Privacy policy
Last updated: September 24th, 2026
1. Who we are
Kolekt is operated by KOLEKT, registered with the Dutch Chamber of Commerce under number 91328829 of the Chamber of Commerce (KvK) , located at Duinlustweg 48, the Netherlands ("Kolekt", "we", "us"). We are the controller of the personal data described in this policy.
For any question about your personal data, or to claim one of your rights, write to info@kolekt.com.
2. Which services this policy covers
Service | Website | What it does
Kolekt website | kolekt.com | Information about Kolekt, our services, team and contact, sign-up and demo request forms.
Kolekt Certificates | certificates.kolekt.com | A marketplace where companies buy verified waste recovery certificates from waste operators, who document their work with proof documents.
Waste Footprint Calculator | footprint.kolekt.com | Calculates the waste footprint of a person or an organisation and lets you reserve certificates to close it.
Kolekt Simulator | sim.kolekt.com | Models extended producer responsibility (EPR) and waste management costs per country.
The Kolekt mobile app, Pay, Dashboard and admin.kolekt.com have their own privacy notice and are not covered by this policy.
3. What data we collect and why
3.1 In every service
Data
_
_
Why we use it
Legal basis
Your account: name, email address, organisation, country and a password. We store your password in encrypted form, as a one-way hash.
To create your account, let you log in and contact you about it.
Contract
Codes and links we send to confirm your email address or reset your password.
To check that the address is yours.
Contract
Technical data: IP address, browser type and the time of a request.
To keep the service running and secure, and to block abuse such as repeated login attempts.
Legitimate interest
Messages that you send us.
To answer you.
Legitimate interest
We do not sell your data, and we do not use it for advertising.
3.2 Kolekt Certificates Website
Data
Why we use it
Legal basis
Buyers. Orders, amounts, reservations and the certificates issued to you. Card and bank details are entered on Stripe's payment page and never reach us; we keep Stripe's reference to the payment.
To take your order, receive payment and issue your certificate.
Contract; legal obligation (bookkeeping)
The name of your organisation on each certificate you buy.
A certificate is a public claim: anyone with its number or QR code can open it and check who it was issued to.
Contract
Your public buyer page: logo, website and description, and the certificates you choose to publish there.
To show your recovery results publicly. Nothing is published until you switch it on, per certificate, and you can switch it off at any time.
Consent
That you previewed an order: the moment, the material and tonnes, and your organisation and country.
Shown to the operators whose tonnes the preview included, so they can see demand for their material. They do not see your name or email address.
Legitimate interest
A request to see an operator's proof document: your name, email address and organisation.
Shown to that operator, who decides whether to grant access.
Contract
Operators. Company details, a contact person's name, title, email address and phone number, registration, tax and VAT numbers, registered address, bank details, identity and company documents (KYC), site locations, photos and logo.
To verify who you are before you can sell, to pay you, and to present your company to buyers. Your company page, photos and logo are public once you are approved; contact and bank details are never public.
Contract; legal obligation; legitimate interest (preventing fraud)
Proof documents (invoices, weight tickets and similar). They can contain names and details of people at your suppliers and customers.
To verify the tonnes behind every certificate. Buyers and the public only ever see a copy in which prices, bank details and personal names are censored.
Contract; legitimate interest (a certificate must be verifiable)
Page views of a certificate offer, counted per operator.
To show an operator how often its offer was viewed. The viewer is not identified or stored.
Legitimate interest
How you heard about us, which we ask when you register.
To learn which channels bring people to Kolekt.
Legitimate interest
Requests you made in the Waste Footprint Calculator to reserve certificates (see 3.3).
So our certificates team can follow up and, if you wish, open a buyer account for you.
Legitimate interest
3.3 Waste Footprint Calculator
Data
Why we use it
Legal basis
Your answers to the calculator (for example household size and habits, or your organisation's staff, buildings and products) and the resulting footprint.
To calculate your footprint and, with an account, save it.
Contract
Certificate reservations: the gaps you chose, the kilograms and the estimated price.
To pass your request to Kolekt Certificates, which is part of Kolekt (see 3.2).
Contract
A result you share by link.
The result, including any name you typed, is inside the link itself. Anyone you give the link to can read it.
Your choice to share
You can delete your account and everything saved with it yourself, on your profile page.
