The Turkish Data Protection Authority (KVKK) has issued a Principle Decision dated 11 February 2026 (No. 2026/266) concerning the use of loyalty card programs in Turkey. The decision addresses the risk that a loyalty card holder’s phone number or loyalty card number may be used by third parties during purchases without proper verification. The decision is particularly relevant for retailers, supermarkets, e-commerce platforms, restaurant chains, and other businesses operating customer loyalty programs in Turkey.
Background of the Decision
Many loyalty programs in Turkey allow customers to obtain discounts, collect points, or benefit from promotions simply by providing their phone number or loyalty card number at the point of sale.
