service agreement

MEMBERSHIP AND SAAS SERVICE AGREEMENT

Version: 1.0

Published: 01.01.2016

Last updated: 01.01.2016

1. Parties

This Membership and SaaS Service Agreement (the "Agreement" or the "Service Agreement") is made between:

Sanalogi Bilişim Sanayi ve Ticaret A.Ş.

Address: YTÜ İkitelli Teknopark No:1 Kat:2 Ofis No:16, 34220 Başakşehir / Istanbul / Türkiye
Phone: +90 850 557 76 54
Tax office and number: İkitelli, 7430431852
MERSİS No: 0743043185200018
Trade Registry No: 18296-5
Email: [email protected]
Website: www.turasistan.com

("Sanalogi" or the "Service Provider"), and

the natural or legal person who registers with Turasistan, starts a free trial, starts a subscription, purchases a package or module, or creates an account on behalf of a company, or, where the account is created on behalf of a company, that company (the "Customer"). Sanalogi and the Customer are together referred to as the "Parties".

2. Subject

This Agreement sets out the terms under which Sanalogi provides the Customer with online access to Turasistan, the SaaS-based tourism software developed and operated by Sanalogi.

Turasistan is a software platform used by travel agencies, Hajj and Umrah agencies, tour operators and related companies for operational work such as customer and traveler registration, tour and operations management, preparing and tracking visa application data, accounting, current account tracking, tracking of collection and payment records, document management, reporting, communication by SMS and email, APIs and integrations.

Sanalogi is solely a software development company that provides software as a service. Sanalogi is not a travel agency; it does not sell tours, tickets, accommodation, transfers, Hajj, Umrah or visa services, does not issue or approve visas, and is not an authorized representative or partner of any public authority, Nusuk, Diyanet, bank or payment institution.

The Customer alone is party to and responsible for all contracts, sales, pricing, cancellations and refunds between the Customer and its own customers and travelers; Sanalogi is not a party to these relationships and makes no commitment to travelers. The accounting, current account and collection modules only help the Customer keep its own records; Sanalogi does not collect, hold or transfer payments on behalf of the Customer or from the Customer's customers. Online payments made through Turizm Web or by payment link go directly to the Customer's account under the Customer's own virtual POS agreement with its bank or payment institution.

The Customer is the operator of its own website built with Turizm Web and the seller in all sales made on that website. The Customer bears all obligations under consumer, e-commerce and tourism law, including content, prices, pre-contractual information, distance and package tour contracts, display of its agency license details, and cookie and privacy notices.

3. Definitions

Turasistan: The SaaS-based tourism software provided by Sanalogi, together with Turasistan App, Turasistan Reader (mobile passport reader), Trobot and API services, and Turizm Web where the Customer purchases it separately.
SaaS: Software provided over the internet on a subscription basis.
Customer: The natural or legal person business that uses Turasistan.
Sub-user: Staff, employees, representatives or consultants authorized by the Customer under its Turasistan account.
Trial Period: The 14-day free use offered for introduction and evaluation before a paid subscription.
Subscription: The Customer's use of Turasistan for a defined period in return for a fee.
Package / Module: A package, feature, function or usage right offered separately within Turasistan (for example, the Visa Package and the Full Package).
API: The technical interfaces that allow data exchange between Turasistan and third-party systems.
Third-Party Services: Systems not owned by Sanalogi, such as Diyanet, Nusuk, Saudi authorities and visa systems, airlines, hotels, ticket providers, SMS and email providers, banks and payment institutions, and e-invoicing and accounting software.
Personal Data: Any information relating to an identified or identifiable natural person.
Data Controller: The party that determines the purposes and means of processing personal data.
Data Processor: The party that processes personal data on behalf of the data controller, based on the authority it grants.

4. Acceptance

By registering with Turasistan, starting a free trial or subscription, making a payment, purchasing a package or module, or using the system, the Customer declares that it has read, understood and accepted this Agreement. The Agreement is concluded electronically and becomes binding upon the Customer's electronic acceptance. The Parties agree that electronic records constitute evidence under Article 193 of the Turkish Code of Civil Procedure No. 6100.

The person acting on behalf of the Customer represents that they are authorized to represent and bind the Customer or have been authorized by it. If this representation is untrue, the person acting is liable for the resulting loss under Article 47 of the Turkish Code of Obligations No. 6098.

