ETBİS registration and legal requirements for e-commerce sites
ETBİS registration, the details your store must publish, the required contracts and message consent: a practical order for building an e-commerce legal skeleton.
A small home-textiles seller in Ankara launched their store in three weeks: clean product photos, a courier contract in place, ad budget live. At the end of the first month a customer asked for a refund, the two sides disagreed, and the case went to the consumer arbitration board. What surfaced there had nothing to do with the product. The site had no pre-contractual information form, the distance sales contract was never wired into checkout, and the company details in the footer were half-written. The selling side was built beautifully; the legal skeleton was never built at all.
This is a roadmap for building that skeleton in the right order. It covers what ETBİS is and why it exists, who falls within scope, what to prepare before applying, which details and which documents your site must carry, where marketing-message consent fits, how responsibility splits when you sell on a marketplace, and what keeps running after registration. One note up front: ETBİS is specific to Türkiye. If you sell from another country, ask your own advisor which equivalent register or notification duty applies to you. We deliberately give no thresholds, amounts, penalties or dates — scope and thresholds change with legislation; confirm your own case against the Ministry of Trade's official source and with your accountant or lawyer.
What ETBİS is and why it exists
ETBİS is Türkiye's central information system for electronic commerce. Its purpose is straightforward: to make visible who is selling online, under which legal entity, and through which domain. A shopper should be able to verify that the store in front of them belongs to a real business, and the public side should be able to see who the active players in e-commerce actually are.
In practice it does two things. Registration: service providers and intermediary service providers link their domain to their business details. Notification: certain information about the activity is declared periodically. It is not a one-off formality but a living record, expected to stay current as your details change.
Think of it less as a permit and more as identity verification. ETBİS does not grant you the right to sell — incorporation already did that. It binds that right to the digital address where you exercise it.
Who falls within scope?
The most common misreading is "I'm small, this doesn't apply to me." Scope follows the environment you sell in and the role you play far more than revenue. Three typical situations clear up most of the confusion.
Selling from your own website
If you sell goods or services through your own domain, you are the service provider and the direct addressee of the obligation. Whether the store runs on a hosted platform or your own server makes no difference; what matters is that the order and the payment complete on your domain.
Selling through social media
Selling regularly and commercially through Instagram, TikTok or WhatsApp is not a hobby. Even when the shop window is a social profile, the activity itself is electronic commerce. The test is continuity and profit intent — where both exist, tax and administrative duties exist with them.
Selling as a marketplace seller
If you run a store on a platform such as Trendyol, Hepsiburada or Amazon, the platform carries its own record as an intermediary service provider, while you remain the service provider selling through it. Its registration does not automatically dissolve yours. Because the approach and the details reported centrally have shifted over time, recheck this distinction every year.
In e-commerce, scrutiny does not arrive when you grow. It arrives with the first complaint — and building the legal skeleton before the first order is always cheaper than retrofitting it.
What you need before you apply
The application is a short task when you arrive prepared and a multi-week drag when you don't. Close this file before you sit down to it:
- Business registration: Your tax record as a sole trader or company, your trade registry details, and an activity description that genuinely covers online retail.
- Domain ownership: The domain must be registered to the business and ownership must be technically verifiable; if it still sits in a founder's personal account, fix that first.
- Registered electronic mail: A registered electronic mail address plus a corporate mailbox is the only reliable way for official notices to reach you — a personal inbox will not do the job.
- Contact details: A real phone number, a real address, and a channel where customer messages are actually read — the same details you will publish on the site.
- Authorized signatory verification: Having the person who files the application able to sign electronically or with a mobile signature keeps the process moving.
Most of this overlaps with work you should do while building the store anyway. If the site is not up yet, run the domain and hosting steps in our guide to building a business website alongside this checklist. If the platform question is still open, choosing an e-commerce platform compares hosted, open-source and marketplace routes.
Details your site must carry
A visitor should be able to see who they are dealing with before they order. In practice that means a business identity block in the footer and on a dedicated contact or about page.
That block carries the trade name, tax office and tax number, trade registry number, full address, phone number and email address. Delivery terms, the shipping process, return and withdrawal explanations, accepted payment methods and any additional charges must be accessible alongside it. Existing is not enough — the information has to sit inside the order flow, where a customer cannot pass it without seeing it.
