see demand for their material. They do not see your name or email address. | Legitimate interest |
| A request to see an operator's proof document: your name, email address and organisation. | Shown to that operator, who decides whether to grant access. | Contract |
| Operators. Company details, a contact person's name, title, email address and phone number, registration, tax and VAT numbers, registered address, bank details, identity and company documents (KYC), site locations, photos and logo. | To verify who you are before you can sell, to pay you, and to present your company to buyers. Your company page, photos, logo and the sites you place on the map (their name, type and position) are public once you are approved; contact and bank details are never public. | Contract; legal obligation; legitimate interest (preventing fraud) |
| Proof documents (invoices, weight tickets and similar). They can contain names and details of people at your suppliers and customers. | To verify the tonnes behind every certificate. Buyers and the public only ever see a copy in which prices, bank details and personal names are covered. | Contract; legitimate interest (a certificate must be verifiable) |
| People at the suppliers and customers of our operators. The name, job title, email address, phone number and address of a contact person, as printed on the proof documents operators upload. We get them from those documents, not from you. | To record who an operator trades with, to check what the operator entered against the document, and to invite that company to Kolekt Certificates. If you do not want to hear from us, reply to the invitation or write to info@kolekt.com and we will not contact you again. | Legitimate interest |
| Page views of a certificate offer, counted per operator. | To show an operator how often its offer was viewed. The viewer is not identified or stored. | Legitimate interest |
| How you heard about us, which we ask when you register. | To learn which channels bring people to Kolekt. | Legitimate interest |
| Requests you made in the Waste Footprint Calculator to reserve certificates (see 3.3). | So our certificates team can follow up and, if you wish, open a buyer account for you. | Legitimate interest |
3.3 Waste Footprint Calculator
| Data | Why we use it | Legal basis |
|---|---|---|
| Your answers to the calculator (for example household size and habits, or your organisation's staff, buildings and products) and the resulting footprint. | To calculate your footprint and, with an account, save it. | Contract |
| Certificate reservations: the gaps you chose, the kilograms and the estimated price. | To pass your request to Kolekt Certificates, which is part of Kolekt (see 3.2). | Contract |
| A result you share by link. | The result, including any name you typed, is inside the link itself. Anyone you give the link to can read it. | Your choice to share |
You can delete your account and everything saved with it yourself, on your profile page.
3.4 EPR Wizard
| Data | Why we use it | Legal basis |
|---|---|---|
| Your choices (of the 100 EPR options), your country, name and organisation and the resulting scenario and EPR Regulation. | To create a tailored EPR Regulation scenario, with an account, save it. | Contract |
You can delete your account and everything saved with it yourself, on your profile page.
3.5 Investment Optimiser
| Data | Why we use it | Legal basis |
|---|---|---|
| Your choice of country and optimisation choices, your name and the resulting scenario. | To create a tailored waste infrastructure investment scenario, with an account, save it. | Contract |
You can delete your account and everything saved with it yourself, on your profile page.
3.6 Kolekt Simulator
| Data | Why we use it | Legal basis |
|---|---|---|
| Your organisation's website, the countries you use, your trial time and your subscriptions. Payments are handled by Paddle, which sees your payment details; we do not. | To give you access to the countries you chose and to remind you before a subscription ends. | Contract |
| The parameters you enter and your saved simulations. | To run and keep your simulations. | Contract |
| Login events, sessions and pages used, with IP address, browser and an approximate country derived from the IP address on our own server. | To secure accounts, prevent misuse of free trials and understand how the simulator is used. | Legitimate interest |
| Feedback you send from within the simulator. | To improve the simulator. | Legitimate interest |
| Usage statistics through Google Analytics. | To understand which parts of the simulator are used. Only with your permission (see the cookie policy). | Consent |
| Names, roles and public profile links of professionals active in extended producer responsibility, taken from public sources with the help of AI, in the country pages. | To show who the relevant organisations and contacts are in each country. If you are listed and want to be corrected or removed, write to us. | Legitimate interest |
3.7 Kolekt website
When you use a form on kolekt.com we receive your name, email address and message, and for a sign-up or demo request also your organisation and country. We use them to answer you (legitimate interest, or steps before a contract). The forms are protected by Google reCAPTCHA, and videos on the website are served by YouTube; see the cookie policy.
