Startup Founders’ Legal Guide to Turkey

yazarı lawyerfbc

açık Kasım 12, 2025

TL;DR (Executive Summary)

Choose between Limited (Ltd. Şti.) and Joint‑Stock (A.Ş.); A.Ş. suits venture scaling and exits, Ltd. Şti. suits lean beginnings.
Lock in founder alignment with a Founders’ Agreement + Shareholders’ Agreement (SHA): vesting, IP assignment, non‑compete, decision rights.
Use convertible notes/SAFEs or direct equity with pre‑emption, anti‑dilution, liquidation preference drafted clearly under Turkish law.
Protect the product early: trademarks, domain, copyright, patents/utility models, assignment from everyone who ever touched the code/design.
Get KVKK (Turkish GDPR) and cross‑border data transfer right; roll out privacy notices, DPA, retention matrix, DPO contact, breach playbook.
Mind licensing traps: fintech, crypto‑assets, e‑money, payment, marketplaces, telecom/VAS, health‑tech, ed‑tech, ad‑tech each have gates.
Use incentives: Techno‑park, R&D/Design Center, TÜBİTAK/KOSGEB grants, angel investor tax breaks, stamp tax/withholding reliefs.
Keep a clean cap table; plan for ESOP/VSOP and 10‑minute due diligence folder.
Handle employment vs. contractors, remote work, IP/know‑how, non‑compete/non‑solicit, and stock options correctly.
Prepare for rounds and exits: data room, warranties, IP/title chain, tax clearance, governance hygiene; adopt board rules and information rights.

This guide is educational and general in nature. Always obtain tailored legal advice for your specific product, sector and investors.

1) Incorporation Playbook: Picking the Right Vehicle

1.1 Company Types at a Glance

Limited Company (Ltd. Şti.)

Minimum capital typically 10,000 TL (practical norms may be higher for credibility).
Shares are not represented by share certificates and transfers may trigger notary formalities and taxes.
Simpler governance; fewer mandatory corporate bodies.
Adequate for early MVP/testing or service businesses with limited external fundraising.

Joint‑Stock Company (A.Ş.)

Minimum capital typically 50,000 TL (startups often set higher to look bankable and absorb losses).
Easier share transfers, possible registered share certificates, flexibility for preferred shares and investor rights.
Suited to venture rounds, ESOP structuring, and exits (share sale/IPO).

Rule of thumb: If you expect institutional VC rounds or an exit, start with A.Ş. (or migrate early). If you need speed and thrift for an MVP, Ltd. Şti. can work short‑term—plan the migration to A.Ş. before Seed/Series A.

1.2 Formation Checklist (Fast‑Track)

Trade Name & NACE Code: Choose a compliant name and accurate activity codes covering near‑term pivots.
Articles of Association: Bake in share classes, transfer restrictions, board rules, and pre‑emption options if A.Ş.
Share Capital & Bank Letter: Deposit capital; keep receipts. Consider timing for capital calls and future increases.
Registered Address & Lease: Avoid virtual office pitfalls; ensure mail and inspections work.
Directors/Managers: Define representation powers (single vs. joint signatory), board quorum, and reserve matters.
Tax & Social Security Registrations: Seal the fiscal footprint from day one.
Commercial Books & E‑Signature: Activate e‑signature for filings; set who signs what.
KVKK Kick‑off: Start a privacy/data inventory concurrently with formation (not after product launch).

2) Founders’ Alignment: The Documents That Prevent Break‑Ups

2.1 Founders’ Agreement (Pre‑Incorporation or within 30 days)

Roles & Time Commitment: CEO/CTO/CPO delineation; minimum weekly hours; side‑project policy.
Vesting on Founder Equity: 4‑year vesting with 1‑year cliff is common; include double‑trigger acceleration for change‑of‑control + termination without cause.
IP Assignment & Moral Rights: “Work‑for‑hire” style assignment to the company; perpetual, global, royalty‑free. Waive or license moral rights as permitted.
Non‑Compete/Non‑Solicit: Reasonable scope, duration and geography; tailor to Turkish enforceability.
Decision‑Making & Deadlock: Tie‑breakers, chair casting vote or independent advisor referral.
Founder Departures: Good leaver/bad leaver outcomes; buy‑back price mechanics.