The Customer acknowledges that it uses Turasistan within its commercial or professional activities. This Agreement is therefore not a consumer transaction under Turkish Consumer Protection Law No. 6502. The Customer is responsible for obtaining the certificates, permits and licenses its activities require.

5. Scope of the service

The services provided under Turasistan vary according to the package, module or usage right the Customer purchases. In general, they may cover:

Customer and traveler registration, passport and ID reading
Tour, Hajj, Umrah, hotel, transfer and operations management
Accounting, current account tracking, tracking of collection and payment records
Document, passport, visa and paperwork management
SMS, email and other communication tools
Transfer of traveler data, on the Customer's instructions and using the Customer's own accounts, to the Diyanet, Nusuk (Mutamer pool) and Saudi tourist visa systems with Trobot, and retrieval of visa outputs from MOFA
API and integration services
Reporting, user management, authorization and logs

Sanalogi may update the scope of the service for technical, commercial, security, regulatory or operational reasons.

6. Free trial

Sanalogi may offer new Customers a 14-day free trial to get to know Turasistan; no credit card is required. The trial does not grant a continuing right of use. Its scope, features and access rights are determined by Sanalogi.

If the Customer does not move to a paid subscription at the end of the trial, Sanalogi may close, restrict or suspend the account. Sanalogi does not guarantee that data entered during the trial will be kept or fully transferred to a paid account.

7. Paid subscription and use

The Customer may use Turasistan by starting a paid subscription after the trial or directly. Subscriptions are offered on an annual basis; Sanalogi may also set other periods. Current packages, user numbers and prices are listed on the Pricing page at www.turasistan.com.

A subscription renews at the end of each period unless it is cancelled. The Customer may cancel a subscription it does not want renewed by emailing [email protected] at least 15 days before the renewal date. Renewal is at the list price current on the renewal date. Sanalogi notifies the Customer of any price change at least 30 days before the renewal date; if the Customer does not accept the new price, it may cancel the subscription as set out in this article.

The Customer may use the service only within the package, module, number of users and scope of use it has purchased. Using features that have not been purchased, unlocking them by technical means, gaining unauthorized access or exceeding license limits is prohibited.

8. Payment and invoicing

The Customer must pay the fees for the subscriptions, packages, modules, API, SMS, support, integrations or other services it purchases on time. Payments are made in advance for the subscription period by bank transfer, EFT or credit card; card payments are collected through a payment institution.

Sanalogi issues invoices in accordance with applicable legislation. Unless stated otherwise, taxes, duties, bank commissions, payment institution fees, exchange rate differences and similar costs are borne by the Customer.

9. Late payment and suspension

The fee for each subscription period, including on renewal, is due on the due date stated on the invoice. Sanalogi may grant additional time for accounts whose subscription has expired or whose payment has not been made. If the Customer does not pay within 7 days after the due date, Sanalogi may suspend the account, restrict access or stop the service.

During suspension, the Customer's access to its data may be restricted. The Customer is responsible for taking the backups needed to avoid data loss during this period. Sanalogi is not obliged to reactivate the service until payment is made.

10. Cancellation and refunds

The Customer may request a refund by writing to [email protected] within 14 days of first starting a paid subscription to Turasistan. In that case, the full subscription fee is refunded and the subscription ends. The right to a refund applies only to the first subscription purchase; subscription fees are not refunded on renewal or after 14 days. Details are set out on the Cancellation and Refund Policy page.

11. Data retention

This article applies to data the Customer enters into Turasistan or that is processed on the Customer's behalf ("Customer Data"). The contract, invoice, payment, log and correspondence records that Sanalogi keeps for its own activities are kept for the periods required by the applicable legislation.

Customer Data is kept for no more than 1 year after the Agreement ends for any reason (for a free trial that does not move to a paid subscription, after the trial ends). On the Customer's written request, Customer Data is deleted before this period ends. At the end of the period, Customer Data is deleted from live systems, destroyed or anonymized; copies in backups are deleted within the backup cycle. Data that must be kept by law or under an order of a court or administrative authority is not subject to this limit.

The Customer must export its data and take the necessary backups before the Agreement ends.

