Draft — pending review by Turkish counsel. Working draft for the pilot. The Turkish text (Açık Rıza Metni) will be binding; this is a convenience translation. This document is deliberately separate from the privacy notice: the Personal Data Protection Board's principle decision 2026/347 requires the information text and the consent text to be distinct documents, and consent to be given by a separate, affirmative act that is not bundled with the contract or pre-ticked.

Explicit consent text (KVKK açık rıza metni)

Version 0.1 · 24.10.2026 · Law 6698 arts. 3/1-a (definition of explicit consent), 5/1, 6/2, 9/1.

What explicit consent means here

Explicit consent is consent relating to a specific subject, given after you have been informed, by your free will. Under Turkish law it must be specific (one subject per consent), informed (you have read the privacy notice), and freely given (not a condition of a service that does not need it). It can be withdrawn at any time with effect for the future; withdrawal does not make earlier processing unlawful, but it may mean we can no longer provide the feature that depended on it.

You will only ever be asked for the consents below that your order or request actually needs. Each is a separate tick box, unticked by default, with its own short text. None is bundled with the distance sales contract or the privacy notice acknowledgement.

Consent 1 — Special-category personal data (art. 6)

Text shown at checkout: "I have read the privacy notice. I give my explicit consent to Rostu Organizasyon Danışmanlık Limited Şirketi processing the special-category personal data contained in the documents I upload for this order — specifically [criminal-record extract / medical report / health-insurance document / document showing religion or union membership, as applicable] — for the sole purpose of translating, checking and preparing the document pack for [PROCEDURE], by the contracted translator and ROSTU staff assigned to my order, and deleting it upon delivery. I understand I can withdraw this consent at any time by writing to [email protected], and that without it this particular document cannot be processed by ROSTU."

Asked only when the checklist contains such a document. Not asked for ID cards: religion and blood-type fields are masked automatically and never stored, so no consent is needed for them.

Consent 2 — Transfer of personal data abroad (art. 9)

Text shown when applicable: "I have read the privacy notice, including section 5 on transfers abroad. I give my explicit consent to the transfer of my [name, contact details, message content / the documents in this order] to [RECIPIENT — e.g. a messaging or e-mail provider located in COUNTRY] for the purpose of [communicating about my order / delivering the translated documents to me by e-mail], where no other lawful transfer mechanism is available. I understand that the country of destination has not been found to provide adequate protection by the Board, that I may withdraw this consent at any time, and that we can then communicate by [alternative channel] instead."

We use standard contracts notified to the Board as the primary mechanism; this consent is used only where a standard contract is not available for a specific recipient and you choose that channel. The list of recipients and mechanisms is available on request.

Consent 3 — Document vault and family profiles

Text: "I give my explicit consent to Rostu Organizasyon Danışmanlık Limited Şirketi keeping copies of the documents from my orders in a secure document vault after the order is completed, so that future orders can start faster, until I delete them or withdraw this consent. I understand that special-category documents are never kept, that each family member's documents are visible only to that person and to me as account holder, and that adult family members will be asked for their own consent."

Without this consent, scans are deleted 90 days after the order closes.

Consent 4 — Renewal reminders

Text: "I give my explicit consent to Rostu Organizasyon Danışmanlık Limited Şirketi keeping the expiry dates of my [residence permit / passport / health insurance / work permit / children's school documents] and sending me reminders by [WhatsApp / e-mail / SMS] before they expire. I can stop these at any time by replying STOP or writing to [email protected]."

Consent 5 — Commercial electronic messages (Law 6563 art. 6)

Text: "I agree to receive commercial electronic messages from Rostu Organizasyon Danışmanlık Limited Şirketi about procedure changes, new services and offers by [WhatsApp / e-mail / SMS]. I can withdraw at any time, free of charge, by replying STOP, through İYS (iys.org.tr) or by writing to [email protected]."

Recorded in İYS (İleti Yönetim Sistemi) as the law requires. Service messages about an order you placed do not need this consent and are sent regardless.

How consents are recorded and withdrawn

  • Each consent is logged with the exact text version, the time, the channel and the IP address, and attached to your record. You receive a copy with your order confirmation.
  • Withdraw any consent, individually, at any time: [email protected], KEP [address], the contact form, or by post to Atatürk Mah. Ertuğrul Gazi Sok. Metropol İstanbul C1 Blok 2B/101, Ataşehir, 34758, İstanbul. Processing based on that consent stops within 7 days; data kept only on the basis of that consent is deleted within 30 days unless a legal retention period applies.
  • Withdrawing consent 1 or 2 during an order may make the order impossible to complete; in that case the withdrawal and refund rules apply to the unperformed part.
  • Refusing consents 3, 4 and 5 has no effect on the service you ordered.
Last verified: 24.10.2026 · source: Law 6698; Board principle decision 2026/347 — kvkk.gov.tr; Law 6563 art. 6 and Ticari İletişim Yönetmeliği — ticaret.gov.tr

Related: Privacy notice (aydınlatma) · Distance sales contract · Pre-contract information · Cookies