Two-way
We build KVKK compliance into the product, not only into documents: which data, on which screen, for what purpose, for how long. The legal decision turns directly into code and design.
We handle the legal side with a team that knows how the product works, on the same plan as the product.
KVKK's cross-border transfer rule was rewritten in 2024. Transfers to countries without an adequacy decision need appropriate safeguards such as standard contracts, binding corporate rules or an undertaking approved by the Board, and a standard contract must be notified to the Authority within five business days of signature. Most cloud hosting, email and analytics services fall under this.
Companies based abroad that process the data of people in Türkiye must register with VERBİS and appoint a data-controller representative resident in Türkiye. Some registration exemptions available to small domestic businesses do not apply to controllers based abroad.
Apple and Google ask you to declare the data your app collects on its store page and, for apps with accounts, to let users delete their account from within the app. These declarations must match your KVKK documents and the real data flow; a mismatch leads to review rejections and legal risk.
We clarify your goal, timeline and critical risks together, in English or Turkish.
We write the legal, technical, design and operational steps into a single plan, each with an owner and a date.
Formation, contracts, product and brand work run in parallel. Work that requires a lawyer is done with independent legal professionals on BEG Hukuk.
We stay with you after launch: compliance updates, new markets, product development.
These answers are general information and are not legal advice for your specific situation.
No. The privacy notice is only one obligation. The legal basis for each processing activity, separate explicit consent where needed, security measures, retention periods, VERBİS registration, cross-border transfers and handling data-subject requests are all part of compliance.
When none of the other legal bases in the law applies, for example marketing communications not needed to perform the contract, or some analytics and personalisation. Consent must be specific, informed and freely given, and should not be made a condition of the service.
Under the Board's decision, a breach must be notified to the Board within 72 hours of becoming aware of it, and affected people must be informed as soon as reasonably possible. A written response plan prepared in advance is the safest way to meet these deadlines.
If it processes personal data of people in Türkiye, generally yes. Notices, legal bases, cross-border transfers and VERBİS registration then come into play. We can adapt your existing GDPR set-up to the Turkish rules without redoing most of the work.
From the fieldKampüs KuryeOn our own platform we built privacy notices at sign-up, cookie choices, account deletion and app-store privacy declarations together.→ TR · TR →Two-way legal supportInto Türkiye and from Türkiye to the world: the page on both directions and both sides of each.International 