On product pages, expect prices shown inclusive of taxes, shipping stated separately, and stock or delivery-time information. Where a promotion applies, write its conditions and duration plainly.
The family of required documents
The legal side of a store is not one contract but a set of documents that complement each other. Knowing what each one does prevents copy-paste damage.
| Document | What it does | Where it sits |
|---|---|---|
| Pre-contractual information form | Summarizes product, price, delivery and withdrawal before the order | Confirmed before the payment step |
| Distance sales contract | Establishes the sales relationship between the parties | Accepted at order confirmation |
| Privacy notice | Explains why personal data is processed | On forms and sign-up steps |
| Cookie policy | Governs tracking technologies and preferences | Via the consent banner on first visit |
| Return and withdrawal terms | Sets out the process and its exceptions | A dedicated page plus post-order email |
The most consequential of these is the distance sales contract; what it must contain and how to wire it into checkout is covered in our piece on the distance sales contract. To set the privacy notice and consent banner up together, the cookie policy and privacy notice guide offers a practical template logic. Once your data processing reaches a certain level, a controller registry entry also enters the picture — the data controller registry explains who that covers.
Marketing message consent
Sending a campaign SMS to someone who has ordered from you is not free ground on the reasoning that they are "already a customer." Commercial electronic messages require consent obtained in advance, recorded, and revocable. The channel matters too: consent collected for SMS does not automatically carry over to email.
Registering with the central consent system and uploading your list protects you on both the compliance and the reputation side; we walk through it in commercial e-message consent. On the CRM side, hold consent status as a visible field on every contact and filter marketing lists by it — in Rocketly, segments can attach to exactly that field so unconsented records never enter a send.
Payments, security and the technical floor
The invisible leg of the legal skeleton is technical. A valid SSL certificate across the whole site, a signed agreement with your payment provider, and a flow in which card data never touches your own server are baseline expectations for both regulators and customers.
When choosing a payment provider, read the refund, chargeback and settlement clauses closely — when something goes wrong, those clauses shape your relationship with the customer. Plan early how order and payment data flows into your books. For the tax framework, see our overview of e-commerce taxation; invoices, balances and collections in one place is the fastest way to answer an inspector.
Complaints and dispute channels
An unhappy customer writes to you first. Recording that first contact — who said what and when — makes every later step easier. If it is not resolved, the complaint can move to the consumer arbitration board or the courts, and by then you should hold the order record, the accepted contract text, courier tracking and the message history.
Running returns generously but by the book is the cheapest defense available; our piece on consumer rights and returns details that flow. Teams on a shared inbox have the advantage: when a WhatsApp complaint and an email request land on the same customer record, "who handled this?" stops being a question.
Selling on a marketplace: what is yours, what is theirs
As an intermediary, the marketplace provides the storefront, the payment rails and often the courier integration. Accuracy of product information, regulatory compliance, warranty and after-sales service stay with the seller. Using the platform's contract templates does not transfer the consequences of a false claim in your description.
The most frequent mistake is businesses that sell on a marketplace and then open their own store treating that store as a "second window" and leaving its documents half-finished. From the moment you sell on your own domain, every obligation comes back to you.
Registration is a start, not a finish
ETBİS registration is not a one-time job. A domain change, a change of trade name, an address or contact update, a new sales channel, or ceasing activity all require notification. Keeping track of periodic declaration dates is the business's responsibility too.
Tying this to a reminder system is the practical answer: annually recurring tasks in your CRM with a named owner end the "who did this last year?" fog. For discipline on the customer-data side, the retention and deletion approach in our data-protection-compliant CRM guide gives a solid frame.
A first-30-days checklist and the usual mistakes
Order matters: legal entity and domain first, then the ETBİS application, then the details and documents on the site, then message consent, and advertising last. Turning on ads before the documents exist is the most expensive sequence available.
The mistakes we see most: a domain still sitting in a founder's personal account; contracts copied from another store with the trade name left unchanged; a pre-contractual form never wired into checkout; return terms operated differently from how they read; consent taken with one checkbox and never recorded; a record left stale after a name change. None needs real investment; all come from neglect.
Keeping orders, conversations, quotes and collections in one place makes this work almost by itself — in a dispute, the evidence you are looking for is already on the same screen. You can create a free Rocketly account and build the customer side of your e-commerce operation in the same order as its legal skeleton.