Does your privacy notice actually describe your website?

A KVKK privacy notice is the text that tells the people whose personal data you collect who is processing their data, for what purpose and on what legal basis, and what rights they have. KVKK is Türkiye's Personal Data Protection Law. The most common mistake when preparing a privacy notice for a website is taking another site's text and changing the company name. The result is a notice that describes an e-newsletter the site doesn't have, but never mentions the file upload on the contact form. In this article we explain how to prepare your privacy notice starting from your site's real data flow.

What does the duty to inform require?

Personal Data Protection Law No. 6698 requires the data controller to inform the data subject at the time their data is collected. The Personal Data Protection Authority's communiqué on this topic and the guides it publishes expect the notice to cover at least the following:

• The identity of the data controller (legal name, address, contact details)
• The purposes for which the personal data will be processed
• To whom the data may be transferred, and for what purpose
• The method of collection and the legal basis
• The data subject's rights under the law and how to exercise them

An important detail: the notice is given at the moment the data is collected. So what you need is not a page that opens after the form is submitted, but a link or short piece of information that can be seen before the form is sent.

Data map first, then the text

Before you write the notice, list every point where personal data enters your site. On a typical corporate website, the list looks like this:

This table is the skeleton of the notice. Don't write any processing into the notice that isn't in the table, and don't do any processing on the site that isn't in the notice.

One notice for every form, or separate notices?

For a small corporate site, a single general privacy notice plus a short form-specific summary under each form is often enough. But for processes whose purpose and retention period are clearly different, such as job applications, a separate notice is easier to understand. Applicants want to see clearly how long their CV will be kept and whether it will be considered for other positions.

A practical rule: when visitors filling in a form ask themselves "what will happen to this information?", the answer should never be more than two clicks away.

Don't confuse the privacy notice with explicit consent

This is the problem we run into most often. Putting an "I have read and accept the privacy notice" checkbox under a form mixes up two things:

• The privacy notice is information; it isn't accepted, it is read. It doesn't need a checkbox.
• Explicit consent is a separate, optional approval obtained for a specific processing activity (for example, sending marketing messages).

The Authority recommends presenting these two texts separately. We explain in detail when you actually need explicit consent in our article on when explicit consent is required.

Writing the notice clearly is also an obligation

A privacy notice is written not for lawyers but for the person filling in the form. A few suggestions:

1. Use short sentences and everyday language instead of legalese such as "hereinafter" and "aforementioned."
2. State purposes concretely. Instead of "carrying out business activities," say "responding to your request for a proposal."
3. Name the recipients of transfers by category: hosting provider, email service, accounting, shipping.
4. If you use a tool that runs outside Türkiye, don't hide it. For the rules on this, see our article on cross-border data transfers.
5. Explain clearly how to submit a request to exercise rights: to which address, and by what method.
6. Add the date of the last update at the end of the notice.

Checklist

• All data entry points on the site are listed
• A purpose and legal basis are defined for each entry point
• The privacy notice link is visible before the submit button of every form
• The privacy notice and the explicit consent text are separate
• Recipients of transfers and tools located abroad are disclosed
• The request procedure and contact details are up to date
• The notice is reviewed whenever a new form or tool is added to the site

How we do it at Globya

In a corporate website project, we draw up the data map during the design stage, because that is also when decisions are made about which fields each form really needs. Removing an unnecessary field up front is easier than trying to explain it in the notice later. We draft the notice based on the site's actual flow and submit it for your legal advisor's approval. This work is part of our KVKK compliance approach and is not charged separately.

Frequently asked questions