2.2 Shareholders’ Agreement (SHA) & Articles Enhancements

Pre‑emption & Rights of First Refusal (ROFR).
Drag/Tag Rights: Drag to secure exits; tag to protect minorities.
Information & Audit Rights: Monthly management accounts, KPI dashboards, annual budgets.
Protective Provisions (Reserve Matters): New share issues, debt thresholds, key hires, M&A, liquidation.
Board Composition: Investor/director seats, independent seat, observer rights, meeting cadence.
Option Pool & ESOP Mechanics: Pool size (typically 5–15% pre‑money), strike price policy, exercise windows.
Anti‑Dilution: Weighted average is market‑typical; avoid punitive full‑ratchet unless you are desperate.

Keep the SHA aligned with Articles to avoid conflicts; investors will insist on mirroring key rights in registered documents.

3) Capitalization & Instruments: Building a Clean Cap Table

3.1 Equity Rounds vs. Convertibles

Equity (priced) rounds: straightforward valuation; preferred shares enable liquidation preferences, anti‑dilution, and pro‑rata rights.
Convertible Notes/SAFEs: speed and lower friction; use valuation cap, discount, and Most Favored Nation (MFN) clauses carefully; define conversion events, maturity, interest (if any) under Turkish law.

3.2 Liquidation Preferences & Waterfalls

1x non‑participating is founder‑friendly; participating preferences can over‑tilt returns.
Senior/pari passu stacks: be explicit.
Create a waterfall model in the data room so everyone sees who gets what in various exit scenarios.

3.3 Protecting the Cap Table

Keep it tight: Limit friends‑and‑family micro‑tickets if they become administrative noise.
Use a trustee or nominee only with clear documentation.
Record every promise in writing: No “oral side letters.”
Maintain a live cap table ledger: Issuances, transfers, options, convertibles, ESOP grants.

4) ESOP/VSOP in Turkey: Motivating Talent Legally & Tax‑Smart

Plan Type:
- ESOP (actual shares/options): Best for A.Ş.; issuance under authorized capital or capital increase; consider share certificate mechanics.
- VSOP/Phantom: Cash‑settled bonus linked to company value—easier for Ltd. Şti., avoids shareholder formalities but requires robust contracts and funding for payouts.
Vesting: 4 years standard, with cliff; include good/bad leaver logic and post‑termination exercise window.
Tax Touchpoints: Moment of grant vs. exercise vs. sale; withholding and reporting obligations; potential reliefs in techno‑parks/R&D centers for qualified wages—structure carefully with your tax advisor.
Employee Communications: Clear plan rules, grant letters, FAQ, and playbook for resignations/firings.

5) IP & Brand: Own It or Lose It

5.1 Chain of Title

Assignment Agreements from founders, employees, interns, contractors, agencies (design, marketing, software).
Cover source code, models, datasets, training scripts, prompts, UI/UX, documentation, and domain names.
For open‑source use, maintain an OSS register (licenses, versions, obligations, copyleft flags).

5.2 Registrations & Protection

Trademarks: File early in classes that match your go‑to‑market; watch services to police copycats.
Patents/Utility Models: If you have patentable tech or hardware, map filing timelines vs. publication/launch.
Copyright: Automatic, but keep creation proofs (time‑stamped repos, design files, emails).
Trade Secrets: Confidentiality by design—access control, NDA, exit protocols, DLP tooling.

