Personal Data in the Return Process: Core Principles Under KVKK

A return request carries far more personal data than it seems: the customer's name, phone number, email address, delivery address, order history, sometimes a photo of the product and a free-text note explaining the reason. In Turkey, each of these falls under the Personal Data Protection Law No. 6698, known as KVKK. The short answer: collect only the data the return actually needs, keep it only as long as necessary and let only the people who need it see it.

This article is general information, not legal advice. Legislation and decisions of the Personal Data Protection Board may change; consult a legal adviser about your own situation. If you also sell in other jurisdictions, their rules apply as well.

What personal data does a return involve?

Start with an inventory. A typical return flow touches:

• Identity and contact: full name, phone, email.
• Address: delivery address and, where needed, a pickup address.
• Transaction data: order number, items, amounts, return reason and outcome.
• Free text: the customer's note explaining the reason, which can contain unexpected information.
• Images: photos uploaded to show a defect or damage.
• Communication records: messages sent and the customer's replies.

Writing this list down for your own process is the foundation for every step that follows.

Core principles: the general KVKK framework

Article 4 of KVKK sets out general principles for processing personal data. They include lawfulness and fairness, accuracy and being kept up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to those purposes, and being retained only for as long as necessary. The current text of the law is available at mevzuat.gov.tr, and guidance and decisions at kvkk.gov.tr.

In the context of returns, these principles become concrete questions:

1. Why am I collecting this data?
2. Could I achieve the purpose with less?
3. When will I delete or anonymise it?
4. Who can see it?

Data minimisation: collect only what you need

If the order is already in your system, a return form should not ask the customer for their address or identity details again. An order number and one contact detail for verification are usually enough.

Practical suggestions

• For every form field, ask: "can the return really not be processed without this?"
• State what the free-text field is for, so customers are not nudged into sharing unnecessary personal details.
• Collect a phone number only if you will actually contact the customer on that channel.
• In internal reports, use order or return numbers instead of customer names.

Photo uploads

For defective or damaged items, asking for a photo is sometimes genuinely necessary. But photos can contain unexpected personal data: a face, the inside of a home, an address label or details saved inside the file, such as location.

• Ask for photos only when needed, not routinely in every case.
• Tell customers to photograph only the product and keep labels and personal belongings out of frame.
• Where possible, remove those hidden details from the file on upload.
• Store photos in access-controlled storage, not behind public links.
• Delete photos once the case is closed and the necessary period has passed.

Retention and disposal

Keeping personal data indefinitely "in case it is useful later" does not fit the principle of keeping it only as long as necessary. At the same time, tax, commercial and consumer legislation may require certain records to be kept for set periods.

Steps toward a retention policy

1. Define the purpose and retention period for each type of data.
2. Handle records with a legal retention duty (such as invoices) separately.
3. Delete, destroy or anonymise data when its period ends.
4. Do this through a regularly running process rather than by hand, and keep a record of it.

The return statistics you need for analysis (reasons, products, resolution types) can often be kept without linking them to a person.

Access control and security

Article 12 of KVKK requires the data controller to take appropriate technical and organisational measures to prevent unlawful processing of and access to personal data. In a return process this means:

• Role-based access: someone who only reviews reports does not need to see customer phone numbers.
• Encryption: choose tools that store and transfer customer details encrypted.
• Audit trail: track who accessed or changed which record, and when.
• Suppliers: if carriers, messaging providers or software vendors process data on your behalf, put contracts in place that spell out their obligations.

Transparency and data subject rights

Customers must be informed about the purposes and legal grounds for which their data is processed (KVKK Article 10). Linking a short, clear privacy notice next to the return form is good practice. People also have rights over their data, such as requesting information, correction and deletion (Article 11); define an internal process to answer those requests. In the event of a data breach there is also a duty to notify the Board and the people affected, so prepare a response plan in advance.

Personal data in Revoop

In Revoop, customers' personal data is stored encrypted and never in readable form. Merchant panel users are separated by role. See the FAQ for more.

Conclusion

A return may look like a small transaction, but it touches a lot of personal data. Start with an inventory, collect only what you need, take extra care with photos, define retention periods and restrict access by role. These steps help you meet your obligations and protect the trust customers place in you.