KVKK data deletion request: self-service within 24 hours

KVKK Article 11 (Turkey’s data protection law) and GDPR Article 17 give people the right to ask for their data to be deleted. On paper it is a simple right; in practice, in most software it waits behind a support ticket and a deletion run by hand. In inTusell a KVKK data deletion request is self-service: the request starts in the panel, enters the queue right away and deletion runs as a nightly job. This post explains how the flow works and what is deleted and what is kept.

Quick answer

Who is it for?

inTusell is an AI sales assistant and CRM that answers messages on WhatsApp, Instagram and web chat and books appointments and opens orders, so it processes your customers’ personal data. This post is for:

• Business owners who want to close their user account or business account
• Teams that get a "delete my data" request from a customer
• Officers who run the KVKK compliance process and need to explain the deletion flow to an auditor

Three ways to delete

When you delete the business account, the screen clearly says the action cannot be undone and asks you to type the business name before you continue.

What happens in the background?

The request is written to the deletion queue right away. The deletion job runs once a day, at night, and deletes data in dependency order:

messages → conversations → deals → contacts → products → orders → audit → business account

That is why deletion starts within 24 hours at most, well within the 30-day response period under KVKK. Once the request is in the queue it cannot be cancelled. Promising a "cancellable deletion" would be misleading, because deletion is irreversible.

Data that is deleted and data that is kept

Deleted or cleared: messages, conversations, deals, contacts, products, orders; in a per-contact deletion, the name, phone, email, custom fields and message bodies. Uploaded media files are removed from storage.

Kept:

• Financial records: invoices, collections and payment ledger records are under legal retention. The record stays, but its link to the person is removed; personal fields read from a receipt, such as the sender name, recipient name and description, are deleted, while the amount, date and bank reference stay.
• Consent records and the trace of the deletion request itself: who gave which permission and when the deletion request was processed are kept because of the duty to prove it.

Retention periods are also managed by a recorded policy: categories such as technical logs and audit trails are deleted, or have their personal content cleared, every night once their period ends. The audit log is kept for 365 days.

Before deleting: download your data

The Download My Data (KVKK) section on the My business › Business Info page gives you your data in the system (profile, customers, conversations, messages, appointments, orders, audit log) as a single JSON file. This is how the right of access under KVKK Article 11 and GDPR Article 15 is met; you can download it at most once a day.

Toward your customers: notice and consent

Deletion is the last step of the data life cycle; it begins with notice and consent:

• Legal notices: in this section on the same page you enter the address of your own KVKK privacy notice page. The first-contact KVKK note, the opt-out line in promotional messages and the recording notice on voice calls are on by default; your customer gets your link, not inTusell’s.
• Consent per channel and purpose: a customer may allow WhatsApp promotions but not SMS. When a customer writes "STOP" ("DUR" in Turkish), their consent is withdrawn right away and pending follow-ups are cancelled.
• Consent portal: you send the customer a time-limited link so they can manage their permissions without creating an account. This page manages only permissions; it does not delete data. A deletion request comes to you and you process it the way described above.

What it is not

• It is not reversible archiving. A request in the queue does not come back.
• It is not a tool that deletes financial records. Records that the law requires you to keep are kept, and this is stated clearly.
• It is not a portal where the customer deletes data on their own. You are the data controller; the request comes to you.

Frequently asked questions

How quickly is a deletion request processed?

The request enters the queue right away. Because the deletion job runs every night, deletion starts within 24 hours at most; that is well within the 30-day response period under KVKK.

Can I undo a deletion request?

No. Once the request enters the queue it cannot be undone; this is a deliberate choice, because deletion is irreversible. Read the warning that shows what will be deleted carefully before you start.

Which data is deleted and which is kept?

Messages, conversations, deals, contacts, products and orders are deleted; in a per-contact deletion the name, phone, email, custom fields and message bodies are cleared, and uploaded files are removed from storage. Financial records such as invoices and collections stay because of the legal retention duty, but their link to the person is removed.

Can I download my data before deleting it?

Yes. The Download My Data (KVKK) section on the My business › Business Info page gives you your profile, customers, conversations, messages, appointments, orders and audit log as a single JSON file. You can download it at most once a day.

What should I do if my customer asks for their data to be deleted?

As the data controller, you receive the request and delete the person from their contact card; the result shows in the panel. The consent link you can send to the customer manages only promotional permissions; it does not delete data.

Next step

You can read how personal data is processed on the KVKK and privacy pages, and find help articles in the support center. If your business processes special category data, such as a clinic, the clinic guide shows the legal notice steps one by one. If you have a question, write to hi@intusell.com.