KVKK and İYS compliant customer loyalty

What does this guide cover, and what does it not?

This guide gives a broad overview of the core concepts small and medium businesses in Turkey should know when setting up a loyalty program; it is not legal advice. Legislation and decisions of Turkey's Personal Data Protection Board can change, and every business is different. Have a lawyer or KVKK consultant review your texts before you publish them.

The topic has two pillars: Law No. 6698 on the Protection of Personal Data, known as KVKK (Turkey's data protection law), governs how customers' personal data is collected and processed. Law No. 6563 on the Regulation of Electronic Commerce and its regulation govern sending commercial electronic messages such as campaigns or discounts; consent for these messages is registered in İYS (İleti Yönetim Sistemi, Turkey's national message management system). A loyalty program touches both.

What is the difference between privacy notice and explicit consent?

The privacy notice (aydınlatma) is information you always provide; explicit consent (açık rıza) is the customer's approval for a specific processing activity and is only requested when needed. The two are often confused, but they are not the same thing.

The privacy notice tells the customer, at the time of collection:

• Who the data controller is (your business).
• Why the data is processed (e.g. running the loyalty card, tracking stamps and rewards).
• To whom and for what purpose the data may be transferred (e.g. your software provider).
• How the data is collected and on what legal basis.
• What rights the customer has under the law and how to contact you.

Explicit consent is consent about a specific matter, based on information and given freely. Under KVKK it is only one of several legal bases for processing; others include forming or performing a contract, legal obligations and legitimate interest. Which processing rests on which basis is something to settle with your lawyer.

In practice, two points matter: keep the privacy notice and the consent text separate. And don't make consent a precondition for the service; tying a service that would work without consent to it just to obtain approval calls into question whether the consent was freely given.

What is İYS, and why is marketing consent collected separately?

İYS (İleti Yönetim Sistemi) is Turkey's national system where businesses register their consents for commercial electronic messages and where citizens can view and manage those consents. Promotional SMS, emails or calls, such as campaigns, discounts or "we miss you" messages, count as commercial electronic messages and require the recipient's prior consent.

Marketing consent is separate from KVKK explicit consent. A customer may agree to data processing for the loyalty card but not want marketing messages. So the form needs two separate choices, and the marketing consent box must not be pre-ticked.

• Keep a record of marketing consent: when, through which channel and with what wording it was given.
• Register consents in İYS; don't send messages based on a consent that isn't registered there.
• Offer an easy, free way to opt out in every message.
• Stop messaging customers who opt out and keep your list up to date.
• Purely informational messages (e.g. appointment reminders) may be treated differently from promotional ones; clarify the line with your lawyer.

Wallet notifications deserve the same thinking. If a campaign announcement that appears on the lock screen is promotional, it's the cautious approach to send it only to customers who gave marketing consent.

What data should a loyalty program collect?

Collect only the data the program actually needs; this is called data minimization and reflects the general KVKK principle that data must be "relevant, limited and proportionate" to its purpose. The less data you hold, the less you have to protect.

For a loyalty card, this is usually enough:

• One piece of contact information to match the card to the customer (e.g. email).
• Name (optional; for a personal greeting on the card).
• Stamp, point and reward history.
• Birthday, if you offer a birthday treat; if not, don't ask at all.

Beauty salons, spas and pet shops need extra care on one point: information about allergies, skin sensitivity or health counts as special category personal data and is subject to stricter rules. Keep it out of the loyalty program. Notes about a pet can also become personal data when stored with the owner's identity; collect them only if needed. For industry examples, see the pages for beauty salons, spas and pet shops.

How long is customer data kept, and how is it deleted?

Personal data is kept for as long as the purpose of processing requires; once the purpose is gone, it must be deleted, destroyed or anonymized. If other laws require a different retention period, that period applies.

A practical approach for loyalty programs:

1. Set a retention period (e.g. define what happens when a card is unused for a long time) and state it clearly in the privacy notice.
2. Review expired data at regular intervals and delete or anonymize it.
3. Keep the figures you need for analysis (e.g. visits per month) aggregated, not linked to individuals.
4. Paper cards, notebooks and copies can contain personal data too; destroy the old ones securely when you go digital.

If you are planning the switch from paper to digital, the guide moving from paper stamp cards to digital has a step-by-step plan.

What should you do if a customer asks to access or delete their data?

Log the request, verify the person's identity reasonably and respond within the legal deadline, at the latest within thirty days. KVKK gives data subjects rights such as learning whether their data is processed, requesting information, asking for correction, deletion or destruction, and objecting.

• State in the privacy notice which channel requests should come through.
• Record incoming requests, their dates and your response in one place.
• For a deletion request, handle the card, contact details and marketing consent together; remove the customer from your messaging list too.
• Make sure your staff know who to pass such requests to.

Who is the data controller and who is the data processor?

The business that sets up the loyalty program is the data controller (veri sorumlusu); the software provider that runs it is, in most cases, a data processor (veri işleyen) acting on the business's behalf. The controller decides why and how data is processed; the processor handles it on the controller's instructions and on its behalf.

The distinction matters because giving notice, obtaining consent where needed and answering customer requests are primarily the controller's duties. The controller can also be held responsible for data security together with the processor, so it's good practice to set out roles and security measures with your provider in writing. Some businesses also have to register with the Data Controllers' Registry (VERBİS); this depends on the business, so check your own situation.

Dokun works the same way: the business is the data controller and Dokun is the data processor. Dokun gives you tools to meet these duties: the privacy notice and explicit consent are logged, marketing consent is collected and stored separately, consents can be exported in a format ready to upload to İYS, and customers can download their data or request deletion from their own card page. Data is stored on infrastructure hosted in the EU (Ireland); since this is a transfer abroad, it must be stated in the privacy notice and the legal conditions for transfer must be met. See our KVKK page for details. Tools make the work easier but don't replace a legal review.

KVKK and İYS compliance checklist

Tick off this list item by item before launch; ask your lawyer about anything you're unsure of.

• The privacy notice is ready and accessible before customers provide any data.
• If explicit consent is needed, it is collected separately from the notice and not as a condition of the service.
• Marketing consent is requested with its own box, unticked by default.
• Marketing consents are recorded and registered in İYS.
• Every campaign message includes an easy, free way to opt out.
• Only necessary data is collected; special category data such as health information is not in the program.
• A retention period is set, and expired data is deleted or anonymized.
• There is a request channel and a record-keeping routine for access and deletion requests.
• Controller and processor roles are clarified with the software provider.
• Any transfer abroad is stated in the privacy notice and the transfer conditions have been assessed.
• Staff know not to copy customer data to personal phones or notebooks.

For the basics of digital cards, see the guide what is a digital loyalty card. Plans and features are listed under pricing.