12. Sub-users

The Customer may create staff, employee, representative or authorized user accounts under its own account. The Customer is responsible for all actions, access, viewing, data changes, exports and deletions carried out by its Sub-users.

The Customer must give Sub-users only the permissions they need for their work. Sub-users may not share their usernames and passwords, let third parties use them or cause unauthorized access.

13. User account and security

The Customer is responsible for the accuracy, currency and security of its account information. The Customer must use strong passwords, keep them confidential, prevent unauthorized access and notify Sanalogi immediately of any suspicious activity. Unless proven otherwise, all actions carried out through the Customer's account are deemed to have been carried out by the Customer.

14. Personal data and KVKK

14.1. The Customer confirms that it has obtained all personal data it uploads to Turasistan lawfully, has informed the data subjects as required and has obtained their explicit consent where necessary. The Customer is responsible for fulfilling its obligations as data controller, including VERBİS registration. The Customer must provide its own privacy notice to travelers who will use Turasistan Reader and to visitors of its website built with Turizm Web before their data is collected.

14.2. For personal data of customers, travelers, staff, agencies, suppliers and other third parties entered into the system by the Customer, or collected through Turasistan Reader, Turizm Web and Trobot or received from third-party systems on the Customer's instructions, the Customer is the data controller and Sanalogi is the data processor acting on the Customer's instructions. Sanalogi is the data controller for the subscription, billing, support, communication, log and security data it processes for its own activities.

14.3. As data processor, Sanalogi:

Processes data only on the Customer's instructions and within the scope of this Agreement.
Takes the technical and administrative measures required under Article 12 of KVKK.
Ensures that its staff with access to the data are bound by confidentiality obligations.
Notifies the Customer within 24 hours of becoming aware of a personal data breach.
May work with hosting and similar sub-processors to provide the service. It notifies the Customer at least 30 days before adding or changing a sub-processor, and the Customer may object on documented data protection grounds.
Allows the Customer to request an audit once a year with at least 15 days' notice, subject to confidentiality obligations and without access to other customers' data, primarily by documents and questionnaire; the costs of on-site audits are borne by the Customer.

14.4. Some of Sanalogi's service providers, such as server and email providers, are located outside Türkiye. Transfers to these providers rely on one of the transfer mechanisms under Article 9 of KVKK (for example, a standard contract notified to the Personal Data Protection Authority). Transfers the Customer makes through Turasistan to systems abroad (for example, Nusuk and Saudi visa systems) are the Customer's responsibility.

14.5. Data processed for Hajj and Umrah may indirectly reveal a person's religious beliefs. Where uploaded by the Customer, documents such as vaccination cards or health reports contain health data; the facial image read from the passport chip and the passport photo may be biometric data where they are processed by technical means for identification. These are special category personal data. As data controller, the Customer is responsible for relying on a processing condition under Article 6 of KVKK and for informing data subjects. As data processor, Sanalogi applies technical and administrative measures for this data, taking into account the Personal Data Protection Board's adequate measures for special category personal data. The Customer will not upload special category personal data that the service does not require.

14.6. Further information on personal data is set out in the Privacy Notice and the Privacy Policy.

15. Requests from public authorities and mandatory data sharing

Sanalogi may share information, documents, records, logs or data to the extent required by law when requested by courts, prosecutors, law enforcement, administrative or regulatory authorities, or other legally authorized bodies. Unless prohibited by law, Sanalogi notifies the Customer of such requests concerning Customer Data.

The Customer may use Turasistan to transfer data about its own customers and travelers, using its own accounts, to Diyanet, Nusuk, Saudi authorities or similar systems. These transfers are made on the Customer's instructions; Sanalogi does not establish any data-sharing relationship with these bodies on the Customer's behalf. The Customer is responsible for the accuracy and lawfulness of the data transferred, the conditions for transfers abroad and its authority to make the transfers.

16. Third-party services and integrations

Some Turasistan functions work in connection with third-party systems. These may include Diyanet, Nusuk, Saudi systems, SMS operators, email providers, banks and payment institutions, accounting and e-invoicing software, airlines, hotels and similar services. These systems are not owned by Sanalogi; Sanalogi is not their owner, operator or representative and only provides a technical connection to them. The Customer is responsible for the accounts and agreements needed to use these services.

