B2B website visitor identification in Turkey

Turkey is neither an EU nor an EEA member, so the GDPR does not apply there directly; instead Turkey runs its own comprehensive statute, the KVKK — Law No. 6698 on the Protection of Personal Data — in force since 2016 and closely modelled on earlier European data protection law. The structure will look familiar to anyone who has worked with the GDPR: a lawful basis is required before processing, data subjects hold rights of access and objection, and a processor acts strictly on the controller's documented instructions. Treating the KVKK as a direct translation of the GDPR understates real differences, particularly around the registration duty and cross-border transfer conditions, which follow their own Turkish procedural rules rather than the GDPR's adequacy and standard-clause mechanisms. For company-level website visitor identification, the practical starting point in Turkey is the same question as anywhere else — is personal data of an identifiable individual involved — but the answer has to be documented against KVKK vocabulary and KVKK Board guidance specifically, not against GDPR case law, if it is going to hold up in a Turkish legal review.

Enforcement sits with the Kişisel Verileri Koruma Kurumu, commonly called the KVKK Authority, and its decision-making body, the Kurul, which issues binding decisions, published guidance and administrative fines for non-compliance. The Kurul's decisions function similarly to how GDPR case law and European supervisory guidance shape practice elsewhere: a Turkish legal or compliance team consulted on a new vendor will typically check the vendor's stated positions against specific Kurul decisions on legitimate interest, cross-border transfer or registration duty rather than against the bare statute. That habit means a vendor able to point to how its processing activity maps onto a relevant Kurul decision, rather than offering a generic compliance statement, tends to move through a Turkish review with fewer follow-up questions. The Kurul does not pre-certify vendors or products, and no seal or badge substitutes for the controller's own documented assessment; lead.box supports that assessment with a data processing agreement and technical documentation rather than making the KVKK determination on the customer's behalf.

The KVKK establishes VERBİS, the Data Controllers' Registry, and certain data controllers operating in Turkey are obliged to register there and describe, at a general level, the categories of personal data they process and the purposes behind that processing. Whether a specific organisation falls under this duty depends on criteria the Kurul has set, including factors such as headcount, annual data volume and whether special category data is processed, and that determination is made case by case rather than by a fixed universal threshold. This page deliberately does not state a threshold or claim that any customer is, or is not, obliged to register, because that assessment belongs to the controller and depends on facts about the controller's own organisation that lead.box does not hold. What lead.box can describe is the processing itself: company-level identification, without advertising identifiers or device fingerprints, so that whoever runs your VERBİS assessment has an accurate, specific description of this particular activity to work from rather than a vague vendor characterisation.

The KVKK sets its own conditions for transferring personal data abroad, separate from the GDPR's adequacy decisions and standard contractual clauses, and those conditions were substantially revised by amendments that took effect in September 2024, replacing the earlier permission-based regime with a structure closer to, though still distinct from, the GDPR's own transfer mechanisms. Under the amended rules a transfer abroad can rely on an adequacy decision for the destination country, on Kurul-approved safeguards such as standard contractual clauses adapted to Turkish requirements, or on binding corporate rules, with notification duties to the Kurul depending on the mechanism used. lead.box processes data concerning the EU in ISO-certified EU data centres, which keeps that data within a defined, documented location, but classifying any particular flow out of Turkey under the amended KVKK transfer rules, and choosing the correct safeguard mechanism for it, remains an assessment the Turkish data controller has to make for its own processing activities rather than something a vendor can pre-clear on the controller's behalf.

The KVKK recognises a legitimate interest basis for the data controller that is structurally comparable to Art. 6(1)(f) GDPR, and it is the basis most Turkish organisations rely on for company-level website visitor identification, since the processing serves a clear business purpose — recognising which organisations are researching a supplier — without imposing a disproportionate burden on any individual, because no individual is actually identified. As with the GDPR-based frameworks in neighbouring markets, relying on this basis is expected to be documented rather than asserted: a short written note explaining the purpose, the categories of data involved and why the interest is not overridden by an individual's rights is the kind of record a Turkish compliance reviewer or, in an audit, the Kurul itself would expect to see. Because identification here resolves a company rather than a person, that balancing exercise is comparatively straightforward, but skipping the documentation step and only relying on a vendor's general assurance is the gap that most often draws follow-up questions in a Turkish procurement review.

lead.box resolves an anonymous website visit to the name of the visiting organisation using network-level signals, principally the IP address range associated with a business connection, matched against a maintained company-to-network database; the process does not create or store a cookie, a device fingerprint, an advertising identifier or a cross-site profile, and it does not attempt to identify the individual employee behind a visit. The output delivered to a customer is limited to the company name, an approximate location and the pages viewed during that visit, not a person's name, role or contact details, which is the distinction that keeps this processing activity at the company level rather than the individual level under KVKK terminology. A meaningful share of visits, particularly from residential or mobile connections and from organisations without a dedicated business IP range, cannot be resolved to a company at all, and lead.box does not substitute an estimate or a guess for those visits; unresolved traffic is simply left unidentified rather than presented as a match.

Turkish exporters and manufacturers commonly run a compact commercial team tracking a defined set of named international accounts rather than a large inbound funnel, and CRM discipline ranges from structured Salesforce or HubSpot deployments to lighter spreadsheet-based tracking maintained by the sales office itself. lead.box exports identified companies as CSV or Excel files for that kind of manual review, or pushes matches by webhook into whichever CRM a team already relies on, so the identification layer slots into existing habits rather than requiring the business to adopt a new platform. For teams working export accounts largely by phone, email and in-person visits, a simple weekly export naming which international companies viewed which product or technical pages is often more actionable than a live dashboard, particularly where the buying committee on the other side is a foreign engineering or procurement team evaluating suppliers before making direct contact.

Getting started requires adding a single JavaScript snippet to the site, after which identified companies typically begin appearing within the first days of traffic, without any waiting period tied to a contract term or involvement from a hosting provider beyond a code or tag-manager edit. Accuracy follows the same underlying constraint everywhere the product runs: identification depends on a visit originating from a network range that can be matched to a specific organisation, and traffic from mobile networks, home connections or organisations sharing infrastructure will frequently not resolve to a named company, a limitation that is stated plainly rather than minimised. Teams can add colleagues as additional seats, export lists as CSV, Excel or JSON at any point, and connect a webhook to hand qualified companies to a CRM without manual re-entry; if the tool does not prove useful, cancellation is handled through self-service account settings rather than a notice period or a retention call, which matches the lower-commitment way many Turkish exporters prefer to trial new software before scaling it up.