Guides
How to run a GDPR and KVKK-friendly online store
Short answer
To run a GDPR and KVKK-friendly store, publish a clear privacy notice, collect only the data you need, record consent for marketing messages, let customers request a copy of their data or its deletion, use only necessary cookies or ask for consent, and keep records. Vitrula supplies the screens; your lawyer must approve the texts. This is not legal advice.
Author: Vitrula teamLast updated: Plain-text version
Steps
- 1
Map the data you collect
List what you store about customers (name, address, email, orders) and why.
- 2
Publish a privacy notice
Explain what you process, why, for how long and how customers can use their rights. Have a lawyer review it.
- 3
Handle consent properly
Ask for permission before SMS or email marketing and keep a record of it.
- 4
Prepare data requests
Customers can request a copy of their data or deletion from their account; track those requests in the dashboard.
- 5
Check cookies
Use only strictly necessary storage or add a consent mechanism for anything else.
What does Vitrula provide?
Customer data copy and deletion request screens, a cookie notice for strictly necessary storage and consent records for SMS and email.
What must I still do myself?
Write and approve your legal texts with your own adviser, register or report where the law requires it and train staff who handle customer data.
Keep reading
Frequently asked questions
Does Vitrula make my store compliant automatically?
No. It provides tools, but compliance also depends on your texts, processes and how you use customer data.
Do I need a cookie banner?
If you use only strictly necessary storage you typically need only an information notice; if you add analytics or marketing cookies you need consent. Confirm with your adviser.
Written by the Vitrula team with AI assistance and checked against the product and public vendor pages. See how we write.