Turkish data protection (KVKK) and your club

In short

• Using a service whose servers are outside Türkiye counts as a transfer of personal data abroad.
• The tool the Board published for a club and its software provider is the Standard Contract 2 (controller to processor). It is signed, then notified to the KVKK within five business days.
• Health information, such as a sports health report, is special-category data. For a child, the Board's decisions look to the consent of the parent who has custody.

Data kept outside Türkiye

In its decision 2020/404, the Personal Data Protection Board described the use of services whose servers are abroad as a transfer of personal data abroad. Paak's servers are in France, so keeping your members on Paak is such a transfer. The transfer rules are in Article 9 of the KVKK, as amended in 2024, and in the Regulation on the transfer of personal data abroad (Official Gazette of 10 July 2024, no. 32598). Paak read that Regulation in the version published on kvkk.gov.tr and has not compared it article by article with the Official Gazette text.

The standard contract

The Board published four standard contracts (decision 2024/959). Standard Contract 2 covers a data controller (your club) and a data processor working on its behalf (here, Paak). What the KVKK texts and announcements say about it:

• It is used without any change, and the Turkish text governs.
• It is notified to the KVKK within five business days of the last signature, on paper, by registered e-mail (KEP), or through the KVKK's Standard Contract Notification Module.
• The parties may say in the contract who notifies. If they do not, the party that sends the data, your club, notifies.
• The notification carries documents showing that the signatories may represent and sign for each party, and both signature dates are written on the contract.

The contract texts are on the KVKK's site, on the page of its 10 July 2024 announcement on standard contracts and binding corporate rules. Paak does not reproduce them here: they must be used as published.

VERBİS registration

The Board exempts associations under the Associations Law (No. 5253) from registering in VERBİS, the data controllers' registry, as long as they process data only in line with their legislation and purposes, within their field of activity (decision 2018/32 as amended by decision 2020/315). The exemption does not cover an association's economic enterprise (iktisadi işletme). Whether it covers a club set up under the Sports Clubs Law (No. 7405) rather than the Associations Law is not settled in the texts Paak read: check it for your club.

Health data and children

Health is special-category data under Article 6 of the KVKK. The Board's decision 2018/10 lists the measures it expects for such data, among them storage with cryptographic methods. In a 2020 case about a school (decision 2020/255), the Board held that processing children's health data had to rest on explicit consent, and in decision 2022/776 it looked to the consent of the parent.

Under the Sports Health Reports Regulation of 11 August 2026, the sports health report or the health status document is submitted to the provincial directorate of youth and sports and can be seen on e-Devlet; Paak found no rule that a club keeps a copy. So in Türkiye, Paak lets your club record the dates of a member's health document, not the document itself.

What Paak does, and does not do

• Paak keeps your club's data on OVHcloud servers in France.
• Paak signs Standard Contract 2 with your club on request: write to contact@paak.club. Paak does not notify the KVKK on your club's behalf.
• Paak does not register your club in VERBİS and does not collect consent on your club's behalf.
• Your club can export its data as CSV. On a member's request, Paak anonymises the member's record (write to contact@paak.club), as described in GDPR.

FAQ