July 10, 2026 · Updated: July 22, 2026

KVKK and Free Online Tools: What Should You Watch For?

A practical checklist on personal-data risk, client-side processing, and mindful use of free PDF and image tools under Turkish data-protection rules.

Sözleşmeler Editör Ekibi · İçerik editörü

KVKK
privacy
online tools

This guide is provided in English for reference. Document templates and tools linked below open on their Turkish pages — generated contract and petition text stays in Turkish (see the note on the English home page).

A free tool doesn't mean risk-free transfer

Searches like "free PDF merge," "free background removal," or "free CV builder" are extremely common online. Some of these tools process the file in the browser without uploading it to a server; others take the file into their own infrastructure. Users can't always tell the difference from the interface. Under Turkey's KVKK, the critical question is: is personal data being transferred to a third party, and if so, is the legal basis and the security adequate?

This article is not a legal opinion. Its purpose is to clarify the questions individuals and small businesses can ask when choosing a free tool. For official guidance and current legislation, consult the resources of the Turkish Personal Data Protection Authority (KVKK Kurumu).

Which files carry personal data?

ID documents, addresses, phone numbers, emails, payslips, health records, student documents, contracts, customer lists, invoices and CVs — most of these can contain personal data, or even special-category personal data. A company-letterhead proposal can also carry trade secrets. What feels like "I'm just merging one page" is, in fact, a data-processing activity.

Special-category data (such as health data) especially requires greater care. Avoid uploading these kinds of documents to unfamiliar sites. Where possible, process them locally or with client-side tools, and redact information when sharing.

Questions to ask when choosing a tool

Is the file uploaded to a server? Is the privacy policy readable? Is the data stored abroad? Can it be used without creating an account? Is there a post-processing deletion promise, and is that promise verifiable? Is it clearly stated that it runs in the browser (client-side)? If there's no answer to these questions, look for an alternative.

The PDF, image and CV tools on the Sözleşmeler platform are designed around the approach that file and form data are processed on your device without being uploaded to a server. Even so, the security of your browser, device and downloads folder remains your responsibility. Read the KVKK and Privacy pages to check the scope.

A mini policy for small businesses

Write down which tools staff should use for which operations. Even a simple rule like "no random free PDF sites" cuts a lot of risk. Before processing a customer document, ask whether it's actually necessary; remove pages that aren't. Clean up sessions and downloads on shared computers.

In your privacy notices, describe how documents are processed accurately, without overstating it. Instead of absolute statements like "no data is ever processed," say which data is processed, where, and for how long. If you keep logs, analytics or support records, be transparent about those too.

Practical checklist

1) Does the document actually contain necessary personal data? 2) Can a client-side tool be used? 3) Does the file name contain personal data? 4) Is the recipient of the share correct? 5) Were local copies cleared once the job was done? 6) Are the policies up to date? These six questions meaningfully improve day-to-day operations.

Conclusion: free tools boost productivity; careless use raises the privacy cost. The combination of choosing the right tool, minimizing data, and having a transparent policy is a concrete step on the KVKK compliance journey. The PDF tools, image tools and CV builder hub pages on this site are a good starting point for anyone who wants to process their documents on their own device.

More guides

This article is for general information only and is not legal advice.