Acceptable Use Policy

This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.

This Acceptable Use Policy (the "Policy") sets out how the EnaTTO service may be used. It applies to the Service as defined in the Terms of Service: the web administration interface, the public pages, the API and related support services. The Policy supplements Section 9 of the Terms of Service and forms part of the Contract Documents. Terms such as Customer, User, External person, Customer Environment, Customer Data and confidentiality class have the meanings given in the Terms of Service.

1. Who this applies toCopy Anchor Link

The Policy applies to:

• the organization using the Service (the "Customer"), for example a technology transfer office, university, research institute, technopark, hospital or public institution;
• the Customer's users, including staff, academics, students, industry users, institutional viewers and external experts such as evaluators and patent attorneys ("Users");
• people who use the Customer's public pages without an account ("External persons"), for the rules in Section 8;
• visitors of the www.enatto.com website.

The Customer is responsible for its Users' compliance with this Policy.

2. Confidentiality classes and accessCopy Anchor Link

EnaTTO protects records by confidentiality class (public, internal, confidential, strictly confidential) and by record membership. The Customer and Users must:

• give each record a class that matches its content; in particular, invention disclosures, unpublished research results, trade secrets and company information received in confidence must not be classed as public or internal without a deliberate decision;
• request elevated access to a confidential or strictly confidential record only when it is needed for their work, and give a truthful reason;
• not add themselves or others to records, committees or workflows only to gain access to content;
• set expiry dates for external experts and remove access for people who leave or whose role ends;
• not share downloaded documents or exports outside the circle of people entitled to see them.

3. Disclosures, publications and confidential informationCopy Anchor Link

• Users must not use the Service to disclose an invention or unpublished research result before the Customer's IP review, for example by publishing it in the technology catalogue, sending it to external services or sharing an export.
• Planned publications and presentations entered in an invention disclosure are kept out of exports and notifications by design; Users must not work around this, for example by copying them into fields that are exported or published.
• Information that the Customer has received from companies or partners under a confidentiality agreement must be handled according to that agreement.

4. No reliance on the Service for legal decisionsCopy Anchor Link

EnaTTO does not give legal advice and does not make legal determinations. The Customer and Users must not:

• treat deadlines suggested by the Service as the only control for official time limits; they are reminders and must be checked against the official rules and, where needed, with a patent attorney;
• present records in the Service (for example contribution shares, ownership notes, revenue-sharing percentages or EP Register status suggestions) to third parties as a legal assessment made by EnaTTO or ENA Innovation;
• use AI suggestions or report drafts without review by a person.

5. Optional external servicesCopy Anchor Link

Where the Customer switches on AI assistance or benchmarking, or uses external data sources:

• Users must not copy content from confidential or strictly confidential records into public or internal records in order to send it to the AI provider;
• Users must not type personal data of third parties, company contact details or confidential content into fields that are used for AI suggestions;
• only Users with the right permission may approve benchmarking submissions, after checking the preview;
• external data sources may be queried only with identifiers that belong to the person or record concerned (for example a person's own ORCID iD).

6. Public pagesCopy Anchor Link

When the Customer publishes public pages (technology catalogue, demand, application and event registration forms, feedback survey, certificate verification), the Customer:

• publishes only technologies and summaries it is entitled to make public;
• provides its own privacy notice and consent text for the data collected through the forms;
• uses the data collected only for the purpose stated on the page;
• does not use certificate verification to disclose more about a person than the certificate itself.

7. Accounts and identityCopy Anchor Link

• User accounts are personal. Users must not share sign-in details or let others act through their account.
• No one may act as if on behalf of another person, organization or ENA Innovation.
• The Customer gives Users only the roles and permissions they need.

8. Rules for External personsCopy Anchor Link

People who use the Customer's public pages must not:

• submit forms on behalf of another person without authorization, or use another person's email address;
• submit content they know to be false, unlawful or confidential information of third parties;
• try to guess certificate codes, confirmation links or survey links, or submit automated mass requests.

Questions about a submission should be directed to the organization that published the page.

9. Abuse of system resources and securityCopy Anchor Link

• No one may try to bypass rate limits, access controls, confidentiality classes or other security measures.
• Load testing, denial-of-service testing, scraping and automated mass requests against the Service are prohibited.
• Malware, links to phishing pages or other harmful content must not be uploaded to the Service.
• Security research is allowed only within the scope and rules of the Responsible Disclosure Policy. If the Customer wants to have its own Customer Environment tested, it must first obtain written permission via support@enainnovation.com.

10. Unlawful content and third-party rightsCopy Anchor Link

Content that infringes the law of Türkiye or of the country where the Service is used, or the intellectual property, trade secrets, personality or privacy rights of others, must not be uploaded to the Service or published through it.

11. Reporting violationsCopy Anchor Link

Requests about data in an organization's environment should first be sent to that organization. ENA Innovation forwards such requests it receives to the organization concerned.

12. EnforcementCopy Anchor Link

12.1. Depending on the severity of the violation, ENA Innovation may:

• inform the Customer and ask for the violation to be remedied;
• with the Customer or on its instruction, restrict access to the content or data concerned;
• temporarily suspend the user account, public page or feature concerned (for example AI assistance);
• suspend the Service in whole or in part under Section 13 of the Terms of Service;
• terminate the agreement under Section 16 of the Terms of Service.

12.2. If the security of the Service, other customers or third parties is under serious and imminent threat, ENA Innovation may act first and inform the Customer afterwards.

12.3. For Customer Data, ENA Innovation acts on the Customer's instructions, as set out in the Data Processing Agreement, unless the law requires otherwise. ENA Innovation does not review Customer Data in advance and has no obligation to monitor it.

13. ChangesCopy Anchor Link

ENA Innovation may update this Policy. Changes that materially affect the Customer are notified to the Customer's registered email address at least 30 days before they take effect. The current version is published on this page with its effective and update dates.

This Policy is published in Turkish, English and German. In case of conflict, the Turkish version prevails.