KVKK, Türkiye's data-protection law, and the pincer it puts our buyers in

No Solidus product is KVKK-compliant, and no independent audit says otherwise. We hold no VERBİS registration.

What it is

KVKK, Kişisel Verilerin Korunması Kanunu, Law No. 6698, passed in 2016, is Türkiye's general data-protection law, and the acronym is used in practice for both the law and the authority that enforces it, the Kişisel Verileri Koruma Kurumu.

It was modelled on the EU framework that preceded the GDPR, and enforcement practice has converged toward GDPR-style expectations since. It requires a lawful basis for processing, treats biometric data used to identify a person as a special category, exactly as GDPR Article 9 does, grants individuals access, correction and erasure rights, and backs all of it with administrative fines the board can levy directly.

Like GDPR, it applies to us today rather than being a gate that switches on later, because our pipeline processes Turkish residents' identity documents and biometric captures right now.

The pincer, which is the part worth reading

Turkish hotels are legally required to report every guest's identity to the police notification system. The Kurul has separately ruled that a hotel photocopying and retaining a guest's full identity document as routine practice is excessive collection under the data-minimisation principle.

Both obligations land at the same front desk, pulling in opposite directions: submit the required fields, but do not hoard the document they came from. And the obvious workaround, copy it anyway, file it away in case someone asks, is itself the liability, not the safe default.

This is the clearest real-world statement of the problem selective disclosure is shaped for: prove the fact, without handing over the document. We are not going to pretend it is more than that.

Bounding it honestly: that ruling concerns hotels, not us. It is not an endorsement of any vendor, we build no hotel or KBS integration, and reading a regulator's decision as a recommendation of our product would be exactly the kind of borrowed authority this site exists to avoid. The Kurul publishes its decisions at kvkk.gov.tr, read them directly rather than take a vendor's paraphrase, including ours.

What exists on our side, and what does not

Exists, in code: retention windows on stored personal data, defaulting to 30 days for identity documents, selfies and voice audio, with a purge sweep that deletes the stored object and then the row. That is storage limitation as a mechanism.

Does not exist: no VERBİS registration, the mandatory data-controller registry, no published KVKK-specific processing documentation, no data-protection officer appointed under Turkish law, and no independent audit of any of it.

A mechanism is not a program, and we would rather say so than let a retention default stand in for compliance.

Why this page is in English only

Our Turkish content lane is not open, and this page is a good illustration of why. Legal vocabulary is where machine translation fails most visibly, and a Turkish compliance reader would judge it hardest, on a page about Turkish law. Publishing a machine-translated version would be worse than publishing none, so we have not.

Where reuse helps, and where it stops

Fewer verifications means fewer copies of the same identity document sitting in fewer companies' storage. Under a principle that treats excessive retention as the violation, that is a real argument, and it is the same one the hotel ruling makes from the regulator's side.

It does not discharge your obligation. A business subject to KVKK remains its own data controller with its own lawful basis, its own records and its own registration duties, and whether accepting a third-party credential satisfies a given requirement is unsettled. Reuse reduces copies; it does not move accountability.