Document: Cookie and Similar Technologies Policy
Version: 2.1.2
Effective date: 29 July 2026
Last updated: 29 July 2026
Technology Inventory
The technologies used on the site are listed below with their provider, purpose, category, retention, party, overseas-transfer status and consent basis.
- Secure session access — Provider: Barışkan; Purpose: Login access token; Category: Essential; Retention: Up to 15 minutes; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: bk_at.
- Secure session renewal — Provider: Barışkan; Purpose: Secure session renewal; Category: Essential; Retention: Up to 7 days; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: bk_rt.
- Request security — Provider: Barışkan; Purpose: Request-forgery protection; Category: Essential; Retention: Up to 7 days; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: bk_csrf.
- Social sign-in security — Provider: Barışkan / Google / Meta; Purpose: Secure social-login return; Category: Essential; Retention: Up to 10 minutes; Party: First / third; Overseas transfer: May occur when selected; Consent: No; initiated by user; Technical identifier: OAuth state.
- Cart continuity — Provider: Barışkan; Purpose: Preserve and protect the cart; Category: Essential; Retention: Session / account-cart period; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: Cart identifiers/storage.
- Cookie preference record — Provider: Barışkan; Purpose: Remember cookie choices; Category: Essential; Retention: Up to 365 days; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: bariskan.consent.v2.
- Language preference — Provider: Barışkan; Purpose: Remember language; Category: Preference; Retention: Browser storage period; Party: First; Overseas transfer: Not planned; Consent: No; Technical identifier: Locale/language storage.
- Bot and abuse protection — Provider: Google; Purpose: Abuse and bot prevention; Category: Essential security; Retention: Provider-defined; Party: Third; Overseas transfer: May occur; Consent: No; Technical identifier: reCAPTCHA identifiers.
- Traffic measurement — Provider: Google Analytics; Purpose: Pseudonymous traffic measurement when configured; Category: Analytics; Retention: Provider-defined; commonly up to 2 years / 24 hours; Party: Third; Overseas transfer: May occur; Consent: Yes; Technical identifier: _ga / _ga_* / _gid.
- Order conversion measurement — Provider: Barışkan; Purpose: Deduplicate conversion events and measure order conversions; Category: Analytics; Retention: Session / limited event period; Party: First; Overseas transfer: May occur after consent; Consent: Yes; Technical identifier: Purchase/session analytics storage.
- Advertising conversion measurement — Provider: Google Ads; Purpose: Attribution and advertising measurement when configured; Category: Marketing; Retention: Provider-defined; commonly up to 90 days; Party: Third; Overseas transfer: May occur; Consent: Yes; Technical identifier: _gcl_au / ad identifiers.
- Meta advertising measurement — Provider: Meta; Purpose: Pseudonymous browser/click matching when configured; Category: Marketing; Retention: Provider-defined; commonly up to 90 days; Party: Third; Overseas transfer: May occur; Consent: Yes; Technical identifier: _fbp / _fbc.
- Campaign attribution — Provider: Barışkan; Purpose: Campaign attribution; Category: Marketing / analytics; Retention: Up to 30 days; Party: First; Overseas transfer: May be shared after consent; Consent: Yes; Technical identifier: UTM / gclid / fbclid storage.
Choice Management
Accept, Reject and Preferences remain equally visible. Non-essential analytics/advertising scripts do not run before opt-in. Preferences can be changed later through Cookie Preferences; rejection does not block essential shopping functions. Analytics identifiers are pseudonymous/online identifiers, not described as completely anonymous.
