Terms of Service

1. The Service

Montipass (the “Service”) is a digital loyalty platform provided by Monti Labs Ltd Şti (“we”, “us”, “our”). It allows businesses to create and manage digital stamp cards that their customers keep in Apple Wallet and Google Wallet.

2. Who uses the Service

The Service has two kinds of users:

• Business account holders: people who have set up a loyalty programme and use the business dashboard.
• Customers: individuals who join a business’s loyalty programme and keep its digital card in their phone wallet.

3. Accepting these terms

By accepting these terms, you are granted the right to use the Service. If you do not agree with any part of these terms, please do not use the Service.

4. Your account

Business account holders are responsible for keeping their account confidential and secure. All actions taken within the Service through an account are the responsibility of the account holder. You can change your account details at any time.

5. Current limitations of the Service

At this stage, the Service has the following limitations:

• Points and tier programmes are not offered.
• APIs and integrations are in beta.

6. Fees

The Service is free of charge during the pilot period. When the product becomes generally available, fees will apply as stated on the pricing page.

7. Data protection and privacy

For details of how your personal data is processed, please read our Privacy Policy.

8. Data processing terms

This section applies when a business uses the Service to run a loyalty programme for its customers. For that customer data, the business is the controller and Monti Labs Ltd Şti is its processor, within the meaning of Article 28 of the GDPR and the UK GDPR. By accepting these terms the business also enters into these data processing terms.

• Subject and duration: we process customer data (names, optional email addresses, visit and reward history, wallet card registrations and, where enabled, location permissions) only to provide the Service, for as long as the business’s account is open.
• Instructions: we process the data only on the business’s documented instructions, which are these terms and the settings and actions the business makes in its dashboard, unless the law requires otherwise. We will tell the business if we believe an instruction breaks data protection law.
• Confidentiality: everyone we authorise to process the data is bound by confidentiality.
• Security: we apply the measures described in our Privacy Policy and on our infrastructure page, including encryption in transit, access control at database level and daily backups stored separately from the server.
• Sub-processors: the business authorises the sub-processors listed in the Privacy Policy. We will announce any new sub-processor on that page at least 30 days before it starts processing customer data; the business may object, and if we cannot resolve the objection, it may close its account. We impose data protection obligations on each sub-processor equivalent to these.
• Assistance: we help the business respond to requests from its customers to exercise their rights, and with security, breach notification and data protection impact assessments, taking into account the information available to us.
• Personal data breaches: we notify the business without undue delay after becoming aware of a breach affecting its customer data.
• End of the service: when the account is closed, we delete the customer data, or return it first if the business asks before closing, unless the law requires us to keep it. Copies remaining in backups are deleted when those backups expire, within 30 days.
• Information and audits: we make available the information needed to demonstrate compliance with this section and allow for reasonable audits, on reasonable notice.
• International transfers: the Service is hosted in Türkiye. For customer data transferred from the European Economic Area, the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into these terms, with the business as data exporter and Monti Labs Ltd Şti as data importer. For data from the United Kingdom, the UK International Data Transfer Addendum applies in addition.

9. Copyright and intellectual property

All content, software and design of the Service belong to Monti Labs Ltd Şti or its licensors. You may not reproduce any part of the Service without permission.

10. Prohibited use

You may not use the Service to:

• carry out unlawful or illegal activities;
• harm another person;
• attempt to gain unauthorised access to the Service;
• interfere with, disrupt or slow down the Service;
• distribute malicious software.

11. Limitation of liability

The Service is provided “as is”. Monti Labs Ltd Şti does not guarantee that the Service will be uninterrupted, error-free or fit for a particular purpose. Nothing in these terms limits any rights you have under mandatory consumer protection law that applies to you.

12. Termination

We reserve the right to suspend or close accounts that are used in breach of these terms. If your account is closed, you will lose access to the related data.

13. Changes to these terms

We may update these terms at any time. We will notify you of significant changes. Continuing to use the Service after an update means you accept the new terms.

14. Governing law

These terms are governed by the laws of the Republic of Türkiye. Disputes will be resolved by the courts of Türkiye.

15. Contact

If you have questions about these terms or the Service, please get in touch through our contact page.