5.3 Inbound/Outbound Licensing

Review inbound licenses for territory, exclusivity, sublicensing, derivative works.
Outbound EULA/SaaS terms: ownership, license scope, usage limits, warranties/disclaimers, SLA and SLO, renewal/termination, data return/deletion.

6) Data, Privacy & Cybersecurity (KVKK‑First)

Map personal data flows: categories, purposes, legal bases, processors, storage, retention, destruction.
Publish Privacy Notice and Cookie Policy; implement consent management where needed.
Controller–Processor DPAs: Standardize with vendors; define sub‑processing, audits, breach notice windows.
Cross‑Border Transfers: Assess adequacy, SCC‑like safeguards under Turkish practice, and explicit consent where applicable; maintain transfer logs.
Data Subject Rights: Requests handling SLA; templates for access, deletion, portability; verification protocol.
Security: ISO‑27001‑style controls, encryption, key management, 2FA, secure SDLC, vulnerability scans.
Breach Playbook: 72‑hour style internal target, authority/user notifications after risk assessment; maintain an incident register.

Privacy maturity is a deal readiness signal—VCs diligence KVKK now as standard.

7) Sector Playbooks: Regulated & High‑Scrutiny Areas

7.1 Fintech & Payments

Payment/E‑Money Services: Licensing thresholds, capital, safeguarding, governance, outsourcing and agent rules; cooling‑off plans for wind‑down.
Open Banking/APIs: Contracts with banks and data permissions; consent UX; liability allocation.
AML/CTF & Sanctions: KYC program, PEP screening, transaction monitoring, suspicious activity reporting.

7.2 Crypto‑Assets/Web3

Exchange, brokerage, custody, staking, stablecoins: expect licensing/registration frameworks; align with AML and consumer protection; segregate assets and implement proof‑of‑reserves style attestations where feasible.
Token Sales/Utilities: Map tokens to securities vs. utilities analysis; risk disclosures; marketing rules; vesting and lock‑ups.

7.3 Marketplaces & Platforms

Liability Shields: Terms, content moderation, notice‑and‑takedown, repeat infringer policies.
Consumer Law: Pre‑contract info, right of withdrawal, warranties, logistics/returns, unfair terms controls.
Advertising: Influencer/affiliate transparency, pricing accuracy, claims substantiation.

7.4 Health‑Tech & Ed‑Tech

Medical Devices/Software as Medical Device: classification, clinical/real‑world data, approvals, vigilance.
Tele‑health: Licensing of providers, cross‑border practice limits, e‑prescriptions, e‑signature.
Ed‑tech: Age‑appropriate design, parental consents, student data protections.

7.5 AI/ML & Safety by Design

Training Data Provenance: licensing or fair use equivalents; dataset governance; opt‑outs.
Model Cards & Risk Assessments: document intended use, limitations, bias testing.
Human‑in‑the‑loop: in high‑risk decisions; appeal rights; logging for audits.

8) Commercial Contracts That Matter in Year 0–2

Customer T&Cs / MSA + SLA: uptime credits, support tiers, data processing, IP ownership, indemnities.
Pilot/POC Agreements: limited scope, limited liability, clear success criteria, IP/results ownership.
NDA & Invention Assignment: with anyone touching confidentials or code.
Vendor & Cloud Contracts: security annexes, BCDR, subcontractors, exit/portability.
Reseller/Referral/Affiliate: commission structures, exclusivity caps, brand guidelines.
Joint Development: background vs. foreground IP, revenue shares, publication rights.

9) People: Hiring, Contractors, and Remote Work

Employment Agreements: role, salary/benefits, probation, working hours, IP assignment, confidentiality, post‑termination obligations, disciplinary regime.
Independent Contractors: clear outcome‑based scopes; avoid misclassification (control, continuity, exclusivity red flags).
Remote & Cross‑Border Work: permanent establishment risks, payroll/withholding, immigration/permits.
Policies: code of conduct, anti‑harassment, IT/security, BYOD, leave, whistleblowing.
Non‑Compete/Non‑Solicit: reasonable and enforceable; consider garden leave and consideration.

