Setting up a business website means settling a list of items in order, from the domain registration to the notice beside a contact form. What the site will do decides which items reach the list; where an item comes from decides who finishes it. An item nobody wrote down stays invisible until launch day, so this article names each item, the decision that puts it on the list, and where its detail already lives.
Build order comes off the item list, not the page plan
Most setup lists come from whoever sells the setup, which is why they read as a run of screens: register a name, install the software, pick a template, publish. A business website’s item list fills in a set order of its own: the accounts opened in the business’s name, the work the site will do, the legal text that work requires, and the person who updates the pages after launch. The subject of every line in that order is the business, which is what makes the list usable by an owner who writes no code.
A vendor’s ordering is not dishonest; it is the only order that vendor holds. It hides what is missing as surely as what is unnecessary, since a product cannot know whether visitors will leave written requests with you, nor which line your own business will never fill. The decision behind a line sits in the work rather than inside the product. On our own corporate site work, the fields a form will ask for and the address a request lands at are settled while the flow of the business is discussed, before design starts. Against that sequence, a page plan fills a single line, which is why a list built around pages reads as finished long before it is. Turning the list into your own order takes a question per line: where does this item come from.
Whether a packaged setup or a custom build carries the site is not a step in this order either; it follows from what the site will carry, and the measure for it sits in our guide weighing a packaged setup against a custom build rather than being reopened here.
Not every business fills the whole order. A short list stands for decisions nobody had to make. A site that takes no written request and measures no visits keeps a short list, and its length comes out of the work rather than the page count.
A domain comes by allocation; the account sits with the business
What a registration asks you to decide at the outset is set out line by line in our article on domain names, and how account ownership is tested when a system changes hands belongs to the article on what you receive at handover. The domain registration and the hosting account reach the list together, and both stay under the business’s own identity.
Who gets a .tr name is often settled by a time record: where no document is asked for, a first-come rule applies and the order follows the moment an application reaches the system. Names in the documented group wait instead on the papers asked for reaching the registrar. Both routes run through TRABİS and are filed by registrars under the Internet Domain Names Regulation, and whoever does the filing, the record attaches to the business. Hosting appears on this list by name only, since how it is chosen is a subject of its own.
A certificate expires, which is why the account its renewal hangs on is written down while the site is being set up; what a certificate covers is its own article. That expiry date is what makes the certificate a line of its own beside these accounts. Our own quote stops counting an item once you write down what you hold, so where a business already holds the name and the hosting, these lines never re-enter the list.
What the site will do adds its own items to the list
A request form reaches the list as soon as the site is meant to take written requests, and the fields that form will ask for are settled before any page is designed. A site that carries pages only closes its list with the page plan and never meets the item at all. The reason for the timing is what a form drags behind it: added later, it arrives with the legal item of the next section attached.
Where request types differ, what reaches the list is not a form but a set of queues. Diotek keeps a site-survey booking and a post-installation service request as separate flows, built that way from the start: a visitor picks the flow, and the request lands in that flow’s record. Why the split is made at record level is covered on its own.
The distinctions in a catalogue come from the business, while the tree that carries them is built by the software team. On the Plastik ve Makina platform, new and used machines share the same listing while the condition of a machine opens and closes as a filter. What lands on the list is the axis that tree runs on, and the ownership of the item shows itself in that split.
This item stays tied to the accounts at the head of the list. Where a separate piece of software arrives beside the site, a new name is usually unnecessary and a path under the existing name carries it. What the site does, in that sense, reaches back into the account line.
A form that collects personal data brings a privacy notice onto the list
Owners tend to file a privacy notice under paperwork, something handed over once and never touched again. The item behaves differently. A privacy notice joins the list the moment a form starts collecting personal data from visitors, such as a name, an email address or a phone number, so the trigger is a single field rather than a page count, a design or a platform.
