Website · 11 min read · Updated:
KVKK texts for your website: privacy notice, cookie policy and form consent
Even a contact form or visitor statistics turns your website into a place that processes personal data. Once you know which text you need and why, the texts stop being a formality.
In short
- Every website that collects personal data must inform visitors under Article 10 of KVKK (Law No. 6698, Türkiye's data protection law); the privacy notice covers the data controller, purposes, legal grounds, transfers and rights.
- Informing and explicit consent are different things; answering a contact form doesn't require explicit consent, and explicit consent can't be made a condition of a service.
- According to the KVKK Authority's cookie guide, non-essential cookies such as analytics and advertising cookies shouldn't be used without the visitor's consent.
- Online shops need a pre-contract information form, distance sales contract and withdrawal text on top of KVKK texts; campaign emails additionally need consent and İYS registration under Law No. 6563.
- In Heyşirket, a KVKK privacy notice and cookie policy template comes ready at site setup; templates aren't legal advice and should be checked by a lawyer before publishing.
You added a contact form to your site, a measurement tool to see visitor numbers, maybe online booking too. All three collect personal data. That's why KVKK texts for your website matter not only for large companies but for a one-page showcase site as well.
In this article we explain which texts a site needs, which headings a privacy notice must contain, the difference between a cookie policy and cookie consent, and the most common mistake on forms. This article is general information, not legal advice; consult a lawyer for your own text.
Part 1 · Overview Which legal texts should a website have?
Which texts you need depends on what your site does. A showcase site and an online shop don't have the same obligations.
| Text | When is it needed? | Basis |
|---|---|---|
| KVKK privacy notice (aydınlatma metni) | Whenever personal data is collected via forms, booking, membership, measurement and so on | Law No. 6698 Art. 10 |
| Cookie policy | When the site uses cookies or similar technologies | KVKK Authority cookie guide |
| Explicit consent text | Only if some processing relies on explicit consent | Law No. 6698 Art. 5 |
| Pre-contract information form and distance sales contract | If the site sells to consumers | Law No. 6502, Distance Contracts Regulation |
| Consent for commercial electronic messages | If you send promotional emails or SMS such as campaigns or newsletters | Law No. 6563 Art. 6 |
This article focuses on the first three. We covered shop texts and return rules separately in the e-commerce returns process.
Part 2 · Privacy notice KVKK privacy notice example: which headings should it have?
The privacy notice (aydınlatma metni) tells the person whose data you collect why, on what legal ground and how their data is processed. KVKK Article 10 and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform list what the text must contain.
Headings of a privacy notice
Data controller
Trade name or full name, address, email, phone, MERSİS number if any and KEP (registered email) address. Visitors should know who they're giving data to.
Which data, collected how?
Name, phone, email and message asked for on forms; server and security logs; cookies. State whether data comes from the form or by automatic means.
Purposes and legal grounds
Match each purpose to its legal ground. For example, replying to a request relies on establishing a contract (Art. 5/2-c), security logs on legitimate interest (Art. 5/2-f).
Transfers
Who data is transferred to: hosting, email, measurement services. If you use a tool with servers abroad, say so clearly.
Retention period
How long each type of data is kept and what happens afterwards. Write concrete periods instead of "as long as necessary".
Rights and how to apply
The rights in KVKK Article 11 and how and to which email or address a request is made.
Part 3 · Explicit consent Are a privacy notice and explicit consent the same thing?
No. Informing is a notice and always happens. Explicit consent is approval the person freely gives for specific processing, and it's only needed when there's no other legal ground.
A contact form doesn't need explicit consent to reply to the visitor; they're asking you for an answer, which relates directly to establishing a contract. Putting a "I've read and accept the KVKK text" box under the form and blocking submission until it's ticked makes explicit consent a condition of the service. This is a common practice the KVKK Authority considers wrong.
| Case | Right | Wrong |
|---|---|---|
| Contact form | A short note under the form linking to the privacy notice | A "I accept" box that must be ticked to submit |
| Newsletter signup | A separate, unticked consent box | Adding everyone who submits the form to the list |
| Notice and consent | Two separate texts, separate actions | Informing and asking for consent in one text |
Part 4 · Cookies What should a cookie policy and cookie consent look like?
A cookie policy is the text explaining which cookies your site uses and why. Cookie consent is the window that asks the visitor's permission for non-essential cookies. One explains, the other asks; neither replaces the other.
- Essential cookies: what the site needs to work, such as basket, session and security checks. No consent needed, but they're explained in the policy.
- Analytics cookies: tools that measure visitor behaviour. According to the KVKK Authority's cookie guide, they shouldn't be used without consent.
- Advertising and targeting cookies: not used without consent.
- Embedded content: videos, maps and social media content can set their own cookies; loading them only on click is good practice.
In a good cookie window, the Reddet (reject) button is as visible as Kabul et (accept), and the visitor can change their choice later. Closing the window or scrolling the page doesn't count as consent.
Part 5 · Special cases What else do clinic, shop and booking sites need?
