bt_bb_section_bottom_section_coverage_image

Customer Loyalty and Retention Programs in Turkey

Customer Loyalty and Retention Programs in Turkey

Customer Loyalty and Retention Programs in Turkey

Two things make loyalty marketing in Turkey different from the markets most foreign brands come from, and both are easy to miss until they cost you.

The first is competitive. Turkish consumers already carry loyalty currency — the points, instalment offers and campaign benefits attached to their bank credit cards. A new brand programme does not enter an empty space; it competes with a rewards layer the customer already uses at almost every merchant.

The second is regulatory, and it is recent. Turkey’s Personal Data Protection Authority has issued a principle decision specifically on loyalty card programmes, with a compliance period for data controllers. Alongside it sits a 2025 principle decision that directly prohibits a practice many retailers had built into enrolment: using an SMS verification code to obtain commercial electronic message consent at the same time.

For a foreign brand, that combination means a loyalty programme in Turkey is a data compliance project with a marketing purpose, not the other way round. This guide covers the competitive landscape, what the current rules require, how to design a consent architecture that survives inspection, and which retention mechanics actually work with Turkish consumers.

Table of Contents

Why retention matters more in Turkey

Retention is always cheaper than acquisition. In Turkey three local conditions sharpen that.

Price sensitivity is structural. Turkish consumers compare actively before buying, and price comparison platforms sit in the purchase path as a distinct layer — as our guide to Akakçe and Cimri describes. Every purchase is contestable, which makes a reason to return commercially valuable rather than merely nice.

Acquisition costs are volatile. Media costs in lira move with inflation and exchange rates, so the cost of replacing a lost customer is unpredictable in a way it is not in a stable-currency market. An existing customer is a hedge.

Switching is easy. Marketplace-led shopping means competitor products sit one screen away, and in many categories the brand is not the unit of choice at all.

The practical consequence is that a foreign brand entering Turkey should plan the retention mechanism at launch rather than adding it in year two. The cost of doing so is mostly compliance work, and that work has a lead time.

The loyalty layer you are competing with

This is the structural point foreign brands most often miss.

In Turkey, the most widely used loyalty mechanics are attached to bank credit cards rather than to merchants. Major Turkish card programmes operate points schemes, merchant campaign networks and instalment offers that apply across large numbers of retailers. A consumer paying with a Turkish credit card is already earning something, already receiving campaign notifications, and already accustomed to a rewards balance they can spend in many places.

Three implications for programme design:

  • A generic points programme has a weak proposition. Offering points the customer can spend only with you, at a modest earn rate, competes poorly against points they can spend almost anywhere.
  • Card campaign participation may outperform your own scheme in reach and cost, particularly early on. Whether that route is available depends on your category, your acquiring relationship and commercial negotiation with the bank.
  • Differentiate on something banks cannot offer. Product access, service level, expertise, community, early availability and category-specific benefits are defensible. A discount is not.

Because the mechanics, earn rates and merchant terms of card programmes change and are commercially negotiated, treat the landscape as something to scope with your payment provider and acquiring bank rather than something to assume. The payment side of this sits in our guide to payment methods and checkout localization for Turkey.

What KVKK now expects of loyalty programmes

Loyalty programmes are, by definition, personal data processing operations. Turkey’s Personal Data Protection Board has moved from applying general principles to addressing loyalty schemes specifically.

The Board has issued a principle decision addressing loyalty card programmes, reported as coming with a compliance period for data controllers to bring their practices into line. Legal commentary on the decision describes its focus as ensuring that loyalty transactions cannot be carried out by third parties without the data subject’s knowledge — in other words, that the identification and verification architecture around a loyalty account is proportionate and fit for purpose.

