We collect customer data on our website, what are the disclosure statement and privacy policy?

you need to write a disclosure text, man. it's kvkk stuff. open a privacy page write who processes your data and for what purpose. google analytics needs explicit consent, cookies policy separate. make the customer tick a checkbox...

KVKK Disclosure Statement elements: 1) Identity of the Data Controller (company name, contact), 2) Processing purposes (list all), 3) Legal basis (cite Articles 5-8), 4) Data categories (list them), 5) Recipients (list the parties), 6) Retention period, 7) Rights (Article 11 - access, correction, deletion, restriction, portability, objection), 8) Right to complain (Data Protection Authority), 9) Consequence of not providing information (if mandatory). Google Analytics: Separate consent (consent management platform - CMP integration, e.g., OneTrust, Cookiebot). Cookie Policy: Similar structure, cookie types (functional, analytical, marketing), retention, third-party providers.

you need to write a privacy notice kvkk requires it. there are templates online — from tbb and the kvkk guide. put it on the page, make the customer tick the checkbox. write google analytics and cookies policy separately. itll be long but its important — missing it means lawsuits...

Privacy Notice structure: 1) Title (Privacy Notice / Privacy Policy) 2) Effective date 3) Data Controller info, 4) Processing purposes (detailed list) 5) Legal basis (KVKK article reference) 6) Data categories and sources 7) Recipients and sharing, 8) Retention periods, 9) Data subject rights (Article 11) 10) Right to lodge a complaint 11) Automated decision-making (if applicable) 12) Version history. Consent: Explicit opt-in checkbox + pre-ticked = INVALID (must not be ambiguous, requires affirmative action). Cookies: CMP (Consent Management Platform) integration for banner and consent tracking. Accessibility: Plain language, readable font size.

Following. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Correct me if I'm wrong.

We got stuck at the same point for a while. Start with a small trial; don't commit to everything at once.

Of course, it varies if your situation is different.

I've been dealing with this for a long time. If permission and scope aren't in writing, don't start that test.

That's all, sorry if I went on too long.

There's also a measurement aspect to this. If you don't write this down from the start, it leads to arguments later.

Correct me if Im wrong.

The opposite happened to me, that's why I'm writing. If permission and scope aren't in writing, don't start that test.

Correct me if I'm wrong.

The cheap-looking path usually ends up costing more later. Everyone rushing into preparing a disclosure text gets stuck at the same point.

I've been down this road, let me tell you. Having backups accessible on the same network and with the same identity makes them part of the target.

Good luck with that.

Thanks for posting.

I'd say don't rush. Your time to detect an issue directly determines its cost.

Taking measures without an inventory leaves doors you haven't seen open.

Good call starting this thread.

This is exactly what we experienced. Processes without records never improve, because you don't know what to fix.

Of course, it varies if your situation is different.

Just a heads-up. Most incidents start with a leaked password, not a vulnerability.

Everything goes well for the first three months; problems arise in the fourth. That's all, sorry if I went on too long.

if you're going this route, sort this out firts then anyway everything goes well for the first three months; problems arise in the fourth.

just leaving this note, it might be useful.

Saved.