IP, Contracts & Privacy
Türkiye's KVKK Law No. 6698 (post-March 2024 amendments) and the EU GDPR covered with a single, coherent compliance pack. Privacy policies, internal records, VERBIS registration, processor DPAs, cross-border transfer mechanism.
What it is
Turkish data-protection law (KVKK, Law No. 6698) sits alongside the EU GDPR in scope and substance. Any studio that collects player data, accounts, in-app purchase records, support tickets, telemetry, crash reports, or marketing engagement, falls under KVKK in Türkiye and under GDPR wherever it offers services to EU users or monitors their behaviour. We deliver one pack that covers both regimes: public-facing policies, internal records, registration with the Data Controllers Registry (VERBIS) where the threshold is met, processor DPAs, cross-border transfer documentation aligned with the post-March 2024 KVKK amendments, and a breach-response SOP that does not depend on you reading the statute mid-incident.
Four layers, one pack
A privacy policy on its own is not compliance. The four layers below have to agree with each other, so the public-facing claim, the internal record, the regulator registration, and the processor contract all tell the same story.
The documents your players and customers read. Privacy policy, terms of service, cookie policy, age-gate where the audience includes minors. Bilingual EN / TR, KVKK and GDPR aligned.
The records the regulator asks for during inspection and the buyer asks for during DD. Lawful-basis register per activity, retention schedule, data-subject request workflow with response templates.
Registration in the Data Controllers Registry where the threshold is met: more than 50 employees, ₺100M+ turnover, or foreign data controllers regardless of size. The entry mirrors your internal inventory.
Data Processing Agreements with each processor (cloud, analytics, support, payments). Cross-border transfer mechanism under the post-March 2024 KVKK regime (adequacy, SCC, BCR). EU representative where you target EU users.
Cross-border transfers, post-March 2024
The March 2024 amendments to Article 9 of KVKK replaced the old commitment-letter system with a transfer framework that mirrors GDPR concepts: adequacy decisions by the KVKK Board, Standard Contractual Clauses, Binding Corporate Rules, and narrow derogations. For a studio sending player data to AWS, Firebase, Zendesk, or your foreign HQ, this is the regime that governs every flow. We pick the right mechanism for each processor and execute it.
Adequacy
Transfers to jurisdictions the KVKK Board has whitelisted.
SCC
Standard Contractual Clauses approved by the Board, country-specific.
BCR
Binding Corporate Rules for intra-group transfers across a corporate family.
How we do it
Three to four weeks for a full pack on engagement. Annual refresh stays current with regulatory change.
Data flow mapping
We map what personal data you collect (accounts, IAP records, IP and device identifiers, support tickets, telemetry, marketing engagement), where it lives (your cloud, processor systems, HQ), and who touches it (employees, processors, sub-processors). The map drives every other deliverable.
Public-facing policy drafting
Privacy policy, terms of service, and cookie policy drafted bilingually (English and Turkish) and aligned to both KVKK and GDPR. Cookie banner configuration with KVKK Board cookie-guidance compliance (strictly-necessary vs consent-required categorisation). Age-gate language where the audience may include minors.
Internal documentation
Internal data-processing inventory (KVKK Article 16 register and GDPR Article 30 records of processing). Retention and erasure policy with category-level periods. Data-subject request workflow covering access, correction, erasure, objection, and the 30-day KVKK response window.
Cross-border transfer mechanism
Under the March 2024 KVKK amendments, cross-border transfers are now structured around adequacy decisions, Standard Contractual Clauses (SCC), Binding Corporate Rules (BCR), and limited derogations, harmonised with GDPR concepts. We document the lawful transfer basis for each flow (HQ reporting, cloud hosting, analytics, support tools) and execute the relevant SCC or undertaking.
VERBIS registration
Registration in the Data Controllers Registry (Veri Sorumluları Sicili) where the threshold is met: more than 50 employees, annual turnover above ₺100M, or foreign data controllers regardless of size. The VERBIS entry lists data categories, lawful bases, recipients, retention periods, and security measures.
Processor DPAs and EU representative
Data Processing Agreements signed with each processor (cloud, analytics, crash reporting, email, support, payments). EU representative arrangement under GDPR Article 27 where the studio offers services to EU users without an EU establishment.
Breach response SOP
Incident-response playbook with the 72-hour KVKK Board notification window, the GDPR Article 33 supervisory authority notification, and the data-subject notification trigger. Pre-drafted notification templates so the legal work happens before the breach, not during.
What's included
Key facts
Bundled in
Pricing
USD 2,400 for the full pack on engagement. Annual refresh included while on retainer; standalone annual refresh USD 600.
Related services
Bilingual full-time, contractor, and NDA templates that comply with the Turkish Labour Code, survive a Turkish court, and lock down IP assignment for every line of code, frame of art, and asset your team produces.
The intercompany agreements that move IP and revenue between your HQ and the Turkish entity. Arm's-length, bilingual, treaty-aware, and designed to keep the service-export exemption clean.
Monthly bookkeeping under the Turkish Uniform Chart of Accounts, every statutory filing on its statutory date, run by a licensed Turkish CPA on the e-fatura and e-defter rails. Built so your investors and your CFO can read it.
Free 30-minute discovery call. We'll match the right services to your stage and come back with a fixed-fee proposal.
