Privacy-Friendly Contact Forms: KVKK and GDPR Basics

Personal data is any information about an identified or identifiable person: a name, a phone number, an email address, and the message someone writes about themselves. The business that collects this data and decides why and how it is used is the “data controller”, and that is you, however small your business is.

KVKK (Law No. 6698 on the Protection of Personal Data) is Turkey’s data protection law. It follows principles very similar to GDPR: process data lawfully and fairly, for specific and legitimate purposes, keep it limited to what you need, keep it accurate, and do not keep it longer than necessary. If you serve visitors from several countries, more than one law may apply to you.

The two ideas people mix up most are informing people and asking for their consent.

A privacy notice: always

Whenever you collect personal data, you must tell people who you are, why you are collecting it and how it will be used. That is the job of a privacy notice (in Turkey, the “aydınlatma metni”). It informs; it does not ask for permission.

Consent: only when you need it

Consent is one of several legal bases for processing, and often not the right one for a contact form. Replying to a question or a quote request can usually rely on another basis, such as taking steps at the person’s request or legitimate interest, though the assessment depends on your purpose. Using the same contact details later for marketing is a different purpose and generally needs separate permission.

When you do ask for consent:

• Make it specific, informed and freely given.
• Do not make it a condition of replying; avoid “no consent, no answer” designs.
• Keep the privacy notice and any consent request separate rather than bundling them into one checkbox.
• Never use pre-ticked boxes; the visitor must opt in themselves.

Data minimization is the easiest and most effective privacy step: data you never collect is data you never have to protect, store or delete. For a general contact form, this is usually enough:

• Name
• Phone number or email, depending on how the person wants to be contacted
• Message, plus an optional topic

Do not ask for ID numbers, date of birth or a full address unless you truly need them. Special category data, such as health, religion or ethnic origin, has much stricter rules and does not belong in a general contact form.

If you work in healthcare or therapy, visitors may volunteer health details on their own. A short note above the form helps: “Please don’t share health details here; we’ll talk about them at your appointment.” In the clinic and therapist templates you can add this with a simple text block.

Write a notice that is clear, plain and specific to your business rather than copied from another site. It generally covers:

• Who you are: your business name and contact details.
• Purposes: for example, replying to inquiries, preparing quotes or scheduling appointments.
• Recipients: who the data may be shared with, such as your website, email or cloud providers, including any that are based abroad.
• Collection method and legal basis: that the data comes from the website form, and on what basis you process it.
• People’s rights: such as access, correction and deletion, and how to exercise them.

Link the notice right next to the form and in the site footer, so visitors can read it before they hit send.

How long to keep messages

Keep personal data only as long as you need it for the purpose you collected it for. Once you have answered a question and no business relationship followed, there is rarely a reason to keep that message for years. Set yourself a simple rule and regularly clear out old messages in your inbox and other tools.

Security basics

• HTTPS: form data should travel over an encrypted connection; the padlock in the address bar shows your site has SSL.
• Access: know who can read the messages, use a strong password and do not share logins.
• Forwarding: do not casually forward form messages to personal email accounts or group chats.
• Staff: anyone reading messages should know they are only for answering the request.

Some laws require data controllers to register with the regulator. In Turkey this is the VERBİS registry, and the Personal Data Protection Board has exempted certain controllers based on criteria such as employee numbers, annual balance sheet and type of activity, with exceptions, for instance where processing special category data is central to the business. Thresholds can change, so check the official site of the Turkish authority at kvkk.gov.tr. Under GDPR there is no general registration duty, but other obligations, such as keeping records of processing in some cases, may apply.

Either way, being exempt from registration never removes the duty to inform people and keep their data secure.

Cookies are the other half of website privacy. Non-essential cookies, such as analytics and advertising cookies, generally need the visitor’s consent before they run, and a cookie policy explaining what you use is good practice.

On BirSitem sites, Google Analytics runs only after the visitor gives cookie consent. The visitor statistics in your dashboard are cookie-less and do not store visitors’ personal data. You will find the Analytics and search settings in the SEO section of the documentation.

When you add the Contact or Contact form block to a page, the form is built around these principles:

• It asks for name, phone, email, message and, if you want, a topic; nothing more.
• Before sending, visitors separately tick the privacy notice (KVKK notice) and the terms of use; clicking a title opens the full text in a window. You can turn these checkboxes on or off in the block settings.
• The consents are saved with the message and shown under it in your dashboard.
• Messages arrive in your dashboard inbox, appear as a notification and are also sent to your email.
• Sites are served over HTTPS with SSL included.

You manage legal texts under Legal texts in your site dashboard: write them or upload your own PDF or Word file. They are also published on your site at /kvkk and /kullanim-sartlari and linked from the footer. If you leave them empty, a generic draft is shown, but it is only a starting point; preparing the right text for your business is your responsibility. See the contact form and messages documentation for details.

• The form asks only for what you need; no ID numbers or health data.
• A privacy notice written for your business is linked next to the form.
• The notice and any consent request are separate; no pre-ticked boxes.
• Form messages are not used for marketing without separate permission.
• The site loads over HTTPS and you know who can read messages.
• You have a simple rule for deleting old messages.
• You have checked whether you need to register with a regulator.
• Non-essential cookies run only after consent, and your cookie policy is ready.

For the other parts of a trustworthy site, read what a business website should include, and if you plan to sell online, see how to start an online store.

If you work in a field where trust is everything, such as law, consulting or healthcare, start with the law and consulting template or browse all templates. Create a free account, add your contact form and manage your legal texts in one place.