An online store starts processing personal data from the first order: name, address, phone, email, order history, cookies. Türkiye's Personal Data Protection Law (KVKK) places certain obligations on those who process this data. As a web agency, a problem we see often isn't ignorance of the law; it's confusing a privacy notice with explicit consent.
This post is for general information. We recommend having your texts and processes checked by a KVKK specialist or lawyer; the guides on the Personal Data Protection Authority's website are also a free resource.
What personal data does an online store process?
For orders: full name, delivery and billing address, phone, email. Depending on the invoice type, a Turkish ID or tax number may be needed.
With user accounts: password (which must be stored encrypted), order history, favourites, saved addresses.
Payment details: card details are usually processed not on your site but in the payment provider's or bank's system. That takes a significant load off you. Make sure no card numbers are stored on your site.
Technical data: IP address, cookies, browser information. Analytics and advertising tools collect much of this.
Marketing data: email newsletter and SMS permissions, segments based on shopping habits.
Drawing up this list for your own site is the first step. If you don't know what you collect, you can't know what to disclose.
Privacy notice vs explicit consent
These two concepts often get mixed up, and many mistakes start here.
A privacy notice is information. You explain what data you process, for what purpose, on which legal basis, who you share it with, and the person's rights. As a general rule, a privacy notice doesn't need consent. What matters is that the person can reach the text: a link next to every form that collects data, and a permanent page in the site footer.
Explicit consent is permission you rely on when none of the other legal grounds in the law apply. It must relate to a specific matter, be based on information and be given freely.
In e-commerce, the practical meaning is usually this: processing an address and phone number to deliver an order is considered necessary for forming and performing the contract. In most cases the notice, not explicit consent, is enough for that. But using a customer's data for marketing, transferring it to a service abroad or certain profiling activities may require explicit consent. Confirm with your specialist which legal basis each activity relies on.
A common mistake: a single checkbox at checkout saying “I've read the KVKK text and consent to the processing of my data”, and the order can't go through without it. This approach may collect consent that isn't needed and makes consent a precondition of a service, which can conflict with the requirement that consent be freely given.
The commonly recommended flow: a link to the privacy notice, with no checkbox. For each processing activity that needs explicit consent, a separate, unticked, optional checkbox. A customer who leaves it unticked must still be able to complete the purchase.
Permission for commercial electronic messages
Email newsletters, SMS campaigns or calls announcing promotions also fall under e-commerce legislation, alongside KVKK. As a rule, sending commercial messages requires the recipient's prior consent; check the exceptions with your specialist.
This consent has another side: the Message Management System (İYS). Service providers meeting certain conditions must register with İYS and upload the consents they collect. Recipients can see and withdraw their consents through İYS. Sending messages based on a consent not recorded there can cause problems.
On the site, this translates to a separate, unticked checkbox on the sign-up or checkout page, such as “I'd like to hear about campaigns and offers by email and SMS”, plus an opt-out link or method in every message you send.
The scope and exemptions of the İYS obligation can change. Check your own situation against current legislation and İYS's own guidance.
Data security measures
KVKK requires data controllers to take appropriate technical and administrative measures to protect data. For an online store, that can concretely mean:
- SSL and HTTPS across the whole site
- Admin panel access only for those who need it, with two-factor authentication
- Customer lists not circulating as Excel files over email
- Sharing only the necessary data with third parties such as couriers, accountants and marketing providers
- Regular backups, with the backups protected too
- Closing a departing employee's access the same day
If a data breach happens (say, the site is hacked and customer details leak), it may need to be reported to the Board and to the people affected. The time allowed for notification is short. That's why it matters to know in advance what you'll do in a breach and to act with your specialist as soon as you notice it.
If your server, email marketing tool or customer support software is located abroad, that can count as transferring personal data abroad. The rules on this have changed in recent years. List where the services you use are hosted and review it with your specialist.
Common mistakes
On the sites we've built and reviewed, we often see these:
- A privacy notice copied from another site, still carrying another company's name
- Making the explicit consent box mandatory for ordering
- Offering marketing permission pre-ticked
- A privacy notice listing purposes that are never used, or never mentioning the tools that are (analytics, ad pixels)
- A cookie notice consisting of nothing but an “OK” button
- A customer who asked for deletion staying on the newsletter list
- Never checking whether VERBİS registration applies
A note on the last one: the obligation to register with VERBİS (the data controllers' registry) depends on criteria set by the Board, and these criteria can be updated from time to time. Check your situation against the Authority's current decisions and with your specialist.
We covered cookies in a separate post, and the distance sales agreement and other mandatory texts in their own post. It makes sense to handle all three together, since they all meet on the same checkout page.
This article is for general information only and is not a substitute for legal, financial or tax advice. For your own situation, consult a lawyer or a certified accountant.
Frequently Asked Questions
Should I add a checkbox for the privacy notice?
The notice is a duty to inform and, as a general rule, doesn't require consent. What matters is that the text is easy to reach. Some sites add an “I've read it” checkbox; if so, it's important to word it so it isn't mistaken for explicit consent. Clarify your own flow with a specialist.
Do KVKK obligations apply to guest checkout too?
Generally, yes. Even without an account, name, address and contact details are processed. Guest checkout keeps less data, but the notice and security obligations still apply.
What should I do if a customer asks me to delete their data?
Record the request and reply within the period set by law. You may not be able to delete records with a legal retention obligation, such as invoices, right away; in that case, explain why. Clarify what to do with data that has no retention requirement, and the process as a whole, with a lawyer or KVKK specialist.
Blog posts are for general information only and are not a substitute for legal, financial or technical advice.
