WhatsApp Bulk Messaging, IYS and KVKK: General Information
This article is for general informational purposes only and does not constitute legal advice. Legislation is subject to change, and rules may apply differently depending on your business type, the content of the message you send, and the recipient. Seek legal advice specific to your situation before launching a campaign.
Businesses that send bulk messages to customers via WhatsApp generally need to consider two key areas: the rules regarding commercial electronic communications and the Message Management System (İYS), as well as the Personal Data Protection Law (KVKK) concerning the protection of personal data. In this article, we explain what these two topics entail, highlight common points of confusion for businesses, and share a practical checklist.
The Difference Between the Two Topics
| Topic | What does it regulate? | Key Question |
|---|---|---|
| Commercial Electronic Communications Legislation and the IYS | Electronic communications sent to promote goods and services | Is there permission to send commercial communications to this person, and does the right to opt out apply? |
| KVKK | Processing of personal data | For what purpose and on what legal basis am I processing and storing this data? |
Compliance with one requirement does not automatically satisfy another. For example, just because a person has given consent to receive commercial messages does not mean you can use their data without restriction.
What Is a Commercial Electronic Message?
Generally, electronic messages intended to promote goods or services, market your business, or increase sales fall under this category. Discount announcements, new product launches, and campaign messages are typical examples. Clarify with your advisor how messages sent via apps like WhatsApp should be classified.
On the other hand, notifications related to an existing transaction—such as an order being shipped or an appointment time—may be treated differently. However, including promotional content in a notification message can turn it into a commercial communication. The line between the two may not always be clear.
What Is the IYS?
The Message Management System (İYS) is a centralized system where commercial message permissions are recorded and recipients can manage their permissions. Recipients can view their permissions and opt out. Service providers’ obligation to register with the system may vary depending on the business’s status and the type of messages sent. Check the IYS’s latest announcements and consult your advisor to determine your specific registration and submission obligations.
WapFlow does not have an integration with the IYS. The block list in the panel does not serve as a substitute for IYS registration. It only helps prevent messages from being sent to numbers that have opted out in your own campaigns.
Important Considerations Regarding Consent
- It is important that consent be verifiable. Record when, where, and for which channel it was given.
- The channel must be clearly specified. Consent obtained for email may not cover WhatsApp.
- Do not use a pre-checked box. Let the person check it themselves.
- Avoid tying the service to consent. Keep purchase and marketing consent separate.
- Use clear language. The person should know what kind of messages they will receive.
Be aware that certain rules may apply differently if the recipient is a business or merchant. Do not assume whether this applies to you—ask your advisor. The right to opt-out is also important for these types of recipients.
Right to Opt Out and Exit Path
Recipients must have the option to opt out of receiving commercial communications. In practice, this means:
- Include an easy opt-out option in every marketing message.
- Process opt-out requests without delay.
- Apply the opt-out request not only to that specific campaign but to all your communications.
- Record the request and do not accidentally send messages to that person again.
In WapFlow, under Settings > Delivery and Security, the “Automatically Block ‘STOP’/‘DUR’” option adds people who use the keywords you specify to the block list and prevents campaign messages from being sent to them. If Auto-Tagging is enabled, replies classified as “unsubscribed” may also be added to the list. This setting is disabled by default—be sure to enable it.
Basic Questions Regarding the KVKK
A customer’s name and phone number are personal data. During the bulk messaging process, answer the following questions:
- Information Notice: Have you informed individuals why you are processing their data and with whom you are sharing it?
- Legal Basis: On what grounds are you processing the data? Explicit consent may be required for marketing purposes.
- Purpose Limitation: Are you using the phone number you collected for an appointment for advertising purposes?
- Retention Period: How long do you retain the data, and do you have a deletion process in place?
- Security: Who has access to the Excel files?
- Transfer: In which country do the software programs you use process the data? Cross-border data transfers may be involved.
- Requests: What will you do if a person requests that their data be deleted?
Obligations such as VERBIS registration vary depending on the business’s size and type.
Risks Based on the Source of the Individual List
| Source | Assessment |
|---|---|
| Customer who has given consent on the form | The most reliable source—keep a record of the consent |
| Customer who has made a purchase from you | Marketing consent may not be automatic—please verify |
| Someone who has written to you | You can respond to the inquiry; future promotions should be evaluated separately |
| Group member | Being in a group does not imply permission to send private messages |
| Google Maps and the Internet | Being public does not grant permission to send commercial messages |
| Purchased list | High risk—do not use |
The Google Maps and Data Extraction tools in WapFlow help collect information; they do not grant permission. Responsibility lies with the business using the tool. You can find our recommendations on this topic in the Google Maps article.
Artificial Intelligence and Third Parties
Your messages pass through the WhatsApp infrastructure. If you use AI-generated responses, customer messages are sent to your chosen provider using your own API key. Read the provider’s data policy and consider these types of services in your privacy notice. The dashboard also requires your liability consent for such operations.
Practical Checklist
- Review your commercial messaging and KVKK compliance with your legal advisor.
- Clearly include the WhatsApp consent in your customer forms.
- Record the date and source of the consent.
- Update your privacy notice.
- Review your list sources and remove those with unclear consent.
- Enable the “Stop” option and include an opt-out link in every marketing message.
- Determine which team members will have access to personal data.
- Write your retention and deletion policy.
For steps related to sending, refer to the bulk messaging guide; for text examples, see the template document.
Notes on the Sample Consent Text
Prepare your consent text with your legal advisor. The points you need to address generally include: your company’s name, the channel through which messages will be sent, the type of content to be sent, and how the individual can withdraw their consent. The text should be short and clear, and should not be hidden among other contract clauses.
Internal Team Rules
To ensure these rules aren’t just on paper, everyone on the team must be aware of them. Put in writing who is authorized to export the contact list, who can launch a campaign, and who should be notified when a person requests data deletion. Explain these rules to new employees on their first day. Including a brief confirmation step that asks for the list source before launching a campaign reduces the risk of accidentally sending messages to people without permission.
Frequently Asked Questions
Is WapFlow integrated with an IYS?
No. WapFlow does not have an IYS integration. Your business must manage this process separately.
Can I send an unsolicited campaign to my existing customers?
The answer to this question depends on the situation. Instead of making assumptions, seek legal advice.
Do I need to keep a record for someone who texts “STOP”?
The block list retains the number. Consult your advisor regarding your official record-keeping obligations.
How much are the fines?
Amounts are subject to change and vary depending on the situation. Check with official sources and your advisor for the most up-to-date information.
