ERY SOFTWARE7 min read
Almost every business website processes personal data, even a simple one. A contact form collects names and email addresses; server logs record IP addresses; embedded maps, videos and analytics tools may send visitor data to third parties. Many of these decisions are made during development, often without anyone noticing. Making them consciously is much easier than fixing them after launch.
Start with an inventory
Before writing any privacy text, list what the site actually collects. For each form, note the fields and why each one is needed. Then list every external service the site loads: fonts, maps, videos, chat widgets, analytics, advertising pixels. Each item raises two questions: what data does it receive, and is it really needed?
Collect less
Data minimisation is both a legal principle and good engineering. A field you do not collect cannot leak, does not need protecting and does not need to be explained. Ask whether a phone number is necessary when email is enough, whether a free-text field invites people to share more than you need, and whether optional fields are clearly marked as optional.
Information notice and consent are not the same thing
Under KVKK, informing people about how their data is processed (the aydınlatma obligation) and asking for explicit consent (açık rıza) are different concepts. A common technical mistake is a single checkbox that mixes both, or a consent checkbox where consent is not actually the legal basis. Which basis applies to each processing activity is a legal question; the website should be built so that the wording and the checkboxes can follow whatever your legal advisor decides.
Cookies and analytics
Cookies that are strictly necessary for the site to work are treated differently from analytics or marketing cookies. If you use non-essential cookies or tracking, the site needs a way to ask for and remember the visitor's choice, and the tools must actually stay off until permission is given. Cookieless, first-party measurement that does not store IP addresses is one way to reduce the amount of personal data involved, but whether it needs consent in your situation is still a question for your legal advisor.
Where the data lives
Hosting, databases and email services may store data outside Turkey. Cross-border transfer of personal data has its own rules under KVKK. Know where each service stores data, write it down, and discuss it with your legal advisor before launch rather than after.
How long you keep it
Contact requests, logs and analytics data should not be kept forever. Decide on retention periods and, where possible, enforce them technically with automatic deletion. A retention rule that only exists in a document tends to be forgotten.
Security basics
- HTTPS everywhere and modern security headers
- Server-side validation of every form, not only in the browser
- Rate limiting and spam protection on public endpoints
- Admin areas protected by strong authentication
- Secrets kept in environment settings, never in the code
- Hashing or removing identifiers such as IP addresses when the raw value is not needed
Questions to take to your legal advisor
- Who is the data controller, and which contact details should appear in the notices?
- What is the legal basis for each form and tool on the site?
- Do our analytics and cookies require consent?
- Is our hosting setup a cross-border transfer, and what does that require?
- What retention periods should we apply?
- Do we have registration or other obligations specific to our business?
On our own site, legal pages are clearly marked as drafts until this review is complete. It is a simple practice we recommend: launch the technical measures early, and publish final legal texts only after a professional has reviewed them.
Have a project in mind?
Send us a brief