KVKK compliance
As the data controller, use EnaFeedback in line with KVKK: privacy notices and consent text, contact fields, retention, and handling erasure requests.
The organization that uses EnaFeedback is the data controller for visitor and staff data under Turkey's Personal Data Protection Law No. 6698 (KVKK). ENA Innovation is the data processor that processes this data on your behalf and on your instructions. This article explains how, as the data controller, you set up EnaFeedback in line with your KVKK obligations.
Not legal advice
This article describes product settings and is not a legal opinion. Make decisions on privacy notices, explicit consent and retention periods together with your organization's KVKK officer or legal team.
Required role
Module settings (contact fields, consent text) are open to the Owner and Administrator roles; visitor data wipe and factory reset to the Owner role only.
Who does what
| Party | KVKK role | Responsibilities |
|---|---|---|
| Your organization | Data controller | Decides what data is collected, why and for how long; informs data subjects; answers data subject requests |
| ENA Innovation | Data processor | Provides the service and processes data on your instructions |
| Sub-processors | — | Hosting (Huawei Cloud), network and TLS (Cloudflare), admin identity (Logto), email (Resend), SMS (NetGSM), AI (Google Gemini behind the ENA AI Gateway) |
If you connect your own provider account (SendGrid, SMTP, Twilio, Bird, Firebase, OpenAI, Anthropic and so on), that provider comes in by your choice.
Step-by-step KVKK setup
Decide which contact details to collect
Under Module management, you can turn the name, phone and email fields on or off, and make them required, separately for the visitor and staff feedback modules. By default the visitor form has name and phone on, email off, and nothing required. Submissions are anonymous by default; a visitor can tick "Add my contact details" if they want. For data minimization, turn on only the fields you really need.
Write your consent / notice text
EnaFeedback does not ship a default consent text. The consent checkbox appears only when you have written consent text (HTML) and at least one contact field is enabled. Prepare your notice with your legal team.
Use the consent question in surveys
The Consent question type is a checkbox that always sits at the bottom of a survey, and its default text refers to KVKK. Adapt the text to your organization.
Limit what teams can see
Visitor contact details are shown in full to anyone who can see the feedback. Assign roles and resolution team membership on a least-privilege basis.
Set your retention periods
Feedback, tickets, scans and IP records are not deleted automatically. Plan periodic clean-ups according to your retention and destruction policy.
Consent is not recorded
Whether a visitor ticked the consent box is not stored. Required fields and the consent box are enforced in the visitor form. If a process requires you to prove explicit consent, plan an additional method.
Data subject requests
- Access: find the record on the Feedback screen by the visitor's request code (starting with FB) and export that single ticket as a PDF.
- Erasure: there is no per-person erasure function for visitors. Erasure is possible only through the bulk visitor data wipe or a full factory reset, and both keep the audit tables. You can talk to our support team to plan how you will handle a single person's erasure request.
- Staff: deleted staff keep their name, email and phone in the system because of soft delete.
Data you should know about
- IP addresses are stored in plain form in scan records and audit entries.
- ENA Cloud logs the IP address and browser information for every QR, NFC and display redirect.
- Visitor photo, video and voice attachments can contain faces or voices.
- AI invocation logs do not store prompt content.
Deleting data at the end of the service, and exporting it on request, is an operational commitment of ENA Innovation under the contract. For personal data requests: support@enainnovation.com.
Related articles
Can't find what you need?
Our support team can help with anything from setup to reporting.
Security and data
Learn where EnaFeedback hosts your data, how each customer gets a dedicated stack, what is encrypted or masked, and how long each kind of data is kept.
Common problems
Fixes for QR codes that do not open, the wrong organization's screen, NFC tags that will not read, forgotten personnel codes, missing alerts and exports.