In brief
Terms of use and the KVKK privacy notice are not the same document. The difference between them, a clause outline for the terms, and where each text belongs on the portal.
A guest Wi-Fi portal usually carries two texts: the terms of use and the KVKK privacy notice. Many venues put both behind a single "I accept the terms" box and blend the contents. The result is a long document nobody reads and neither text doing its job when needed. This post clarifies the difference, gives a clause outline for the terms of use, and explains where each text sits on the portal.
Two texts, two jobs
| Terms of use | Privacy notice | |
|---|---|---|
| Its question | "How may I use this service?" | "What happens to my data?" |
| Its source | The venue's own rules (contractual) | The data controller's duty to inform (KVKK) |
| Its content | Scope, limits, prohibitions, liability, suspension | Controller identity, which data, which purpose, legal basis, transfers, retention, rights |
| When it changes | When the venue decides | When processing changes |
| Acceptance | The guest accepts | The guest is informed; consent is a separate step |
The last row is the critical one. A privacy notice is not something that is "accepted"; it is presented to the guest and must be readable. If some processing needs explicit consent (marketing communication, for example), that is a separate checkbox and is not mixed with accepting the terms. In Hotspot-Box the portal shows the privacy notice and keeps the consent record separately; you can place the two texts as separate links.
Clause outline for the terms of use
The outline below is a starting point. Fill each clause for your venue and show it to your legal adviser.
1. Parties and scope
The venue providing the service, what the service is (guest internet access), who may use it (guests on the premises).
2. Access and verification
How sign-in works: an SMS code sent to a mobile number; coupon or e-mail if offered. The guest's statement that the number provided is their own. If you use device memory, the information that the device will reconnect for a set period without a new code.
3. Limits of the service
Speed, session length, idle timeout, device count and daily quota, with numbers. If your fair-use policy is a separate document, link to it here.
4. Prohibited uses
Unlawful content, blocking other users' access, attempts to interfere with the network or other devices, activity harming the rights of third parties. Keep it short and general; do not write a long list of offences.
5. Nature of the service
That the service is free and provided "as is"; that no uninterrupted service or specific speed is guaranteed; that the venue may limit the service for maintenance or load.
6. The guest's responsibility
Security of their own device, their own accounts and passwords, the actions they take over the network. That the guest network is separate from the venue's network, and that open networks still call for care with sensitive transactions.
7. Suspension and termination
The venue's right to end a session that breaks the rules and, if needed, to prevent the device from signing in again.
8. Record keeping
That connection records are kept as required by applicable law; that the data processed is explained in the privacy notice; that visited sites and content are not recorded. The reference to legislation should be brief here; detail belongs in the privacy notice.
9. Changes
That the terms may be updated, that the current version is published on the portal, and the effective date.
10. Contact
E-mail or phone for questions and complaints.
What belongs in the privacy notice
This post is about the terms of use, but a short list makes the difference clear: the identity of the data controller, the data processed (phone number, MAC address, internal IP, session times), the purpose (service delivery and legal obligation), the legal basis, recipients (including sending the SMS to the provider), retention period (2 years for the records), the data subject's rights and how to exercise them. In Hotspot-Box the phone number is stored encrypted and shown masked in the panel; when a guest's request arrives, the KVKK request management and anonymisation tools are used. Those details go in the privacy notice, not in the terms.
Where each text goes on the portal
| Item | Place | Form |
|---|---|---|
| Terms summary | Sign-in screen | One line: speed, duration, quota |
| Full terms of use | Link from the sign-in screen | Separate page, own heading |
| Privacy notice | Separate link from the sign-in screen | Separate page; "I have read", not "I accept" |
| Explicit consent (if any) | Separate checkbox on the sign-in screen | Unchecked by default, stating what it is for |
| Quota and duration reminder | Post-login screen | Announcement area, one sentence |
Two links fit on one line: "Terms of use · Privacy notice". Keeping the consent box apart from them improves both readability and the clarity of the record.
Common mistakes
- Making guests "accept" the privacy notice and counting that as consent.
- Listing article numbers and regulation names in the terms; the text grows and guests stop reading.
- Promising things that are not done: content filtering, uninterrupted service, a specific speed.
- Writing "unlimited" while applying a quota.
- Leaving the texts in one language; if you host foreign guests, add an English version. The box sends SMS to foreign numbers too, so the text should reach them as well.
See Box + Software for portal branding and text areas, and the FAQ for short answers on records and data. If you want help placing your texts on the portal, write to us.
This article is general information and is not legal advice. Show the texts to your legal adviser before publishing them.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.