- Clinic and health sites: health data is a special category of personal data with stricter conditions. Not asking for illness, complaint or treatment details on contact and booking forms is the safest route. Promotional content in the health sector is also subject to advertising bans; details are in what a clinic website should look like.
- Online shops: order, invoice and delivery data and their retention periods are added to the privacy notice. Distance sales texts are needed separately.
- Booking sites: processing phone numbers for appointment reminders is explained in the notice. A reminder is a service notification; sending campaign messages needs separate consent.
- Newsletters and campaigns: commercial electronic messages need prior consent under Law No. 6563 and registration in İYS, the Turkish commercial message management system.
Part 6 · Heyşirket How are KVKK and cookie texts prepared in Heyşirket?
In Heyşirket, legal pages are created from templates during site setup, depending on the site type. A corporate site gets KVKK aydınlatma metni (privacy notice) and Çerez politikası (cookie policy) as separate pages; a personal site gets a single Gizlilik ve KVKK (privacy and KVKK) page. On clinic sites, a health data section is added to the template and a patient rights page is created; shops get order data and a delivery and returns page.
Step by step: getting legal texts ready to publish
Enter the data controller details
In the company panel, under Ayarlar › Genel (Settings › General), fill in the Yasal bilgiler (veri sorumlusu) (legal details, data controller) fields in the Privacy section: trade name or full name, MERSİS number, address, KVKK request email, phone and KEP address. The tags in the template fill in automatically from these.
Complete the template for your process
Open your KVKK page and fill in and remove the bracketed notes according to your tools and periods. For example, if you don't use Google Analytics, remove that item. The "ÖRNEK METİN" (sample text) marker at the top is there so you don't publish before doing this.
Select the privacy page
In the same section, select this page as the Gizlilik / KVKK sayfası (privacy page). The link appears under forms, on the checkout page and in the cookie window. Forms show a short notice linking to this page instead of a consent box.
Turn on the cookie consent window if needed
The Çerez izni penceresini göster (show cookie consent window) option is off by default. While off, visitor statistics are kept only as general counts without storing anything on the visitor's device. If you connect a measurement tool that uses cookies, turn the window on; visitors are asked for permission.
Have a lawyer check it
Templates aren't legal advice and don't make you KVKK-compliant on their own. Review the text with a lawyer before publishing.
If someone asks for their data to be deleted or for a copy, find them by email or phone on the Ayarlar › Araçlar › Kişisel veriler (Settings › Tools › Personal data) screen. Give them their data with Dışa aktar (JSON) (export) or delete name, phone, email and message with Sil (anonimleştir) (delete, anonymise); only the date and type remain. Step-by-step guide in the panel: Help › KVKK: personal data, privacy text and cookies.
These tools are included in the free Başlangıç package too. The full summary is on the KVKK-compliant website page, and managing requests from forms on forms and request management. If you haven't built your site yet, what a corporate website should look like is a good place to start.
Part 7 · Practice KVKK checklist before publishing
Before your site goes live
- The privacy notice has data controller, purposes, legal grounds, transfers, retention and rights headings.
- The text describes the tools and periods I actually use; it isn't copied from another site.
- Forms have no mandatory consent box; they have a note linking to the privacy notice.
- If I use analytics or advertising cookies, the cookie consent window is on and Reject is equally visible.
- I use a separate, unticked consent box for newsletters or campaigns.
- If it's a health site, forms don't ask for illness or treatment details.
- A lawyer checked the texts and I wrote the last updated date.
Does every website need a KVKK privacy notice?
If the site has anything that collects personal data, such as a contact form, booking, membership or a measurement tool, visitors must be informed under Article 10 of Law No. 6698. In practice almost every business website falls into this scope.
Should I put a KVKK consent box on my contact form?
Usually not. Replying to a request doesn't need explicit consent; a short note linking to the privacy notice is enough. A consent box that must be ticked before the form can be sent makes explicit consent a condition of the service and is a mistake. For a separate purpose such as a newsletter, use a separate, unticked consent box.
What's the difference between a cookie policy and cookie consent?
A cookie policy is the text explaining which cookies the site uses and why. Cookie consent is the window that asks the visitor's permission for non-essential cookies such as analytics and advertising. Essential cookies don't need consent but are explained in the policy.
Can I use a ready-made privacy notice example?
Using a template is a good start, but you need to fill it in for your own process. Which tools you use, who you transfer data to and how long you keep it vary from business to business. Have a lawyer check it before publishing.
Is a KVKK text enough to send campaign emails?
No. Commercial electronic messages such as campaigns and newsletters need prior consent from the recipient under Law No. 6563 and registration in İYS, the commercial message management system. This consent should be kept separate from the privacy notice and the form itself.
Which Heyşirket package includes the KVKK template?
The KVKK privacy notice and cookie policy template, the cookie consent window and the personal data tool are included in the free Başlangıç package too. Distance sales and pre-contract information texts for shops come with the store in the Profesyonel package.
Complete your legal details Enter the data controller details, select your privacy page and set cookie consent for your site. Open general settings
Author: Heyşirket Editorial Team