KVKK AND E-COMMERCE LAW WEBSITE COMPLIANCE GUIDE

1. COMMERCIAL ELECTRONIC COMMUNICATION CONSENT TEXT (WEB + PHYSICAL)

1.1 What Is a Commercial Electronic Communication?

Messages containing data, audio, and visual content that are carried out electronically and sent for commercial purposes by means such as telephone, call centers, fax, automatic calling machines, smart voice recording systems, electronic mail, and SMS constitute commercial electronic communications.

With commercial electronic communication consent, you can send mailings to your consumers. However, this consent must be obtained in compliance with the law.

1.2 How Is Commercial Electronic Communication Consent Obtained?

Commercial electronic communication consent may be obtained in physical form or through the web.
It may be obtained as a pop-up on the website or through areas where an email address is entered.
Example – E-Newsletter

I consent to the sending of commercial electronic communications to me by webtures.com within the scope of the information regarding commercial electronic communications (the text should be provided as a link).

It may be obtained together with the membership agreement; however, selecting the consent checkbox must not be mandatory—i.e., membership should be possible even if the consumer does not click it.
Example – Membership

1.3 What Should Be Considered in Commercial Electronic Communication Consent?

Consent may be obtained in writing or through any electronic communication tool. The consent includes the recipient’s affirmative declaration of intent to receive commercial electronic communications, their name and surname, and their electronic communication address.
For consent obtained in physical form, the signature of the person giving consent is required.
If consent is obtained electronically, the information that consent has been obtained is sent to the recipient’s electronic communication address on the same day, with an option to refuse also provided.
Consent cannot be requested by sending a commercial electronic communication to the recipient’s electronic communication address.
If consent is obtained by including it in the content of an agreement such as a subscription, sales, or membership agreement, it is obtained at the end of the agreement, before the affirmative declaration of intent or signature, under the side heading “Commercial Electronic Communication”, by providing an option to refuse, and written in at least 12-point font.
Consent given to one of the parties in an agency, authorized enterprise, or dealership agreement is deemed to have been given for the other party to the agreement as well, limited to the goods, services, or brand subject to that agreement.
The service provider may use the consent obtained for goods and services offered as a promotion, provided that it is together with its own goods or services. However, such promotional relationship must be based on an agreement.
The affirmative declaration of intent cannot be presented as pre-selected in the consent text.
The service provider cannot assert that the recipient must provide commercial electronic communication consent as a precondition for the supply of the goods and services it offers.
Details are included in our guide prepared on commercial electronic communications.

2. DISTANCE SALES AGREEMENT (WEB)

2.1 What Is a Distance Sales Agreement?

It is the most important legal text of e-commerce sites, containing the sales relationship and the rights and obligations relating to the sales relationship. Distance sales agreements essentially include the subject of sale, the parties to the sales relationship, information about the goods or services subject to the agreement, the buyer’s confirmation, sales price, payment method, delivery details, general provisions containing the rights and obligations of the seller or buyer, the buyer’s rights of withdrawal, cancellation, and return, the competent court, and applicable legal procedures.

2.2 How Should the Distance Sales Agreement Be Displayed on the Website?

It should only be displayed in the sales section. The member’s information must be filled in automatically. Payment page cannot be reached without approval.

The distance sales agreement, preliminary information form, and right of withdrawal must be displayed in some way as follows.

To summarize the points to consider in a distance sales agreement:

A distance sales agreement must be prepared specifically for each transaction.
A copy of the distance sales agreement must be provided to the buyer.
For the sale to be legally completed, the agreement must be approved by the buyer.
The seller or provider is obliged to prove that the delivery of goods or services is made without defects.

3. PRELIMINARY INFORMATION FORM (WEB)

3.1 What Is the Preliminary Information Form?

The Preliminary Information Form is a form through which the buyer can learn all information regarding the products or services subject to payment before proceeding to the payment stage. In particular, with this form, the information obligations that the seller must fulfill as stipulated under Article 5 of the Regulation on Distance Contracts and Article 23 of the Law on Consumer Protection are fulfilled.

3.2 How Is the Preliminary Information Form Placed?

The Preliminary Information Form must be displayed in a readable manner only in sales transactions. The user must approve the preliminary information form before approving the Distance Sales/Service agreement.

Detailed information about the seller (Mersis no., trade name, etc.), the basic characteristics of the goods or services subject to sale, the sales price of the goods or services in Turkish Lira, transportation/logistics/delivery costs, maturity/installment information, and details regarding withdrawal and return must be included.