Commentary on the decision draws out several practical expectations:

  • Verification design is the responsibility of the controller. The Board’s approach is described as not mandating a particular technology but requiring a verification architecture that prevents unauthorised third-party use, proportionate to the purpose. Controllers are expected to conduct their own risk analysis and choose a suitable mechanism.
  • Loyalty transactions should be logged. Records of each loyalty transaction, including indicators of suspicious activity such as repeated attempts or unusual amounts, support demonstrating lawfulness in an inspection.
  • Membership, marketing and additional service consents must be managed separately, with straightforward withdrawal.

Because this is a recent decision with an implementation period, confirm the current text, the exact deadline and what it requires for your specific programme with Turkish data protection counsel. This article describes the direction of travel; it is not a compliance specification.

The wider framework is covered in our guide to KVKK compliance for foreign brands marketing in Turkey.

The enrolment practice that is now prohibited

This one deserves its own section because it invalidates a specific enrolment flow that had become standard in Turkish retail.

The Personal Data Protection Board’s principle decision numbered 2025/1072, dated 10 June 2025, addressed the widespread practice of collecting contact details during product and service transactions and sending an SMS verification code, where that verification step was used simultaneously to obtain consent for commercial electronic messages.

The decision’s conclusions, as set out in legal analysis of it, are direct:

  • Combining distinct processing activities into a single action must stop. Accepting a membership agreement, permitting personal data processing and obtaining commercial electronic message consent are different activities and cannot be bundled into one confirmation.
  • Separate options must be offered. Where processing requires explicit consent, data subjects must be given separate choices and consent must be obtained independently for each activity.
  • Consent for commercial messages cannot be a precondition of the product or service. Making marketing consent a condition of supply is not permissible.
  • The verification code is for verification. Using an SMS verification step as the mechanism for obtaining marketing consent raises doubt about whether valid consent was given at all.

If your Turkish enrolment flow asks a customer to confirm a code that simultaneously signs them up, consents them to data processing and opts them into marketing, that flow needs rebuilding. For foreign brands deploying a global loyalty platform, this is frequently a configuration that ships by default.

Is a members-only discount lawful?

A reasonable question follows from all of this: if consent cannot be made a condition of service, can you offer a discount only to loyalty members?

The Board’s position, as reported in legal commentary, has been that a loyalty-card-specific discount does not amount to imposing consent as a condition, provided it does not remove access to the basic product or service. A decision from 2019 is cited for that view, and a 2023 decision is described as confirming a similar approach in the context of a frequent flyer programme — finding that participation was not required to access the basic flight service, that the programme provided an additional benefit, and that the free-will element of consent was therefore not impaired.

The principle that emerges is workable: a loyalty programme may offer additional benefits, but it may not make the core product or service conditional on joining or on consenting to marketing. Members get more. Non-members still get the product.

The practical test for a programme design is whether a customer who declines every consent can still buy what you sell, on normal terms. If the answer is no, the design needs revisiting — with Turkish legal input, since the assessment is fact-specific.

Pulling the above together, a defensible Turkish loyalty enrolment separates four things that global platforms typically merge.

Element What it covers Design requirement
Membership agreement Terms of the programme itself Its own acceptance step
Data processing consent Processing requiring explicit consent Separate, specific, informed, freely given
Commercial message consent Marketing by email, SMS, call Separate option; not a precondition of supply; recorded in İYS
Additional services Profiling, third-party sharing, extra features Separate consent per purpose

Three further design points. Withdrawal must be as easy as giving consent, which means a visible, functioning opt-out rather than an email address nobody monitors. Information must be provided before consent is taken, not alongside it. And consents should be recorded in a way that lets you demonstrate what was agreed, when and how — which is an infrastructure requirement rather than a legal one.

Building enrolment, consent capture and loyalty account infrastructure that meets these conditions is CRM and application work rather than campaign work, and it is the kind of build that sits within CRM and mobile application capability such as Medyae’s. The point is practical: a global loyalty platform configured for another jurisdiction will not satisfy this by default.

İYS and loyalty communications

Loyalty programmes generate messages, and in Turkey commercial electronic messages are governed by a separate regime from data protection.