10) Taxes & Incentives: Don’t Leave Money on the Table

VAT & Withholding: SaaS vs. digital services, B2B vs. B2C; marketplace collection responsibilities.
R&D/Design Center & Techno‑park: corporate tax, income tax and social security reliefs for qualifying activities; documentation discipline.
Angel Investor Relief: accreditation requirements; income tax advantages subject to holding periods.
Grants & Supports: KOSGEB, TÜBİTAK, development agencies—align project descriptions with eligible cost categories.
International Structure: consider holding vehicles, substance, transfer pricing, and double‑tax treaties.

Bring tax planning in before term sheets; it can materially improve investor outcomes and founder liquidity on exit.

11) Governance Hygiene & Reporting

Board Calendar: monthly or quarterly meetings, budgets, KPIs, risk register.
Corporate Books: minutes, share ledgers, option grants, related‑party registers.
Compliance Calendar: filings, tax returns, IP renewals, license renewals, data protection audits.
Banking & Treasury: dual control for payments, limits, investment policy for runway.

12) Fundraising Rounds: From Pre‑Seed to Series B

Pre‑Seed/Seed: angels, micro‑VCs, convertibles. Focus on story and early traction; keep legals lightweight but clean.

Series A: priced equity, preferred shares, board re‑composition, option pool top‑ups, robust reps & warranties.

Series B+: expansion capital, bigger syndicates, covenants and information rights tighten; think about secondary sales for founder liquidity.

Due Diligence Playbook:

Data Room with indices: corporate, cap table, contracts, IP, litigation, employment, privacy/security, financials, tax, licenses.
Top 10 Risks Memo: candid list with mitigations—it builds trust.
Compliance Certificates: where available (security, quality, sector‑specific).

13) Cross‑Border: Selling Abroad, Taking Money from Abroad

Foreign Investors: on‑boarding KYC/KYB files, beneficial ownership, source of funds letters.
Foreign Currency: FX rules for share subscriptions/loans; reporting and registration where applicable.
Export of Services: contract law choices, jurisdiction/venue, service‑of‑process, language, invoices in FX.
IP Holding & Licensing: centralize IP ownership to reduce friction and royalty leakages; ensure arm’s‑length licensing.

14) Compliance & Ethics by Design

Anti‑Corruption: policies, training, third‑party due diligence.
Sanctions/Embargoes: screening for customers, vendors, and counterparties.
Competition Law: pricing, market sharing, MFN, exclusivities—review marketplace rules.
Whistleblowing: channel and anti‑retaliation measures.

15) Disputes & Risk Management

Customer/Partner Disputes: escalation ladder, mediation/arbitration clauses, venue choice, injunctive relief carve‑outs.
Employee Disputes: documentation discipline, performance records, lawful termination grounds.
IP Enforcement: cease‑and‑desist templates, domain disputes, rapid takedown strategies.
Insurance: cyber, D&O, professional indemnity, key‑man.

16) Exit‑Readiness: M&A or IPO

Sell‑Side Preparation: vendor DD report, IP/title chain confirmation, tax rulings where relevant.
Warranty & Indemnity Insurance: can bridge risk gaps for both sides.
Retention/Claw‑back: founders’ continued service commitments; earn‑outs with objective KPIs.
Employee Options: accelerate or roll‑over mechanics; communication plan.

