Introduction: Public Data Does Not Equal Blanket Marketing Consent
The most widespread misconception in digital prospecting is the assumption that because a business lists its contact details publicly on its corporate website or social profile, any commercial offer may be freely sent to that address.
The Personal Data Protection Authority (KVKK) has officially declared in its Public Announcement on Manifestly Public Data: The fact that personal or contact data has been made public by the data subject does not permit unlimited processing for advertising, promotional, or cold marketing purposes beyond the original purpose of publication.
Professionals planning B2B business outreach in Turkey must navigate the intersection of two principal statutory frameworks:
- Law No. 6563 on the Regulation of Electronic Commerce (ETK) and the Commercial Communication Regulation.
- Law No. 6698 on the Protection of Personal Data (KVKK).
1. Understanding the "Merchant & Craftsman Exception" (ETK Article 6/2)
Under Article 6, Paragraph 2 of Law No. 6563, commercial electronic communications may be transmitted to merchants and craftsmen without prior opt-in consent.
However, this exception has strict statutory boundaries that every user must individually verify:
- Individual Burden of Proof: The exception does not provide blanket immunity. The sender must independently verify the merchant status of the recipient and ensure the subject of the communication directly relates to the recipient’s commercial activity.
- Directory Inclusion is Not Definite Proof: Being listed in a directory or having an
info@address does not automatically guarantee merchant status under Turkish Commercial Code. - Sole Proprietorships & Regulated Professions: Sole proprietorships, individual traders, and regulated professionals (lawyers, doctors, certified public accountants) fall under heightened personal data protection. Cold automated outreach to non-corporate entities (A.Ş. and Ltd. Şti.) should be strictly avoided.
2. Mandatory Elements of Commercial Communications
Every commercial communication must contain transparent identification details and accessible contact options:
3. The 3-Business-Day Cessation Rule & Suppression Lists
Under Ministry of Trade regulations, upon receiving an opt-out request from a recipient, the sender must cease sending commercial communications within 3 (three) business days at the latest.
Best practice protocol upon receiving an opt-out:
- Add the address/number immediately to an internal Negative Suppression List.
- Permanently exclude the record from all existing and future marketing automations.
- Retain an immutable audit timestamp proving compliance for regulatory review.
4. The User's Legal Role as an "Independent Data Controller"
MüşteriBulucu is an informational search index and public business directory, not an advertising agency or data broker. Any user extracting data from the platform and deciding on the purposes and means of subsequent communication becomes an Independent Data Controller under KVKK.
In this capacity, users must:
- Fulfill their own statutory privacy clarification (Aydınlatma Yükümlülüğü) when contacting natural persons.
- Establish a valid legal basis (such as Legitimate Interest under KVKK Art. 5/2-f) supported by a written balancing assessment.
- Enforce appropriate internal data retention and destruction schedules.