KVKK for Turkish Online Stores: Data, Cookies and Consent

سفير تركيا · Sunday at 11:54 PM

KVKK for Turkish Online Stores: Data, Cookies and Consent
A practical data inventory, lawful bases, privacy notices and customer choices

Store data starts before the first order: a visitor opens a page, a buyer enters an address, a support employee reads a complaint, and an external extension measures advertising. Applying KVKK means understanding this journey and identifying why each item of information is collected, who can access it, where it is transferred, and when it is no longer needed. A lengthy privacy policy alone does not demonstrate that these decisions have been implemented in the system.

This guide helps the owner of a small Turkish store prepare a practical inventory and daily procedure. Not all processing requires explicit consent, and blanket consent does not solve every use. Start with the purpose, lawful basis and privacy notice, then address suppliers, cookies, customer rights and security. Show a specialist the inventory with an accurate description of the tools you use, rather than sending only the website link.

Required outcome: an up-to-date data inventory, an understandable privacy notice, genuine consent choices where required, defined permissions, and documented records of suppliers, international transfers and customer requests.

The shopping experience collects data that must serve a clear purpose.

Identify who decides how data is processed

Identify the entity that determines the purposes and means of processing store data, rather than merely naming the theme or developer. The store may be the data controller for orders and customer service, while one supplier processes data on its instructions and another undertakes independent processing within its own role. Do not assign every contractor the same status without examining the service and contract.

Record the business name, contact channel and internal privacy lead. In a small business, the owner may handle this file, but employees must know where to direct a question or customer request. Map a short journey: product page, cart, payment provider, invoice, warehouse and carrier, then after-sales service. Beside each step, list the tool and its user so that you can see which data leaves the store dashboard.

Build an inventory around the purpose of use

Create a table of the information actually collected, including email, address, telephone number, login records and marketing preferences. Look beyond the fields displayed at checkout: analytics, chat and monitoring software may collect information without the visitor entering it directly. Review data exports, extensions, email accounts and printed warehouse documents.

For each item, ask why it is needed, the minimum necessary, and what would happen if you did not collect it. Do not request a date of birth to sell a household item simply because the theme includes that field. If a particular case requires special-category data or identity documents, examine the appropriate basis and safeguards instead of copying them into general notes. The inventory must describe today's store and be updated whenever a service or campaign is added.

Store process	Typical data	Specific purpose
Order and delivery	Name, address and contact channel	Fulfill the purchase and deliver the shipment
Invoicing	Data required for the relevant document	Meet tax requirements
Customer service	Order number and problem description	Handle an inquiry or dispute
Optional marketing	Channel, preference and permission record	Send a campaign within its authorized scope
Website security	Limited login records	Protect accounts and prevent unlawful access

Choose a lawful basis for each processing activity

The law's conditions for processing data include explicit consent and other grounds, such as direct necessity for concluding or performing a contract, legal obligations, protecting a right, and legitimate interests subject to their conditions. Do not place all store activities under an 'I agree to the use of my data' checkbox. Processing an address needed to ship an order differs from using it to create an advertising audience.

Document the basis for each activity, purpose and limit, rather than for a database name. When relying on legitimate interests, examine necessity, proportionality and the impact on rights instead of treating the phrase as an administrative shortcut. Reassess before reusing data for a changed purpose. A customer list exported to resolve a shipping issue does not automatically become a promotional mailing list, even if it stays within the same company.

Separate the privacy notice from consent

Provide the privacy notice when collecting data: the controller's identity, processing purposes, recipients and purposes of transfers, collection method and lawful basis, and the data subject's rights. Use clear Turkish suited to the store's audience, with a supporting Arabic version where needed. Privacy information is not an advertisement for service quality; it must describe what actually happens, rather than what you hope to implement later.

Where explicit consent is the required basis, it must concern a specific matter, be adequately informed and be freely given. Separate it from the privacy notice, contract acceptance and marketing-message permission. Do not turn acknowledgment of the privacy policy into blanket consent for every purpose. Retain the wording, version, time and recorded choice so that you can demonstrate precisely what the person selected and what they did not.

Interface element	Function	Error to correct
Privacy notice	Explain processing and rights	Vague wording covering any use
Required consent	A choice for a specific purpose	One checkbox for every purpose
Purchase contract	Govern the sale	Hide marketing within the contract
Marketing permission	A decision by channel and scope	Automatically subscribe every buyer

Payment data requires defined permissions and a known processing route.

Review OTP and membership without hiding marketing permission

A verification code may confirm a telephone number or account login, but it cannot serve as a concealed way to obtain advertising consent. The Board's decision on this practice requires explaining the code's purpose and consequences, separating the different procedures, and avoiding making marketing consent a condition of providing a product or service. Explain what entering the code will do before requesting it.

Test account registration, guest checkout and telephone updates from the customer's perspective. Customers must be able to decline marketing and complete the service where the optional processing is unnecessary for it. Review the wording used by support employees as well: 'Give me the code to finish the invoice' may conceal a different action in the system. Train employees to use accurate language and check that the system records the customer's choice without automatically creating permission merely because verification succeeded.

Classify cookies by their actual function

Necessary cookies may maintain the cart, user login or a requested privacy preference. These activities do not all automatically require explicit consent where another valid basis exists. Conversely, tracking behavior for advertising needs a different assessment and does not become necessary simply because it benefits sales. Examine each cookie and tool's function and the entity receiving the data.