3.4 Kolekt Simulator
Data
Why we use it
Legal basis
Your organisation's website, the countries you use, your trial time and your subscriptions. Payments are handled by Stripe, which sees your payment details; we do not.
To give you access to the countries you chose and to remind you before a subscription ends.
Contract
The parameters you enter and your saved simulations.
To run and keep your simulations.
Contract
Login events, sessions and pages used, with IP address, browser and an approximate country derived from the IP address on our own server.
To secure accounts, prevent misuse of free trials and understand how the simulator is used.
Legitimate interest
Feedback you send from within the simulator.
To improve the simulator.
Legitimate interest
Usage statistics through Google Analytics.
To understand which parts of the simulator are used. Only with your permission (see the cookie policy).
Consent
Names, roles and public profile links of professionals active in extended producer responsibility, taken from public sources with the help of AI, in the country pages.
To show who the relevant organisations and contacts are in each country. If you are listed and want to be corrected or removed, write to us.
Legitimate interest
3.5 Kolekt website
When you use a form on kolekt.com we receive your name, email address and message, and for a sign-up or demo request also your organisation and country. We use them to answer you (legitimate interest, or steps before a contract). The forms are protected by Google reCAPTCHA, and videos on the website are served by YouTube; see the cookie policy.
4. Automated reading of documents
In Kolekt Certificates, uploaded proof documents are read by an AI model (Google Gemini) to fill in the form for you, to compare the document with what you entered, to point out signs of editing and to find what has to be covered in the copy that buyers see. A Kolekt employee reviews documents before they count. For an operator that has passed an audit, a document that passes every check can be approved without that review; you can always ask us to have a person look at a decision.
5. Who receives your data
We use these service providers. They process data on our instructions only.
Provider
For
Where
Microsoft Azure
Hosting, databases and file storage for Certificates, the Calculator and the Simulator.
Netherlands; backup copies of files in Ireland
Twilio SendGrid
Sending account and order emails. Opens and clicks are not tracked.
United States
Google (Gemini API)
Reading proof documents in Certificates (section 4).
United States
Google (Analytics, reCAPTCHA, Fonts)
Statistics in the Simulator (with consent), protection of forms, and the font used on the sites.
United States
Squarespace
Hosting kolekt.com and its forms.
United States
Stripe (Certificates and Simulator) handles payments and are responsible for the payment data you give them under their own privacy policies. Paddle sells the Simulator subscription to you as reseller.
Independent audit firms that audit an operator for Kolekt Certificates see that operator's company details and its proof documents as uploaded.
Other users see what is described in section 3: for example, the public sees issued certificates and approved operator pages, and operators see the organisation and country behind an order preview. We share data with authorities only when the law requires it.
6. Transfers outside the EEA
Some providers above are based in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
7. How long we keep it
Periods marked [proposed] still have to be confirmed.
Data
Kept for
Accounts
As long as your account exists. When you delete it, or ask us to, it is removed within 30 days, except for what is listed below.
Orders, payments and invoices
7 years, as Dutch tax law requires.
Issued certificates, and the proof documents and operator details behind them
As long as the certificate can be checked, and at least 7 years [proposed]. A certificate is a public claim and must stay verifiable.
Operator identity and company documents (KYC)
While you are an operator, and 5 years after [proposed].
Security and usage logs
12 months [proposed].
Simulator: email address and trial use after you close your account
Kept to prevent a free trial from being used twice [proposed: 2 years].
Messages to us
2 years after the conversation ends [proposed].
8. Your rights
You have the right to:
see the personal data we hold about you and get a copy of it;
have it corrected, or deleted when we no longer need it;
have its use restricted, or receive it in a format you can take elsewhere;
object to what we do on the basis of legitimate interest;
withdraw a consent at any time, without affecting what happened before.
Write to info@kolekt.com. We answer within one month. If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
9. Security
Connections are encrypted, passwords are stored only as one-way hashes, files are kept in private storage that is not publicly reachable, and proof documents shown to buyers are rebuilt from images, so covered details cannot be recovered from them.
10. Children
Our services are not meant for anyone under 16, and we do not knowingly collect their data.
11. Changes to this policy
When we change this policy we update the date at the top. If a change affects you materially, we tell you by email or in the service before it takes effect.