GDPR (General Data Protection Regulation)
Definition
The GDPR is the European Union's General Data Protection Regulation. It applies to any business, inside or outside the EU, that sells to or tracks people in the EU, and it sets rules for consent, transparency, data access, portability, erasure, and breach notification. Fines are calculated on global turnover, so it matters to Turkish stores that ship to Europe.
Why it matters for your store
A Turkish store with a German-language storefront and shipping to Germany is inside the GDPR's scope. That brings the familiar duties: a clear privacy notice, consent that is freely given and not pre-ticked, cookie consent before non-essential tracking, and the ability to hand a customer their data in a portable format or erase it on request within a month.
Most of the work overlaps with KVKK, so a store that has done one has done most of the other. The differences are in the details: the GDPR's data portability right, its stricter view of legitimate interest, and its 72-hour breach notification, which KVKK also has.
This page is general information, not legal advice.
How Kambloo handles it
The same mechanisms that serve KVKK serve the GDPR. Consents are separate, unticked, and recorded with the text version, timestamp, and IP. Customers can download their data from their account in a portable format, which meets the portability right, and a deletion request anonymises personal fields while keeping order records in anonymised form for the retention period tax law requires.
Cookie consent for non-essential scripts is category-based, with accept and reject at equal weight. Each store's database is separate, so a deletion is complete and provable. Store deletion drops the whole database and purges files.
For EU payments, Stripe is available as an international gateway alongside the Turkish providers. The data processing agreement, sub-processor list, Turkey/EU hosting region, and 72-hour breach runbook apply to all stores.
Questions about GDPR (General Data Protection Regulation)
Does the GDPR apply to a Turkish store?
Yes, if the store offers goods to people in the EU, for example with a German storefront, euro prices, or shipping to EU countries. Location of the company does not matter; location of the customer does.
How is the GDPR different from KVKK?
They share the same structure and most principles. The GDPR is stricter on legal bases for processing, adds an explicit right to data portability, and carries larger fines. A store that meets the GDPR generally meets KVKK, with some Turkey-specific additions such as İYS.