Sanalogi does not guarantee that third-party systems will work without interruption or error or remain continuously available. Sanalogi is not liable for losses arising from maintenance, outages, quotas, restrictions, API changes, access blocks, data errors, delays or service suspensions in third-party systems.

The Customer enters the usernames, passwords, API keys and similar credentials for Diyanet, Nusuk, MOFA and other Saudi systems, banks and other third-party systems into Turasistan in its own name and under its own responsibility, and authorizes Sanalogi to use them solely to carry out transactions the Customer initiates. The Customer is responsible for complying with these systems' terms of use and their automation and access rules; Sanalogi is not liable if a third party restricts, suspends or closes the Customer's account.

The approval, refusal, timing, quotas and fees of visa, Nusuk, Diyanet and other applications, and the content of documents and outputs issued by authorities, are solely at the discretion of those authorities; Sanalogi gives no guarantee of any outcome or timing. Official fees, charges and penalties are paid by the Customer directly to the relevant body. Sanalogi's technical connection to these systems does not mean that it has any official authorization, partnership or agency relationship with them.

17. API and integration use

The Customer may use API services only if it has been separately authorized or has purchased the relevant API package. The Customer is responsible for keeping its API keys secure.

Sharing the API without permission, letting third parties use it commercially, sending excessive requests, exceeding request limits, using it in a way that threatens system security, or reverse engineering it is prohibited. The technical rules for API use are set out in the Turasistan API documentation.

18. Prohibited uses

The Customer and its Sub-users may not:

Use Turasistan for unlawful purposes
Enter false, misleading or unlawful data
Upload other people's personal data to the system without authorization
Carry out spam, unsolicited messaging, bulk messaging or fraud
Copy, reproduce or reverse engineer the software
Attempt to gain unauthorized access to the API, database or system resources
Transfer the license, account or user permissions to third parties
Damage Sanalogi's brand, commercial reputation or system security
Direct bots, malware or attack tools at the system
Carry out activities that prevent other users from receiving the service

If these terms are breached, Sanalogi may suspend or close the account and take legal action.

The Customer is the sender of SMS and email messages sent through Turasistan and is responsible for their content, recipients' consent and compliance with Law No. 6563 on the Regulation of Electronic Commerce and the rules on commercial electronic messages.

19. Intellectual property

The Turasistan software, source code, database structure, designs, interfaces, brand, logo, documentation, workflows and modules, and all intellectual property rights in them, belong to Sanalogi.

This Agreement does not give the Customer ownership of the software; it grants only a limited, time-bound, non-transferable and non-exclusive right of use. The Customer may not copy, sell, rent or sublicense Turasistan, let third parties use it, or analyze it in order to develop a similar product. Rights in Customer Data belong to the Customer. During the Agreement, the Customer authorizes Sanalogi to process this data to provide, secure and support the service. Sanalogi does not use Customer Data for its own purposes; it may only use anonymous, aggregated usage statistics that contain no personal data to improve the service.

20. Service continuity and maintenance

Sanalogi may carry out maintenance, updates, improvements and infrastructure work to keep Turasistan secure, efficient and sustainable. During this work, the service may be temporarily interrupted, slowed down or restricted.

Sanalogi aims to give reasonable advance notice of planned work; however, it may intervene without notice in urgent situations relating to security, infrastructure, attacks, data integrity or legislation. Sanalogi targets 99.9% monthly availability; this figure is a target, not a commitment.

21. Service changes

Sanalogi may change Turasistan's features for technical requirements, security needs, changes in legislation, changes in third-party systems, commercial requirements or to improve service quality. These changes may include adding new modules, changing existing modules, removing old features, updating the API structure or changing the interface. The Customer acknowledges that SaaS services evolve continuously.

22. Backups and data loss

Sanalogi takes technical backup and security measures for system security and service continuity. The Customer is nevertheless responsible for exporting and backing up its own commercial records, customer information, accounting data and operational data.

Sanalogi is not liable for data loss caused by the Customer's own mistakes, unauthorized users, deletion, incorrect data entry or third-party systems.

23. Support services

Sanalogi provides support through support requests, email, phone, remote connection, documentation and other communication channels. Support channels:

The scope, duration and priority of support may vary according to the package the Customer has purchased. Sanalogi is not responsible for problems arising from the Customer's computers, internet connection, browser, operating system, third-party services, staff errors or local network.

