KVKK explicit consent matrix · employee × scope, audit-ready
In most HR software, KVKK (Turkey's data protection law) and Occupational Health & Safety are an afterthought form. In Folkena they form an audit-ready system: explicit consent, VERBİS, data-subject rights, occupational accident reporting, risk matrix and anonymous reporting — baked into the code down to the article number of the law.
A KVKK audit starts with two questions: was explicit consent obtained (Art. 5/2) and is the VERBİS registry up to date (Art. 16). Folkena manages both in a traceable way.
Employees grant their own consent and withdraw it whenever they wish; every action leaves a trail with the IP and a self-service flag. Seven separate scopes are managed individually:
For every active employee, the latest status of all seven scopes (granted / withdrawn / never obtained) is visible in a single table. The system separately flags employees who have never given any consent — the most critical risk in an audit. If a VERBİS registry number is missing or the last update exceeded 365 days, an automatic alert appears; the entire table is handed to the auditor as a CSV with one click.
KVKK Art. 11 grants employees five rights; Art. 13 obliges the data controller to respond within 30 days. Folkena receives the request from the employee portal, queues it and tracks the deadline.
The employee learns whether their personal data is being processed and can request an export.
The employee requests correction of incomplete or incorrectly processed data.
Erasure, objection to processing and restriction of processing are recorded as separate request types.
KVKK Art. 7 and the Data Destruction Regulation: data whose period has expired must be destroyed. Folkena applies the retention policy, lists expired records and performs role-based masking.
This list shows expired records; the system does not perform actual deletion on its own. To avoid a conflict between KVKK's destruction obligation and the retention obligations of the Labour Law / Tax Procedure Law / Social Security (SGK), the destruction decision requires human approval. Folkena prepares the workflow and the queue; an authorized person presses the button.
Law 6331, Art. 14: an occupational accident must be reported to Social Security (SGK) within 3 business days. Folkena records the incident, validates the mandatory fields, automatically calculates the reporting deadline and turns overdue reports into alerts.
Recording and process branch by incident type.
Incident severity drives statistics and the mandatory-field rule.
Headcount threshold, risk score and examination schedule — all three are tracked with rules tied to the law, and delays warn you in advance.
For a tenant above the threshold, board status is reported automatically.
For each hazard, risk score = likelihood × severity (1–25).
Pre-employment, periodic, return-to-work and special examination records.
In risk assessment, active records whose review date has passed are listed separately; for periodic exams, those with an approaching due date and those already overdue (along with how many days late) are reported separately — the risk of a Law 6331 Art. 15 breach and an administrative fine becomes visible early.
From mobbing to corruption, from workplace safety to customer feedback — 10 channels. No sign-in required and — most importantly — identity is never recorded.
On this channel, IP, user-agent and identity information are never recorded. The IP is used only as a rate-limit key to prevent abuse (3 submissions per hour) and is never written to the database or the audit log. Reporting requires no auth; an employee can speak up without fear. Anonymity isn't a setting — it's the architecture itself.
Ten categories — serving as both an ethics-violation channel and a constructive-suggestion channel:
A manager's pending tasks in one inbox; the human-capital picture in numbers on a single dashboard.
Leave, advance and document requests aren't scattered across modules; an instant answer to "how many pending tasks are there."
Dashboard metrics and charts from a single query; the whole HR board live.
The approval queue is a single-stage aggregator — it brings scattered requests together, it does not set up a multi-stage authorization chain. During bulk approval, each request is verified to belong to the tenant and approved leave is automatically deducted from the balance.
An assistant that understands natural Turkish questions and gives employees and managers instant answers — across 25 defined intents.
"How much leave do I have?", "my latest payslip?", "my tenure?", "my shift this week?" — answered from their own data.
Article-backed information on topics such as annual leave, parental leave, overtime, probation and severance.
Company-wide questions are open only to authorized users.
This assistant is rule-based; it does not call a language model (LLM). It matches recognized question patterns and produces the answer directly from your own data. This has two concrete benefits: employee data is never sent to any external service (privacy) and there is no token cost (predictable spend). We don't overstate the "AI" label — what it does is clear: fast, secure, transparent Q&A.
A one-click answer to "is everything in place?" The system scans critical compliance points, scores them as OK / Warning / Error and tells you whether you're ready to go live.
All checks turn into a single-page A4 PDF audit report: tenant details, tax number, the scope of legislation covered (KVKK, 4857, 6331, 6552), the checklist and a summary score. If there are no failures, it reads "Ready for pilot launch"; otherwise the gaps are listed. Delivered to the auditor or management in one click.
In the demo, let's run the compliance health check on your own company — explicit consent, VERBİS, OHS and data-subject rights, all on a single dashboard.