In a world governed by code and data, law must also digitalize. E-commerce platforms, SaaS companies, and game studios need a law firm that understands both software language and legal language.
Rona Legal provides fast and protective legal solutions tailored to the dynamics of the digital economy. From 2025 e-commerce withholding to 2026 return regulations, SaaS contracts to cyber crime litigation, we're with you for all your IT law needs.
E-Commerce Law and Current Changes
E-Commerce Withholding (1%) - 2025
As of January 1, 2025, 1% tax withholding is applied to marketplace sales.
Tax law support for withholding declaration and payment
Determination of legal obligations between platform and seller
Evaluation of exemptions and exceptions
Return and Withdrawal Right - 2025/2026
The practice of passing return shipping costs to consumers has been postponed to January 1, 2026.
Return shipping costs under withdrawal right belong to seller until 2026
Remember that withdrawal right for electronic products continues
Preparation of distance sales contracts in accordance with current legislation
✅ Rona Legal Service: We prepare dynamic contract infrastructures compliant with current legislation and ETBİS registered.
Software and Internet Law
SaaS and License Agreements
Comprehensive contract preparation for cloud-based software services including SLA (Service Level Agreement), data ownership, and uptime guarantees.
SLA parameters: 99.9% uptime, response time, support levels
Data ownership provisions and liability limits in case of breaches
Software license types: Perpetual, subscription, freemium models
Game Law
Contracts between developer studios and publishers, intellectual property transfer, and legal status of in-game assets.
Publisher contracts: Royalty, revenue share, milestone payments
In-game assets (NFT, skins, items) and digital property rights
Intellectual property protection for characters, music, and graphic designs
Cyber Security Law
Consulting for companies operating critical infrastructure under Law No. 7545 and SOME (Cyber Incident Response Team) obligations.
Critical infrastructure determination and notification obligations
Cyber incident reporting and coordination with SOME
Legal support in penetration testing and security audits
Cyber Crimes and Digital Forensics
Cyber Crimes and Criminal Cases
Defense and victim representation under Turkish Criminal Code cyber crimes section:
TCK 243 - Accessing Information Systems
Legal representation in unauthorized access, hacking, and unauthorized access cases.
TCK 244 - System Disruption, Data Destruction (Ransomware)
Defense with digital forensics support in ransomware attacks, DDoS, and data destruction crimes.
TCK 245 - Misuse of Bank or Credit Cards
Victim and defense representation in counterfeit cards, phishing, and online fraud cases.
Online Reputation Management
Legal proceedings against content violating personal rights under Law No. 5651:
Access blocking and content removal requests (takedown notice)
Direct communication and legal process with Google and social media platforms
Representation in defamation, slander, and personal rights violation cases
Frequently Asked Questions
❓ Can I charge return shipping to customers on my e-commerce site?
No, since the regulation has been postponed, return shipping costs under withdrawal right belong to the seller until January 1, 2026.
💡 Important: This rule only applies to products under withdrawal right. Different regulations apply for defective product returns.
❓ How do I protect my software source code?
Protection is provided through copyright protection under copyright law, confidentiality agreements (NDA) with employees and partners, and source code escrow systems.
💡 What is Escrow? A system where your source code is deposited with a trusted third party and released to customers under specific conditions.
❓ We were attacked by ransomware. What should we do?
Immediately report to the cyber crime desk (155) and do not pay the ransom. Rona Legal files criminal complaints under TCK 244 with digital forensics experts and manages the recovery process.
💡 72-Hour Rule: If systems contain personal data, notification to the KVKK Board within 72 hours is mandatory.
Protect Your Digital Assets with Legal Coverage
Contact us for expert legal consulting in e-commerce regulations, software contracts, cyber crimes, and digital rights violations.
Frequently asked questions
What is the 1% e-commerce withholding?
From 1 January 2025 a 1% withholding applies to marketplace sales in Turkey. The practical questions are who declares and pays it, how it is allocated between the platform and the seller, and whether any exemption applies to the specific arrangement.
Who pays return shipping under the right of withdrawal?
Until 1 January 2026 the return shipping cost under the right of withdrawal stays with the seller; the practice of passing it to consumers was postponed to that date. The right of withdrawal itself continues to apply to electronic products.
What is ETBİS and do we need to register?
ETBİS is the electronic commerce information system in Turkey. Whether registration is required depends on the nature and scale of the e-commerce activity, and the distance sales contract infrastructure has to match the registered position.
What should a SaaS agreement cover?
At minimum the service level (uptime target, response time, support tiers), who owns the data, what happens to it on exit, liability limits and the consequences of a breach. An SLA that promises uptime without defining measurement, exclusions and remedy is not an SLA.
Who owns the data in a cloud service?
Whatever the contract says — which is why the clause matters. Alongside ownership, the agreement should settle the provider's permitted uses, sub-processing, location of processing and the export format and window on termination.
What is regulated in game development contracts?
The relationship between the developer studio and the publisher, the transfer or licensing of intellectual property, revenue splits and milestones, and the legal status of in-game assets. Who owns the engine, the tools and the assets after the deal ends is the clause studios most often leave vague.
Do we need separate data protection advice?
Usually yes, because IT contracts and data protection obligations interlock but are not the same thing. A SaaS agreement can be commercially sound and still leave the customer without a lawful basis for the cross-border transfer it depends on.
How current are the figures on this page?
E-commerce rules in Turkey have changed repeatedly and dates shift — the return shipping change alone was postponed. Confirm the position for the period you are actually trading in rather than relying on a summary page.
Get Expert Advice
Initial assessment within the same business day, complimentary.