3.8 Kolekt App, Pay and Dashboard
| Data | Why we use it | Legal basis |
|---|---|---|
| Kolekt App: Your name, gender, phone number, organisation, GPS location, country, face profile photo, materials that you sell, its weight, price and your buyer or seller | To be able to register the details of a material purchase or sale, with an account, save it. | Contract |
| Kolekt Pay: Your name, gender, phone number, organisation, GPS location, country, face profile photo, the amount paid to you as a seller or by you as a cashier | To be able to confirm that a payment for a sale actually took place, with an account, save it. | Contract |
| Kolekt Dashboard: Your Organisation’s operator name, administrator name and email address, country and team members | To be able to track material and payment transactions associated with the operator, with an account, save it. | Contract |
You can delete your account and everything saved with it yourself, on your profile page.
4. Automated reading of documents
In Kolekt Certificates, uploaded proof documents are read by an AI model (Google Gemini) to fill in the form for you, to compare the document with what you entered, to point out signs of editing and to find what has to be covered in the copy that buyers see. A Kolekt employee reviews documents before they count. For an operator that has passed an audit, a document that passes every check can be approved without that review; you can always ask us to have a person look at a decision.
The same reading also takes from each document the details of the supplier or customer it names - the company and its contact person, as described in section 3.2 - and the prices and quantities on it. The prices are visible only to Kolekt administrators.
5. Who receives your data
We use these service providers. They process data on our instructions only.
| Provider | For | Where |
|---|---|---|
| Microsoft Azure | Hosting, databases and file storage for Certificates, the Calculator and the Simulator. | Netherlands; backup copies of files in Ireland |
| Twilio SendGrid | Sending account and order emails. Opens and clicks are not tracked. | United States |
| Google (Gemini API) | Reading proof documents in Certificates (section 4). | |
| Google (Analytics, reCAPTCHA, Fonts) | Statistics in the Simulator (with consent), protection of forms, and the font used on the sites. | United States |
| OpenStreetMap Foundation | The map tiles on the operator pages of Certificates and the maps in the Simulator. Your browser loads them directly, so the Foundation receives your IP address. | United Kingdom |
| Squarespace | Hosting kolekt.com and its forms. | United States |
Stripe (Certificates) and Paddle (Simulator) handle payments and are responsible for the payment data you give them under their own privacy policies. Paddle sells the Simulator subscription to you as reseller.
Independent audit firms that audit an operator for Kolekt Certificates see that operator's company details and its proof documents as uploaded.
Other users see what is described in section 3: for example, the public sees issued certificates and approved operator pages, and operators see the organisation and country behind an order preview. We share data with authorities only when the law requires it.
6. Transfers outside the EEA
Some providers above are based in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Accounts | As long as your account exists. When you delete it, or ask us to, it is removed within 30 days, except for what is listed below. |
| Orders, payments and invoices | 7 years, as Dutch tax law requires. |
| Issued certificates, and the proof documents and operator details behind them | As long as the certificate can be checked, and at least 7 years. A certificate is a public claim and must stay verifiable. |
| Operator identity and company documents (KYC) | While you are an operator, and 5 years after. |
| Security and usage logs | 12 months. |
| Simulator: email address and trial use after you close your account | Kept to prevent a free trial from being used twice for 2 years. |
| Messages to us | 2 years after the conversation ends. |
8. Your rights
You have the right to:
- see the personal data we hold about you and get a copy of it;
- have it corrected, or deleted when we no longer need it;
- have its use restricted, or receive it in a format you can take elsewhere;
- object to what we do on the basis of legitimate interest;
- withdraw a consent at any time, without affecting what happened before.
Write to info@kolekt.com. We answer within one month. If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
9. Security
Connections are encrypted, passwords are stored only as one-way hashes, files are kept in private storage that is not publicly reachable, and proof documents shown to buyers are rebuilt from images, so covered details cannot be recovered from them.
10. Children
Our services are not meant for anyone under 16, and we do not knowingly collect their data.
11. Changes to this policy
When we change this policy we update the date at the top. If a change affects you materially, we tell you by email or in the service before it takes effect.