Under Law No. 6563 and its associated regulation, commercial electronic messages to consumers require prior consent managed through İYS, the national message management system. That is an operational obligation with registration and timing requirements, not merely a legal standard, and consent obtained under KVKK does not substitute for it.

Two practical points for a loyalty programme. Transactional messages — a points balance, an order confirmation, an account notification — sit differently from promotional ones, and the boundary is worth getting a legal view on rather than assuming. And where a message mixes the two, it is generally treated as the more regulated category.

Our guide to email marketing in Turkey covers the deliverability and platform side, and marketing automation platforms in Turkey covers tooling. This article is about what the programme should do; those cover what runs it.

Programme design for Turkish behaviour

Beyond compliance, some design choices simply work better in this market.

Immediate value beats deferred value. In an inflationary environment, points accumulating toward a distant reward lose real worth while the customer holds them. Faster earn-and-burn cycles, or benefits realised at the next purchase, are more persuasive than a long ladder.

Express value in what it buys, not in points. An abstract points balance is hard to evaluate when prices move. Showing the equivalent benefit concretely is clearer.

Tiers work where status is visible. Recognition-based tiers perform in categories where the benefit is experienced publicly or in service terms. In pure-price categories they add complexity without pull.

Non-monetary benefits are underused. Early access, extended warranty, priority service, expert support and community access differentiate against a bank points programme in a way a discount cannot.

Align with the Turkish calendar. Ramadan, Black Friday and local seasonal peaks reshape purchase timing, and a loyalty calendar that ignores them misses the periods when members are most active — see our Ramadan and Black Friday marketing calendar for brands in Turkey.

Retention channels that perform

Where retention communication lands matters as much as what it says.

Messaging is the strongest channel. Turkish consumers are comfortable with business messaging, and it carries better attention than email for time-sensitive communication — see our guide to WhatsApp Business marketing in Turkey. Consent and İYS obligations apply here as elsewhere.

Email remains useful for structured communication — statements, programme updates, longer content — where messaging is better for immediacy.

An app changes the economics if there is a reason to open it. A loyalty programme alone rarely justifies an app, but where an app already exists, it removes recurring messaging costs and gives you a direct surface.

Service quality is the retention mechanism. No programme compensates for slow responses or unresolved problems. In Turkey, where complaints surface publicly and quickly, service performance and retention are the same conversation.

Measuring retention in an inflationary market

Retention measurement needs adjusting for Turkish conditions, or it will mislead you in a specific and predictable direction.

Lira-denominated customer value inflates on its own. Average order value and lifetime value rise in nominal terms without any behaviour change. Deflate using price index data or measure in a stable currency before concluding that value per customer is growing.

Measure frequency and units, not just spend. Purchase frequency and units per customer are inflation-proof measures of whether the relationship is strengthening.

Use cohorts, not aggregates. Aggregate retention rates hide the effect of acquisition mix. Cohort analysis by join period shows whether the programme is actually changing behaviour.

Hold out a control group. The hardest question in loyalty is whether the programme changed anything or simply rewarded customers who would have returned anyway. A holdout is the only reliable answer.

Getting the analytics foundation right for Turkey — currency handling, segmentation, conversion configuration — is a common failure point covered in our GA4 and marketing analytics setup guide for Turkey.

Common mistakes

Deploying a global loyalty platform unchanged. Bundled consent flows are usually the default and are not compliant here.

Using an SMS verification code to collect marketing consent. Directly addressed by the Board’s 2025 principle decision.

Making the core product conditional on joining or consenting. Additional benefits for members are workable; withholding the basic service is not.

Competing on points against bank card programmes. You will lose on breadth of redemption.

Long earn ladders in an inflationary market. Deferred value erodes while the customer holds it.

Treating KVKK consent as covering İYS. They are separate regimes with separate mechanics.

Reading nominal lira LTV growth as improvement. Inflation produces it without any behaviour change.