The facts in that notice come from the business. Our own notice names its controller and says in its opening section that it is not a consent text; a lawyer may put the wording together, and the correction still lands where the data flow is known. Stating which data serves which purpose is work for the party doing the processing, and Turkey’s personal data protection law sets out the rest of what a controller tells people while their data is being collected: its identity, the purpose of the processing, any transfer, the method of collection and the legal ground.
Informing and explicit consent are separate acts, and our quote form carries the difference in the verbs of its boxes. Under the law, explicit consent is consent on a specific subject, informed and declared with free will, while informing is the act of telling people while their data is collected.
The Terms box records that you read and accept, and the notice box records only that you read it and know how your data is used. The comment beside the code says as much in a line: no consent is asked for the notice.
On the software side this item is not about wording. What turns a text the business wrote into a text that was shown is a server-side condition rather than a design choice: the text sits beside the form, linked and readable, the boxes never arrive pre-ticked, and the server trusts nothing the browser sends, requiring the acceptance and the confirmation again and rejecting a submission that is missing either.
Which version a visitor saw cannot be reconstructed afterwards, so it is recorded. Typed by hand, a version string would go stale the day the text changed and nothing would show the gap. The accepted version and the moment of acceptance go into the record that reaches us, and the version is derived from the document’s effective date.
A claim to process nothing deserves a closer look, since page requests leave server access records behind and that question has an answer of its own. Without a field that collects personal data, though, this line never opens at all.
A site that writes measurement cookies carries a consent band and a cookie policy
Asking whether every website needs a cookie banner has no answer at the level of site types. A consent band and a cookie policy reach the list through the business’s decision to run a measurement tool on the site, and until that decision is made neither item exists. The trigger is a tool, not a sector and not a page count.
The Guidelines on Cookie Practices hold records that are strictly necessary for a service to work, and preferences a visitor sets through their own action, apart from analytics cookies, which stay tied to permission. Not every record a browser keeps calls for consent, then, and a preference record is not a cookie at all. “The site remembers something” and “the site writes a cookie” are different sentences, and the difference lies in where the record sits and whether it ever leaves the browser. On our site the theme choice and the consent decision live in the browser’s local storage, never travel to the server, and are written only when you press a button.
Our own cookie policy keeps the item narrow: a single measurement runs on the site, it writes a cookie and it asks for permission, and until you give it the site places no cookie at all. No measurement tag loads before permission, and until then the browser makes no request to the measurement provider’s address. Closing the band with Esc counts as nothing, and no measurement cookie is written while the decision stays open. Reject is as easy as Accept and the two are shown with the same weight. Having a band is not the item; the behaviours written into it are.
“We use no cookies” is a fact rather than a declaration, and whether it stays a fact depends on the pages making no outside request, which is where the next section starts. Decide against measurement and neither line reaches the list.
The code keeps the promise the legal text makes
A sentence about how a site behaves is worth whatever checks it. Algoriel tests its consent gate on the generated pages rather than in the source. The same gate requires that no tag-manager container appear anywhere, because another measurement channel added beside it counts the same action again and what data leaves the page stops being decided in code and starts being decided in a panel. The measurement script is run with permission granted and with permission withheld, and if the tag loads without permission the build stops. A script that reads correctly in the source and loses its condition in the build is caught at that point and nowhere later.
What the check protects is a measurable promise in our published text: no ad tag, no social media embed and no external font server, so opening a page sends the browser to no address outside our own domain, with measurement permission as the single exception. The day a map embed or an external font arrives, that sentence turns false and nothing announces the change. It describes the code as it stands rather than an intention.
Each legal page prints its last-updated date at the top, and the version the quote form records derives from that same date, so a new form field, a new measurement tool or an embedded piece moves the text, the date and what the form shows together. The text lives with the site in that sense. Consistency is not carried by hand here, which is the part of this item that setup does not close.
How these lines turn into contract clauses belongs to the guide on what belongs in a website contract, and no clause is drafted here. How the work of search visibility divides between the parties is set out in its own article as well. Who updates page copy after launch is a line named during planning.
