When a guest scans the QR in their room and a page opens on their phone, it feels effortless. Behind that simple moment, though, sit obligations a hotel cannot set aside: personal data is touched, cookies may be set, and access to an online page is being made. In Türkiye two frameworks shape this ground — KVKK, the personal-data protection law, and Law No. 5651, on internet publications and access logging. This article explains, in plain terms, what a guest-facing QR system should keep in mind and how a platform can be built with these obligations in view. It is general information rather than legal advice; for your own situation, speak with your advisor.
What a guest-facing QR touches
A guest page can look like a simple menu or an information card, but the moment it opens on a phone it enters regulated territory. KVKK governs how personal data is handled and expects the guest to be informed and, where needed, to give consent — which is why a cookie-consent step and a clear privacy notice matter. Law No. 5651 concerns online publications and the keeping of access records. Neither is paperwork for its own sake; both exist so the guest is informed and the operator can later show that access happened in an orderly way. A platform built with these in view spares the hotel from bolting compliance on after the fact.
Cookie consent and a privacy notice for guests
The first thing a guest should meet is transparency. On the guest side, a cookie-consent banner and a privacy notice let the guest see what is in use and make a choice before anything non-essential runs. The notice explains, in plain language, what data the page handles and why; the banner records the guest's preference. Presented in the guest's own language, this is not a hurdle — it is the mark of a property that takes privacy seriously, and it sets the right tone for the rest of the digital experience.
Access logging in line with Law No. 5651
Law No. 5651 is best known for the expectation that access to online content is logged and kept in an orderly way. In practice this means that when guest pages are served, a record of that access exists rather than vanishing. Building it in matters because it is very hard to reconstruct afterwards: either the logs were kept as access happened, or they were not. A guest-facing platform that keeps access logs in line with Law No. 5651 gives the hotel this record as a matter of course, without anyone on the team assembling it by hand.
Encryption at rest and sanitised content
Compliance is not only about the guest-facing surface; it also lives in how the system stores and handles data. Two safeguards do quiet but important work here:
- Secret keys encrypted at rest: sensitive values such as integration keys are stored encrypted with AES-256, so that even at the storage layer they are not sitting in plain text.
- Guest-entered content sanitised: any content that will be rendered — including text that may carry markup — is sanitised before display, which closes the door on a page being turned against its own visitors through injected code.
Neither of these is visible to the guest, and that is rather the point: they protect the experience from underneath, so the surface can stay simple.
Compliant by design, managed from one panel
The value of putting these pieces together is that compliance stops being a scramble. The cookie consent and privacy notice, the access logging, the encryption and the content sanitising are part of how the platform works — not switches someone has to remember to turn on. Where a page should not be open to everyone, you can also place it behind an encrypted, password-protected QR, so only guests with the password see what is behind the code. And because the whole thing is white-label, all of this runs under your own brand, colours and domain, identically across every property in a group.
Peace of mind with Avdena
Avdena QR is built with these obligations in view. Guest pages come with a cookie-consent banner and a privacy notice, access is logged in line with Law No. 5651, sensitive keys are stored encrypted at rest with AES-256, and guest-entered content is sanitised before it is shown. You manage it all from one panel, in your own language and under your own brand — so you can focus on the guest experience while the groundwork is handled underneath. This remains general guidance rather than legal advice; for obligations specific to your property, speak with your own advisor.
If you want a guest-facing QR setup that treats privacy and security as part of the design, take a look at our QR Content Management page, and plan the restaurant and menu side together with QR Menu.