All details regarding the product and service must be specified both in the distance sales agreement and in the preliminary information form. Based on membership registration and the order, this form should be filled automatically.

4. INFORMATION ON CANCELLATION, RETURN, AND RIGHT OF WITHDRAWAL (WEB)

It should be displayed in the sales section. It is especially important to prevent potential consumer requests. It is not necessary to obtain approval; however, it may be stated in the sales or return section. After the order, the distance sales agreement and the preliminary information form may be sent to the consumer.

5. WITHDRAWAL FORM (WEB)

As an annex to the distance sales agreement, it may be displayed in the return section or provided upon request. It must be filled in by the consumer and then reviewed after reaching you. In cases of withdrawal or return, many obligations are imposed on consumers in the distance sales agreement, preliminary information form, and the cancellation/return/exchange/withdrawal policy. We recommend deciding based on their compliance after the request reaches the company.

6. COMMERCIAL ELECTRONIC COMMUNICATION IMPLEMENTATION GUIDE (INTERNAL)

It has been prepared to clearly set out the company’s obligations regarding commercial electronic communications, what to consider in obtaining consent, processes and notifications about electronic communications, what to do in case of refusal, which communications will not be considered commercial electronic communications, and what the exceptions are; and to ensure the implementation of the legal texts prepared by us. It should not be shared externally and should remain as an internal rule.

7. PERSONAL DATA PROTECTION AND PROCESSING POLICY (WEB + PHYSICAL)

7.1 What Is the Personal Data Protection and Processing Policy?

In general, companies’ ability to inform customers about products, campaigns, or advantages may be possible through collecting personal data. A Personal Data Protection and Processing Policy is required for lawful collection of such information.

7.2 How Should the Personal Data Protection and Processing Policy Be Presented?

The Personal Data Protection and Processing Policy prepared for the web should be displayed at the bottom (footer) of the website. In this scope, consumers should be able to access the policy whenever they wish.

The Personal Data Protection and Processing Policy prepared for physical environments should be sent to company employees together with other policies if possible, or placed in an accessible location.

It is not necessary to obtain user approval for the Personal Data Protection and Processing Policy prepared both for the web and physical environments. What is important is that the KVK privacy notice is approved both on the web side and in the physical side.

8. COOKIE POLICY (WEB)

8.1 What Is the Cookie Policy?

The Cookie Policy is part of privacy law that requires websites to obtain visitors’ consent to store or retrieve any information on a computer, smartphone, or tablet.

8.2 Where Should the Cookie Policy Be Displayed?

The Cookie Policy should be displayed at the bottom section of the website and as a pop-up. It should also appear as a pop-up on website entry and inform the user.

It is possible to proceed with a text such as: “Cookies are used on our website in accordance with legislation; if you continue browsing, you are deemed to have accepted our Cookie Policy (link) and our Personal Data Policy (link). Cookie Settings – OK”.

9. KVK PRIVACY NOTICE (WEB + PHYSICAL)

The Privacy Notice for the Protection of Personal Data must be included at all points where we collect personal data through our website. Member registration or contact form may be given as examples of these points.

When we examine the sample membership form table below;

After data is entered, the personal data privacy notice and explicit consent approval appear in the final section of the form. In this context, we show our KVK text to our users as a link, and we show our explicit consent approval text in section no. 1. In this scope, while obtaining consent for sharing with third parties and special category personal data in section no. 2, we obtain explicit consent for transfer of personal data abroad or to cloud servers in section no. 3.

Another important point in the KVK privacy notice is the contact form. While users share their requests with the company via contact forms, they also share their personal data. In this context, an approval should be obtained as follows. In addition, if desired, it is possible to obtain commercial electronic communication consent from the contact section as well; of course, the checkbox should not be mandatory.

10. CORPORATE COMMUNICATION, BOARD, AND DATA SUBJECT INFORMATION POLICY (WEB + PHYSICAL (MUST BE APPROVED BY THE CONTACT PERSON))

This is a text that must be displayed alongside the KVK Application Form. It may generally be placed in one of three locations:

At the bottom section of the website,
Within the relevant page if a Personal Data Protection page is created,
In the contact section.

11. KVK APPLICATION FORM

This is a mandatory form so that data subjects can direct their rights under the Law to the company. In this scope, as in Article 18, it is important that it be displayed in one of three sections. It is possible to arrange the form online.