In brief
The phone number a guest enters for Wi-Fi is collected for a record required by law. It cannot become a campaign list. Purpose limitation, plainly, and what the portal consent covers.
A question we hear often
"Guests already enter their numbers; can we send them campaign SMS as well?" The question is not ill-intentioned. A business collects some data and wants to benefit from it. But the answer is clear: no. Even if the data is the same, the permission is not.
This article explains why in plain terms. At the end you will find what the portal consent covers and how to keep marketing permission separate if you want it.
Two purposes, two legal bases
A guest's phone number can be collected on the portal for one of two reasons:
| Access record | Marketing consent | |
|---|---|---|
| Purpose | Recording who connected to the network | Sending the guest advertising, campaigns, announcements |
| Basis | The record-keeping duty Law 5651 places on a public access provider | The guest's explicit, separate, informed consent |
| Duration | Kept 2 years, then deleted | Until the guest withdraws; every message needs an opt-out |
| Who sees it | Only an authorised role, masked; authorities on request | The marketing team, the messaging tool in use |
| If refused | No internet; the record cannot be kept | Internet is still provided; only no messages are sent |
The last row matters most. A guest who does not want marketing must still be able to get online. If you say "no consent, no Wi-Fi", that consent does not count as freely given. Even when the same number appears in both columns, each column belongs to a separate legal world; one cannot serve as the basis for the other.
What purpose limitation means
One of KVKK's core principles is purpose limitation: personal data is used for the purpose it was collected for. A number collected for the access record exists to build the record the law expects. Moving the same number to a campaign list takes the data outside the purpose it was collected for.
An everyday comparison: your building's security camera footage is kept for theft investigations. Mining the same footage for "which customers come at which hour" changes the purpose of the recording. The data is the same; the purpose has changed; the basis has collapsed.
What the portal consent covers
On the Hotspot-Box portal the guest sees a privacy notice before login and an explicit consent record is kept. That consent covers whatever the text says. In a standard set-up the text explains:
- That the phone number, device MAC address, internal IP and session times will be recorded
- That the record is kept under a legal obligation
- That it is kept for 2 years and then deleted
- That it is shared with no one except authorised bodies
There is no marketing in that text. So you cannot send campaign SMS on the strength of that consent. Squeezing "I agree to hear about your offers" into the same text is not a fix either; collecting consent for two different purposes with a single checkbox risks invalidating the consent.
The right way if you want marketing consent
If you want to send commercial messages, set it up separately from the access record:
- A separate consent: an unticked, separate checkbox or a separate step. It must not be required to get online.
- A separate text: what will be sent, how often, through which channel and how to opt out.
- A separate record: who consented, when, and to which text. Also confirm with your adviser whether commercial message consents must additionally be registered in a central system.
- A separate tool: send from a messaging tool that manages those consents; do not turn the access record file into a list.
The box does none of these four steps for you, and we do not hide that. The access record file is not designed for export to a marketing tool; the ZIP archive exists to answer an official request.
Example scenario
Picture a patisserie. The owner wants to use the guest numbers collected over two years for a holiday campaign. The adviser asks: "What did these people give you their number for?" Answer: to connect to the Wi-Fi. "Did they know they would receive campaigns?" No. Then the list cannot be used.
The right set-up would look like this: a separate checkbox is added to the portal that is not required to get online; the consent of guests who tick "I want to hear about offers" is kept in a separate record; sending is done from a messaging tool. The access record file is never touched. The holiday campaign goes only to those who consented; everyone else keeps using the Wi-Fi exactly as before.
What about the survey and announcement feature?
The box can show a survey or an announcement to the guest on the portal. That is content displayed on the portal page while the guest is on the network. It does not send a message to their number and does not turn the record into a list. It is enough for "today's special is..." or "would you rate our service?", and it needs no marketing consent because it does not reach the person; it stays on the page.
Why we are this strict
Two reasons. First, you are the data controller; the consequences of misuse land on you, not on us. Second, guest trust. Someone who gives a number for Wi-Fi and receives a campaign SMS the next day loses trust in the business and never joins the network again. Keeping the legal record as a legal record is better for compliance and for business.
For help with your portal text, contact us. Common questions are answered in the FAQ.
This article is for general information only and is not legal advice.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.