17) Document Toolkit (Founder‑Friendly Baselines)

Founders’ Agreement (roles, vesting, IP, non‑compete)
Articles of Association (A.Ş. with preferred share enablers)
Shareholders’ Agreement (investor rights, board, drag/tag, anti‑dilution)
ESOP/VSOP Plan & Grant Letters
Employment Agreement (IP assignment, confidentiality, post‑termination)
Contractor Agreement
NDA & Invention Assignment
MSA/SaaS Terms + SLA
DPA (Processor/Controller)
Privacy Notice & Cookie Policy
Pilot/POC Agreement
Reseller/Referral Agreement
IP Assignment (one‑off)
Open‑Source Policy
Board & Governance Rules

18) 90‑Day Legal Roadmap for New Startups in Turkey

Days 0–30

Incorporate (A.Ş. or Ltd.).
Sign Founders’ Agreement & IP assignments.
Draft Articles with venture features if A.Ş.
Prepare privacy notices, NDAs, and employment/contractor templates.
File trademark; secure domains and social handles.

Days 31–60

Ship MVP; roll out website/app legal pack (ToS/Privacy/Cookies).
Kick off data mapping and DPA framework; set up incident response.
Sign initial customer pilots with limited liability and clear IP.
Build V1 data room (corporate, cap table, IP chain, contracts).

Days 61–90

Design ESOP/VSOP; board approval.
Start angel/seed outreach; term sheet templates (priced or convertibles).
Evaluate incentives (techno‑park/R&D center); meet tax advisor.
Approve compliance calendar; insurance quotes (cyber, D&O).

19) Frequently Asked Questions (FAQs)

Q1: Should we start as Ltd. Şti. and convert later? Often yes for speed; convert to A.Ş. before institutional funding. Mind transfer taxes and procedural steps.

Q2: Can we issue preferred shares in an A.Ş.? Yes—Articles‑backed classes can carry preferences on dividends, liquidation, voting, or appointment rights.

Q3: Are SAFEs enforceable in Turkey? They can be adapted as convertible investment instruments under Turkish law; craft terms carefully to avoid re‑characterization and to ensure conversion mechanics are unambiguous.

Q4: How do we grant options to foreign employees/contractors? Use ESOP/VSOP documents plus local tax advice in the worker’s country; consider phantom plans where share issuance is impractical.

Q5: What does a “KVKK‑compliant” startup look like? It maintains an up‑to‑date data inventory, has published notices, signed DPAs, security controls, a breach plan, and can answer data subject requests on schedule.

Q6: Do we need a license to accept payments? If you handle customer funds or issue stored value, yes you may fall into payment/e‑money regimes. If you merely use a licensed PSP and don’t touch funds, likely no—review your flows.

Q7: Can we use open‑source code freely? Yes within license terms. Watch copyleft triggers that could force disclosure of proprietary code; maintain an OSS register.

Q8: What about contractors abroad? Great for flexibility but check misclassification and permanent establishment risks; use clear SOWs and IP assignments.

Q9: What investors expect in diligence? Clean cap table, chain of IP title, privacy/security maturity, signed key contracts, governance records, and predictable financial reporting.

Q10: How big should our option pool be at Seed? Commonly 10% (range 5–15%), created pre‑money at the investor’s request; model future top‑ups.

20) Sample Clauses (Plain‑English Starters)

Vesting (Founder/Employee)
“Shares/Options vest monthly over 48 months with a 12‑month cliff. Upon a change of control and a termination without cause within 12 months thereafter, unvested amounts accelerate by 50%.”

IP Assignment
“Each Founder assigns to the Company all right, title and interest in any IP created in connection with the Company’s business, including code, designs, data, documentation and inventions, royalty‑free and worldwide, with the right to register and enforce.”

Confidentiality
“Each Party will keep Confidential Information secret and use it solely for the purpose of evaluating or performing the Project; exceptions apply for information that is public, independently developed, or disclosed by law/court order.”

Data Processing (DPA)
“Processor shall process personal data only on documented instructions, implement appropriate security measures, assist with data subject requests, and delete or return personal data upon termination.”

Final Note

This article is written for founders and operators building in Turkey in 2025. Laws and practice evolve quickly, particularly in fintech, crypto‑assets, data protection, and consumer platforms. Review your specific model and funding plan with counsel before committing to terms or launching regulated features.

Categories:

Genel