Website Privacy Compliance in Türkiye (KVKK): Cookies, Notices and Forms

What personal data does your site process?

The first step is knowing which data is collected where. The most common sources:

• Contact, quote and application forms (name, phone, email)
• Account and order details
• Cookies and visitor analytics (such as Google Analytics)
• WhatsApp, live chat and social media widgets
• Server logs (IP addresses)

Privacy notice

Wherever personal data is collected, users must be told why it is processed, who it may be shared with, how and on what legal basis it is collected, and what rights they have under the law. This information goes on a privacy notice page, with a clear link to it next to every form.

Cookie notice and explicit consent

Cookies that are not strictly necessary for the site to work (analytics, advertising, marketing) require the user’s explicit consent. According to the Turkish Data Protection Authority’s cookie guidelines, a proper cookie notice means:

• Non-essential cookies do not run until the user agrees
• A “Reject” option that is as easy as “Accept”
• Users can choose cookie types separately and change their choice later
• Implied consent such as “by continuing to use this site you accept cookies” is not valid

Forms

Ask only for the information you truly need; not collecting data you do not need is the most effective protection. Link to the privacy notice. If you want to send marketing messages, use a separate, unticked consent checkbox.

Data security

KVKK requires not only collecting data lawfully but also protecting it. Technically, at a minimum:

• The whole site running over SSL (https)
• Strong passwords for the admin panel, ideally with two-factor authentication
• Up-to-date software and regular security updates
• Encrypted, regular backups
• Access to data limited to authorised people
• Not keeping data longer than necessary

Common mistakes

These are the most common privacy mistakes on websites:

• A privacy notice copied from another site that does not match the business
• A cookie banner with only an “OK” button that runs cookies without consent
• Pre-ticked consent boxes
• Form submissions sent around in unencrypted emails
• Old form and order records piling up where nobody knows