KVKK Fines for Loyalty Cards: Real Examples and Board Decisions

⏱️ Reading time: 14 min · 📁 Category: KVKK & Digital Compliance

KVKK Fines for Loyalty Cards: Real Examples and Board Decisions

Loyalty card systems are widely used in retail to build customer loyalty.
However, because they also provide infrastructure for processing personal data,
they are among the high-risk activities under KVKK.

In recent years, in connection with loyalty card programmes, customer databases,
campaign systems and transactions using phone numbers,
the KVKK Board has imposed numerous administrative fines.

This guide uses practical examples to explain real KVKK fines and Board decisions
concerning loyalty card systems.

1️⃣ Why Do Loyalty Card Systems Incur Fines? 🔑 Main reason:
Loyalty card systems are often viewed as a marketing tool,
but legally they are personal data processing systems.

Loyalty card programmes typically process the following data:

• Name and surname
• Phone number
• Email address
• Shopping history
• Location and store data
• Responses to campaigns

All of this data is considered personal data under the KVKK.

2️⃣ Fines for Sending Marketing Messages Without Explicit Consent

Sending marketing messages to loyalty card holders without explicit consent
is one of the most frequently penalised activities.

• SMS campaigns
• Email campaigns
• Discount notifications
• Personalised ads

Example of an actual violation:

Phone numbers collected when customers joined a loyalty card programme
were used for advertising SMS messages.

The Board determined that this practice constituted marketing without explicit consent
.

Under KVKK, making a purchase or signing up for membership
does not mean permission has been given to send marketing messages.

3️⃣ Fines for Transactions Using Phone Numbers

Recently, the KVKK Board has placed particular emphasis on treating loyalty card use via a phone number
as a high-risk activity.

• Obtaining a discount by stating a phone number at the checkout
• Shopping with someone else's number
• Use of loyalty points by third parties
• Issuing an invoice in the wrong person’s name

Board approach:

A phone number alone is not an authentication method.

Loyalty card systems without a verification mechanism
may be considered a data security violation.

4️⃣ Fines for Missing or Incomplete Privacy Notices

Missing or incomplete privacy notices on loyalty card membership forms
can lead to administrative fines.

• No privacy notice
• Privacy notice absent from the membership screen
• Not specifying transfers
• Failure to state processing purposes

Actual violation:

During a loyalty card application,
the user was not given a privacy notice.

Under KVKK, privacy information must be provided when the data is collected.

5️⃣ Penalties for Data Security Violations

Loyalty card databases are among the areas where data breaches occur most frequently.

• Leaks from the customer database
• Unauthorised access
• Weak encryption
• Failure to retain logs

Example of an actual violation:

A loyalty card database became accessible
to unauthorised parties.

Such cases are considered a data security breach under Art. 12 of the KVKK.

6️⃣ Penalties for Data Transfer to Third Parties

Loyalty card systems often work with third-party software.

• CRM systems
• Email services
• SMS providers
• Marketing agencies

Actual violation:

Loyalty card data was transferred to marketing firms,
but this was not stated in the privacy notice.

This can be considered illegal data transfer.

7️⃣ Highest Risks of Fines

In loyalty card systems, the following violations carry the highest penalty risk.

• Marketing without explicit consent
• Transactions using phone numbers
• Data leak
• Data transfer abroad
• Missing or incomplete privacy information

📌 Critical fact:

Loyalty card systems are among the first areas examined
in KVKK audits.

8️⃣ The 2026 Approach of the KVKK Board

As of 2026, the KVKK Board classifies loyalty card systems
among high-risk personal data processing activities.

Transactions using phone numbers,
campaign systems and marketing activities
receive particular attention in audits.

9️⃣ KVKK Compliance Checklist

• ✔️ Privacy notice
• ✔️ Explicit consent mechanism
• ✔ Verification system
• ✔ Data security analysis
• ✔ Transfer analysis
• ✔ KVKK documentation

🧠 Expert Conclusion

Loyalty card systems are one of the areas where KVKK penalties are most frequently applied.

Older systems, especially those based on transactions using phone numbers,
present serious risks under the KVKK approach in 2026.

Properly structured loyalty programs prevent administrative fines
and protect brand reputation.

Request a KVKK Risk Analysis for Loyalty Cards