What puts an item on a list is not having founded a company but falling inside the scope a rule draws. The Turkish Commercial Code requires capital companies subject to independent audit to open a website and to dedicate part of it to the announcements the law requires them to publish, and the same code states that this requirement does not apply to capital companies outside that audit.
What breaks the tie between text and code is a new piece that calls out to another address or takes data in. Page copy and images move without touching anything the legal text claims. The tie does not break with every change.
Every item on the list is there because of a decision
You can shorten the table below: the middle column names the decision that puts each item on the list, so a row whose decision you never made comes off your list. What the table maps is the trigger behind each row. The last column sends each mechanism back to the article that explains it, because the fact belongs here and the explanation belongs there.
| Item | Where it comes from | What puts it on the list | Where the detail lives |
|---|---|---|---|
| Domain registration and hosting account | The business: both are opened under its identity and invoiced to it directly by the provider | The site is going live | What a registration is, in the domain name article; how ownership is tested, in the handover article |
| The certificate and the account its renewal hangs on | The account sits on the hosting or certificate side; following the renewal stays with the business | The site will open over an encrypted connection | What a certificate covers, and the renewal question, in the certificate article |
| Page copy and whoever updates it after launch | The business: it holds the facts, and whoever writes the words, corrections land there | Every site; the name of the person who updates is written during planning | The split of ownership in the search article, the contract line in the contract guide |
| The request form and the queue a request lands in | The software team builds the form; the business’s workflow decides what it asks | Visitors are meant to leave written requests; where request types differ, the same decision splits the queue | Why the split is made at record level, in the appointments article; the forms themselves in the Diotek case |
| A catalogue or a listing | The business supplies the distinctions, the software team builds the category tree | Products or machines will be searched by their own distinctions | How the tree is built, in the Plastik ve Makina case; the service side of the item on the corporate website service page |
| The privacy notice and the confirmation beside the form | The facts come from the business; keeping the text readable beside the form and recording the confirmation with its version come from the software | The form collects personal data from visitors | Our own KVKK Notice on its legal page; what the boxes say, in the acceptance section of the Terms of Use |
| The cookie consent band and the cookie policy | The measurement decision is the business’s; the band’s behaviour is the software’s | A tool that writes measurement cookies will run on the site | Which records call for consent, in our own Cookie Policy |
Hold the table against your own site and read it from the middle column: a row with no trigger on your side is not on your list. Those triggers have something answering to them in our own code and in our published text. The field a form asks for brings the notice row, and the measurement decision brings the band row.
Where an item comes from sits after the decision that put it on the list, because an unmade decision has no owner. The order of the columns carries that claim. Where the business column repeats down the rows, it tells you which desk the list is waiting on.
The list changes once the sale closes on the site
Plastik ve Makina carries a catalogue without closing the sale on the site itself: a buyer and a seller meet over a listing and the trade is settled away from the platform, which keeps a payment step, an order record and the texts a sale requires off the list entirely. The measurement decision stands outside the sale in the same way, since nothing about selling makes a site measure visits.
A site that sells nothing holds no shorter list by default; what falls away is only the rows a sale would have added. The privacy notice stays where it is, because the form rather than the sale brings it onto the list.
A store that sells carries a separate list of its own, and that list deserves its own writing. Once the sale closes on the site, the list grows beyond this article’s scope.
A Presidential Circular on the accessibility of websites and mobile applications, published in the Official Gazette, names the parties it binds: public institutions along with banks, private hospitals, private education institutions and e-commerce service providers, among others, and those parties bring their sites in line with the starting level of the accessibility checklist and with the Web Content Accessibility Guidelines, within the time the circular sets. Accessibility is a conditional row on this list. What puts the row on a list is appearing among those parties rather than owning a website, and where an accessibility obligation comes from is covered separately.
Start from what you already hold. In the scope step of the quote form, say whether the domain and hosting are in your own name, whether the site will take written requests, and whether you want visits measured. The optional company step asks for your current web address as well, and those answers are what shorten the list before the first reply goes out.