The Authority's current guidance provides examples and scenarios, including first-party analytics under specific conditions; avoid both 'all analytics is exempt' and 'all analytics is prohibited without consent.' Record why the chosen basis applies to your actual configuration. Some extensions change their function when advertising sharing is enabled or another account is connected, so review settings too. Customizing colors or names in an administration dashboard does not establish that the function collects no personal data.

Make cookie choices effective

Present acceptance, rejection and preferences clearly and with comparable visibility, linking to the detailed privacy notice. Where consent is required, the decision should be an affirmative act, rather than simply continuing to browse. Connect the choice to actual operation: rejecting advertising should prevent advertising tools that depend on that permission from running, rather than merely hiding the banner while tracking continues.

Ask the developer to test a new visitor, rejection of all optional cookies, acceptance of one category, and a subsequent change of choice. Record the tools running in each case and specify how long choices are stored and when the notice is reviewed. A screenshot of an attractive popup is not evidence of testing. The following table is a team work log; after inspection, it can be expanded with cookie name, supplier, duration, purpose and basis.

Test scenario	Expected behavior	Verification evidence
Before any choice	Run only tools with a valid basis	List of active tools
Reject optional cookies	Do not run tools dependent on permission	Page-load test
Accept advertising only	Respect the scope of the decision	Choice and tool records
Withdraw the choice	Update operation on subsequent visits	Change time and outcome

Changing the banner wording is insufficient if extensions run before the visitor chooses. Verification must cover the website's actual behavior on phones and computers.

Review suppliers and data access

List the store platform, hosting, chat, email, analytics, payments, shipping and accounting software. Request descriptions of the data each supplier handles, processing locations, roles, subprocessors, retention periods, security safeguards, and procedures for customer requests or incidents. A general service contract does not always answer these questions.

Give the warehouse the delivery information it needs, rather than marketing consent lists or irrelevant dispute details. Finance employees need payment and settlement documents, rather than customer passwords. Use an account for each employee with job-based permissions and revoke access when the relationship ends. For a temporary developer, provide limited access with an expiry date, and delete test copies containing real data or replace them with synthetic data.

Order data extends into operations, warehousing and delivery.

Assess international transfers under the current framework

An international transfer may occur when a service hosts customer data outside Türkiye or allows access from abroad. This assessment is separate from the initial basis for collecting the data. The framework operating since the 2024 amendments includes adequacy decisions, appropriate safeguards and specified occasional situations, each subject to its own conditions. Do not use an old cookie decision to describe consent alone as the current general route for ongoing transfers.

Safeguards include approved standard contracts where their conditions apply, with notification to the Authority required within five business days of signature. A generic template from a foreign supplier does not complete the file. Match each party's role, transfer type, data annex and measures, and verify the approved notification method. Ask a specialist about your actual configuration; the parent company's location or subscription currency alone does not establish where your data is held.

⁦⁩ Assess VERBIS for the business's circumstances

Registration of data controllers is governed by a general rule, statutory exceptions and decisions applying specific criteria. It is incorrect to say every small store is exempt or every website must register without exception. Collect details of the entity, main activity, workforce, financial figures, data types and legal establishment, then match the current decision to your circumstances and the date the obligation takes effect.

Keep the assessment, reasoning, supporting documents and approver, and review them when the business grows or changes. A registration exemption, where applicable, does not remove duties to provide notices, ensure security, respect processing conditions or uphold individuals' rights. Where registration is required, it must reflect actual processing rather than a generic template. Regular inventory reviews help prevent a new website service from appearing while register information and contracts remain outdated.

Assessment question	Required information	Output
Who is the data controller?	The entity, its establishment and role	Determine its legal position
Is there an exemption?	Criteria of the applicable decision	Documented reason and review date
What data and purposes?	Inventory of activities and suppliers	Accurate declaration where registration is required
Has the business changed?	Growth, a new service or new data	Reassess the obligation

⁦⁩ Organize retention, rights and incidents

Set retention periods by record category, purpose and legal obligation, rather than one period for everything. Withdrawing marketing consent does not require deleting an invoice that must legally be retained, but it does require stopping processing dependent on that permission. When the reasons for processing end, apply the appropriate deletion, destruction or anonymization procedure, and review backups and supplier policies.

Accept data subject requests through a known channel, verify identity proportionately, and respond as soon as possible and within a maximum of thirty days under the applicable provisions. Do not send the complete customer file to someone whose email resembles the customer's name. Also prepare a plan for disclosure or unlawful-access incidents: preserve evidence, contain harm, and assess notification duties and deadlines. Test the plan before an incident, with an alternate contact if the responsible person is absent.

⁦⁩ FAQs and readiness checklist

Review privacy whenever an extension is added or a supplier changes, rather than only on launch day. Use a test order with synthetic data to see where information goes and who can export it. Then test declining marketing, changing cookie preferences and making a rights request. The required outcome is a system that respects choices and gives consistent answers, rather than merely a text file stored where the team never opens it.

Do I need explicit consent for every order?
Not necessarily. Identify the basis for each processing activity, such as necessity for contract performance or a legal obligation where its conditions apply. Providing a privacy notice remains a separate duty.

Does a VERBIS exemption exempt me from privacy duties?
No. The exemption concerns register entry and does not automatically remove other KVKK obligations.

Does cookie consent automatically resolve international transfers?
No. The current transfer framework, roles and conditions must be assessed separately, including appropriate safeguards where used.

I inventoried order, visitor, support and extension data.

I identified the purpose and lawful basis of each activity.

I separated privacy notices, the contract and optional consents.

I tested accepting and rejecting cookies and withdrawing choices.

I reviewed suppliers, international transfers and permissions.

I documented the VERBIS assessment, retention periods and request procedure.