24. Limitation of liability

Sanalogi provides the Turasistan service with reasonable commercial and technical care. Sanalogi is not liable for indirect losses, loss of profit, loss of customers, loss of reputation, business interruption, data loss, third-party system failures, outages in public authority systems or losses arising from the Customer's incorrect use.

Sanalogi's total liability for any reason is limited to the service fees the Customer paid to Sanalogi in the 12 months before the date the loss arose. Notwithstanding the exclusion of data loss in the first paragraph, where data loss is caused by Sanalogi's fault, Sanalogi will use reasonable efforts to restore the data from the last successful backup; any further loss is subject to the cap in this paragraph.

The exclusions and limitations of liability in this article and elsewhere in this Agreement (in particular Articles 9, 16, 20, 22, 23 and 25) do not apply in cases of Sanalogi's intent or gross negligence or where liability cannot be limited by law.

The Customer shall indemnify Sanalogi against claims brought against Sanalogi by the Customer's customers, travelers or staff, public authorities or third-party system owners, and against administrative fines imposed on Sanalogi and legal costs including reasonable attorneys' fees, arising from data the Customer enters into Turasistan, instructions it gives, its unlawful processing of personal data, its breach of third-party terms of use or its relationship with its travelers. Sanalogi will notify the Customer of any such claim within a reasonable time.

25. Force majeure

Natural disasters, war, terrorism, epidemics, fire, flood, earthquake, strikes, lockouts, internet outages, power outages, cyberattacks, decisions of public authorities, changes in legislation, third-party service outages and other events beyond the Parties' control are force majeure. Sanalogi cannot be held liable if the service is disrupted, delayed or stopped due to force majeure. The obligations of the Party affected by force majeure are suspended for as long as the force majeure lasts. If force majeure lasts more than 60 days, either Party may terminate this Agreement.

26. Term and termination

This Agreement takes effect on the date of the first of the acts listed in Article 4 and remains in force during the free trial and the subscription.

The Customer may end its subscription as described in Article 7; refund terms are set out in Article 10 and on the Cancellation and Refund Policy page. Sanalogi may suspend the service or terminate the Agreement if the Customer breaches this Agreement, the law, its payment obligations or the rules of use.

Either Party may terminate this Agreement if the other Party fails to remedy a material breach within 30 days of written notice. Articles 11, 14, 19, 24 and 30, and any other provisions that by their nature must continue to apply after the Agreement ends, are not affected by its termination.

27. Changes to this Agreement

Sanalogi may update this Agreement in line with legislation, security, technical needs, the scope of the service or commercial requirements. The current Agreement is published at www.turasistan.com or within the application. Changes adverse to the Customer are notified to the Customer's registered email address and in the application at least 30 days before they take effect and, except where required by law or for security reasons, apply from the next renewal date. If the Customer does not accept a change, it may choose not to renew its subscription as set out in Article 7. For material changes, Sanalogi obtains the Customer's explicit electronic acceptance.

28. Notices

Sanalogi may send notices to the Customer by in-app message, email, SMS, the support panel or the registered contact details. The Customer is responsible for keeping its contact details up to date. The Parties agree that notices under this Agreement, including notices of termination and default, may be sent to their registered email addresses; where the law requires a specific form, Sanalogi uses a notary or registered mail. The Customer sends its notices to Sanalogi to [email protected].

29. Assignment

The Customer may not assign its rights and obligations under this Agreement to third parties without Sanalogi's written consent. Sanalogi may assign the Agreement for the continuity of the service, to group companies, or in the course of a merger, acquisition, restructuring or for commercial reasons.

30. Governing law and jurisdiction

This Agreement is governed by the laws of the Republic of Türkiye. For disputes between Parties that are merchants, the Istanbul (Çağlayan) Courts and Enforcement Offices have jurisdiction. This Agreement is made in Turkish and English; in case of conflict, the Turkish version prevails. In case of conflict between this Agreement and the Cancellation and Refund Policy, the Pricing page or other policies, this Agreement prevails.

31. Entry into force

By accepting this Agreement electronically, the Customer declares that it has read, understood and accepted all of its terms. This Agreement takes effect on the date of the first of the acts listed in Article 4.

Sanalogi Bilişim Sanayi ve Ticaret A.Ş.