Controller and operating owner
Identify who determines each use, who implements it, who answers people, and who approves the notice, legal basis, or consent approach. Keep organisations and technical accounts distinct.
Data bridge / owner before mechanism
Do not let personal data cross an unnamed span.
Engineering needs an approved map of purpose, fields, roles, notices, suppliers, locations, lifecycle, requests, security, and incidents. KVKK research starts a question; it does not let the builder declare the answer.
Fields, notices, and choices
Inventory direct input, device and log data, cookies, messages, files, inferred values, and backups. Tie every field to a purpose and current reviewer-approved wording.
Vendor and overseas route
Document hosting, analytics, communications, support, AI, identity, and subcontractors, including locations and proposed transfers. The responsible owner obtains any required professional review.
Retention, deletion, and requests
Specify access, correction, export, objection or request handling, retention triggers, backup expiry, deletion proof, and who can authorize an exception.
Security controls and evidence
Set least privilege, authentication, credential storage, encryption decisions, logging, dependency review, recovery tests, and administrator procedures against a named threat and owner.
Incident route
Define who receives an alert, preserves evidence, limits exposure, communicates internally, involves advisers or authorities, and decides whether service can resume.
Use the Personal Data Protection Authority (KVKK) as a current official starting point. Faith Forge Labs can implement approved controls; it is not Turkish counsel, a data-protection authority, or a compliance certifier.
First trace
Follow one person's record through every supplier.
A field-level journey makes vague privacy language testable and exposes where a responsible decision is still missing.