How ready are you for KVKK and GDPR?
27 questions in five areas, each with why it matters and what good looks like. Answer yes, partly or no — the score updates as you go. Your answers stay in this browser.
Records and transparency
Do you know what you process, why, and can you show it?
We have a written record of the personal data we process: where it comes from, who gets it and how long we keep it.
GDPR Art. 30 · KVKK m.16
Every purpose has a named legal basis, decided before the processing started.
GDPR Art. 6 · KVKK m.5
Our privacy notice (aydınlatma metni) states each purpose, its legal basis, recipients and retention in plain language, and is linked from every page.
GDPR Art. 13–14 · KVKK m.10
People are told about the processing at the moment we collect their data (forms, chat, calls), not only in a policy page.
GDPR Art. 13 · KVKK m.10
If we must, we are registered in VERBİS and the entry matches our record of processing.
KVKK m.16
Consent, cookies and tracking
Does the website do what the banner says?
No non-essential tag, pixel or cookie loads before the visitor has made a choice.
ePrivacy Art. 5(3) · KVKK m.5
Rejecting is as easy as accepting: same screen, same number of clicks, same visual weight.
EDPB Guidelines 03/2022 · KVKK Çerez Rehberi
Consent is given per purpose (analytics, marketing…) and a rejection is respected on every later page and visit.
GDPR Art. 7 · KVKK m.3
The consent state reaches Google, Microsoft and other ad platforms as a signal they act on (Consent Mode v2).
Google EU user consent policy · DMA
We keep a record of each consent: what was shown, what was chosen, when, and under which version.
GDPR Art. 7(1) · KVKK m.5
A person can change or withdraw their choice at any time, as easily as they gave it.
GDPR Art. 7(3)
Commercial e-messages (SMS, e-mail, calls) go only to people with a recorded opt-in, and we are registered in İYS.
6563 · Ticari İletişim Yönetmeliği
Security and breaches
Is the data protected, and do you know what to do when it is not?
We can notify the authority within 72 hours of learning about a breach, and we have rehearsed it.
GDPR Art. 33–34 · KVKK m.12(5)
Personal data is encrypted in transit and at rest, and minimised or pseudonymised where the purpose allows.
GDPR Art. 32 · KVKK m.12
Access to personal data is limited to the people whose role needs it, and it is reviewed.
GDPR Art. 32 · KVKK m.12
Everyone with access to customer data signs in with two-factor authentication.
GDPR Art. 32 · KVKK Teknik Tedbirler Rehberi
Staff who handle personal data are trained and know how to recognise and report an incident.
GDPR Art. 39 · KVKK m.12
Accountability
Who is responsible, and what do the contracts say?
Every service provider that handles personal data for us is bound by a data processing agreement.
GDPR Art. 28 · KVKK m.12(2)
A named person answers privacy questions (DPO under GDPR where required, contact person under KVKK).
GDPR Art. 37 · KVKK VERBİS irtibat kişisi
Transfers of personal data abroad rest on an adequacy decision, standard contracts or another lawful tool.
KVKK m.9 (2024) · GDPR Ch. V
We know when a data protection impact assessment is needed and have done one where it is.
GDPR Art. 35
We have retention periods and a destruction policy, and data is deleted or anonymised when they end.
KVKK m.7 · Silme Yönetmeliği · GDPR Art. 5(1)(e)
Individual rights
Can a person use their rights, and do you answer in time?
A person can ask for a copy of their data and gets it within the deadline (30 days under KVKK, one month under GDPR).
GDPR Art. 12, 15 · KVKK m.11, 13
Requests to correct, delete or restrict data follow a defined process, and recipients are told.
GDPR Art. 16–19 · KVKK m.7, 11
A person can object to direct marketing, and the objection stops it everywhere.
GDPR Art. 21 · KVKK m.11
Data can be given to the person in a structured, machine-readable format.
GDPR Art. 20
People are told when they talk to an AI, and automated decisions with real effects can be reviewed by a person.
GDPR Art. 22 · EU AI Act Art. 50
Nothing on this page is legal advice. It shows where to start; apply it to your own situation with counsel where the stakes require it.
Let the data answer for you
In Pexpy's Privacy Center the same check fills itself in from your real records — late requests, consent evidence, website scans, two-factor sign-in, retention rules — next to KVKK / GDPR requests with their legal deadlines and erasure across every module.