Running a programme without a holdout group. You cannot otherwise show it works.

A 90-day plan

Weeks 1–4: compliance first. Get Turkish data protection counsel to review the loyalty principle decision against your intended programme, including the compliance deadline. Audit your enrolment flow for bundled consents. Map which processing relies on consent and which on other legal bases. Establish İYS obligations for your planned communications.

Weeks 5–8: design. Separate membership, data processing, commercial message and additional service consents into distinct steps with working withdrawal. Design the benefit around something a bank points programme cannot offer. Build verification and logging appropriate to your risk profile. Define the metrics and the holdout group before launch.

Weeks 9–12: launch narrow. Start with a limited member base rather than a full rollout. Read cohort behaviour against the holdout. Measure frequency and units alongside spend. Expand only once the mechanic demonstrably changes behaviour rather than rewarding existing habits.

Frequently asked questions

Do loyalty programmes in Turkey have specific data protection rules?

Yes. Beyond the general KVKK framework, the Personal Data Protection Board has issued a principle decision addressing loyalty card programmes, reported as including a compliance period for data controllers. Commentary on it emphasises proportionate verification architecture preventing unauthorised third-party use of loyalty accounts, logging of loyalty transactions, and separate management of membership, marketing and additional service consents. Confirm the current requirements and deadline with Turkish counsel.

Can I collect marketing consent through an SMS verification code?

No. The Board’s principle decision numbered 2025/1072, dated 10 June 2025, addressed exactly this practice. Distinct processing activities cannot be combined into a single confirmation, separate options must be offered for activities requiring explicit consent, and consent for commercial electronic messages cannot be made a precondition of providing the product or service.

Can I offer discounts only to loyalty members in Turkey?

Generally yes, within limits. Board commentary indicates that a loyalty-card-specific discount does not amount to imposing consent as a condition, provided it does not remove access to the basic product or service — an approach reported in a 2019 decision and confirmed in a 2023 decision concerning a frequent flyer programme. The workable test is whether a customer who declines all consents can still buy your product on normal terms.

Does KVKK consent cover commercial messages?

Not as a substitute. Commercial electronic messages are governed separately under Law No. 6563 and administered through İYS, which carries its own registration and timing obligations. Treat data protection and commercial messaging as two compliance exercises.

Why do points programmes underperform in Turkey?

Because Turkish consumers already hold loyalty currency through their bank credit cards, redeemable across large merchant networks. A single-brand points scheme competes against that breadth and usually loses. Differentiating on access, service, expertise or category-specific benefits is more defensible than competing on earn rate.

How should I measure loyalty programme performance in Turkey?

Deflate lira-denominated values or measure in a stable currency, since nominal customer value rises with inflation regardless of behaviour. Track purchase frequency and units per customer alongside spend, analyse by cohort rather than in aggregate, and maintain a holdout group so you can distinguish programme effect from existing habit.

Conclusion

Loyalty in Turkey rewards brands that treat it as infrastructure rather than as a campaign. The competitive reality is that your customers already earn rewards somewhere else, which means a generic points scheme is a weak proposition and the differentiation has to come from something a bank cannot replicate. The regulatory reality is that enrolment flows, consent architecture and verification design are now specifically supervised, with a recent principle decision on loyalty card programmes and a 2025 decision that invalidates a common enrolment shortcut.

For a foreign brand, the practical sequence is compliance, then design, then launch — in that order, because rebuilding an enrolment flow after launch means re-consenting a member base you have already acquired. Get the consent architecture right, build the benefit around access and service rather than discount, measure against a holdout in inflation-adjusted terms, and the programme will do what retention programmes are supposed to do in a market where every purchase is contestable.

This article is general information based on published legislation and reported regulatory decisions as at the date shown. It is not legal advice. Data protection decisions, compliance deadlines and commercial messaging rules change, and the treatment of any specific programme depends on its facts. Confirm your position with qualified Turkish legal advisors before acting.