KVKK consent records (consent ledger)
How Hotspotly records which version of the privacy notice, terms of use and marketing consent a guest accepted at every login, when consent is asked again and how records serve as evidence.
On the login page a guest confirms having read the privacy notice, accepts the terms of use and, if offered, optionally gives marketing consent. Hotspotly writes these confirmations to an immutable consent ledger. For writing and publishing the texts see Legal texts.
Legal review
The platform template texts were prepared without legal advice. Have a lawyer competent in KVKK review them before going live.
What is written at every login
Every accepted document creates one ledger row:
| Field | Description |
|---|---|
| Document and version | Which document type (Privacy notice, Terms of use, Marketing consent) and which version |
| Language | The language the guest saw |
| Content hash (SHA-256) | Hash of the text shown to the guest (with the business name filled in) |
| Accepted | For marketing consent: given or not given |
| Hotspot, guest, identity | Which login the consent belongs to |
| Method, MAC, IP, time | The login method (SMS, Google, trusted device …) and connection data |
Rows cannot be updated or deleted. A published document version cannot be changed either; editing opens a new version. So the question "did this guest see this text on this date" can always be answered.
Consent rules
- The guest cannot sign in, or request an SMS code, before ticking the privacy notice and terms boxes (the guest is informed before the phone number goes to the SMS provider).
- Marketing consent is unticked by default and is never a condition of login. Consent not given is recorded as "not given" too.
- If a new version is published while the page is open, the guest is asked to reload; consent to the old text is not recorded.
- If the ledger cannot be written, the login stops (no login without consent).
When consent is asked again
- When you publish a new version of a document or withdraw it (the platform template applies again), guests are asked to consent again at their next login.
- When a platform template is updated, consent is asked again on every hotspot using it.
- A guest returning with a trusted device ticks the boxes before Continue if the documents changed;
if they did not change, the current versions are written again with the
trusted devicemethod. See Trusted devices.
Using records as evidence
Version history in the panel shows each version's publish date and Hash (SHA-256); the hash in a guest's consent record matches this value.
Consent records screen
A panel screen to list and export the ledger by guest or date is coming soon. If you need a particular guest's consent record today (a data subject request or a complaint), write to support; the platform administrator extracts it, leaving an audit trail.
Retention
The retention period and destruction rule for consent records will be set with legal advice; today records are not deleted. Retention of Law 5651 access records is separate (2 years): see Law 5651 records.