Cookie policy

§ 00 · SCOPE AND CONTENTS

What does this policy cover?

§ 01 · CLAUSES

1. Clause 01

   What is a cookie?

   Answer

   A cookie is a small text file that a website stores in your browser and that your browser then returns to the server automatically with every subsequent request. Cookies keep sessions open, remember a language choice, hold a basket or count visitors. That automatic return trip is their defining property, and it is also what makes cross-site tracking possible.

   Cookies are classified on two axes. By lifetime: a session cookie is deleted when the browser closes, a persistent cookie stays on the device until its stated expiry. By origin: a first-party cookie is written by the domain you are visiting, a third-party cookie by another domain embedded in the page — an advertising network, an embedded video, a map, a font server. Third-party cookies sit at the centre of the tracking debate.

   In Turkey, where a non-essential cookie results in the processing of personal data, explicit consent is required under Law No. 6698 on the Protection of Personal Data (KVKK). The supervisory authority's guidance on the subject works from a distinction between essential and non-essential cookies. Source: Personal Data Protection Authority — guidance on cookie practices ↗(opens in a new tab) · Accessed: 29 July 2026.

   If you are used to the GDPR and the ePrivacy rules, the shape of that requirement will look familiar: consent must be informed, specific and freely given, and it must be as easy to refuse as to accept. The two regimes are not identical and we make no equivalence claim here; what we can state is the practical outcome, which is that this site asks before it measures anything.

2. Clause 02

   Which cookies does this site use?

   Answer

   None. This site writes no cookie to your browser, and no session cookie is created on the server either. Pages are published as plain static HTML, CSS and JavaScript, there is no session handling, and the site's single JavaScript file contains no line that writes a cookie. You can confirm this in your browser's storage panel.

   This is an architectural consequence rather than a preference: with no server-side application, no user account, no basket and no form session, there is nothing that would produce a cookie. The contact form does not use one either. Protection against automated submissions is provided by a hidden trap field and by comparing the time at which the form was opened with the time it was sent. Neither value is stored in your browser; both travel only with the request you submit.

   How can you verify this?

   1. Open developer tools on this page with F12 (on macOS, Cmd+Option+I).
   2. In Chrome or Edge, open the «Application» tab and go to Storage → Cookies; the «Storage» tab in Firefox and Safari shows the same information.
   3. Under the bakibilisim.com entry you will find the cookie list empty.
   4. Open the «Network» tab and reload the page: every request — the document, the stylesheet, the two font files and the single JavaScript file — goes to the same domain.
3. Clause 03

   Which local records are stored instead of cookies?

   Answer

   Two records are defined, and each is created only when you express a preference. bb-theme holds your dark or light theme choice; bb-consent holds the permission you have given or refused for analytics measurement. Both live in your browser's localStorage area, are never sent to the server, contain no identifier, and remain on your device until you delete them.

   Records stored · measured 29 July 2026

   Record	Type	Category	Purpose	Value stored	Duration	Sent to server?
   bb-theme	localStorage	Essential / functional	Remembers the theme you chose for your next visit	light or dark	Until you delete it	No
   bb-consent	localStorage	Essential / consent record	Stores your analytics decision so the banner is not shown again	granted or denied	Until you delete it	No

   The duration column deliberately reads «until you delete it»: localStorage entries have no expiry date in the way cookies do. They remain until you, or your browser's clear-data function, remove them.

   Current state: analytics measurement (Google Analytics 4) is configured and runs only with your explicit consent. The consent banner is shown on your first visit; the bb-consent record is created only once you press accept or decline. Until you decide, measurement does not start and no third-party request is made.

4. Clause 04

   What is the difference between a cookie and localStorage?

   Answer

   A cookie travels to the server automatically with every HTTP request; a localStorage entry does not. It stays in the browser and can be read only by page code from the same domain. That is the technical difference. The legal outcome is the same: every non-essential record requires explicit consent. We draw the distinction for clarity, not as an exemption.

   Local storage (localStorage)

   A small key-value store that the browser reserves for a given domain and that survives the page being closed. Unlike a cookie, its contents are not sent to the server automatically and can be read only by page code served from the same domain.

   Why it matters: «We do not use cookies» is not on its own a privacy claim, because there are ways to store information on your device other than cookies. That is why both records we keep are listed above in full, with the values they can hold.

   Technical terms in the glossary How personal data is processed

   The same reasoning applies to other storage mechanisms: sessionStorage, IndexedDB, the browser cache and service workers. None of them is used on this site. The only things recorded are the two preferences above.

5. Clause 05

   Are there third-party cookies or trackers?

   Answer

   No. When a page opens, no request is made to any third-party domain: fonts are served from our own server, there is no embedded map frame, no reCAPTCHA, no social media plugin, no advertising network, no heatmap and no session recording tool. That boundary is also enforced by the content security policy header sent with every page.

   Third-party components · status

   Component	Status	Note
   Web fonts	Self-hosted	Two variable font files are served from bakibilisim.com; no request goes to a font network.
   Embedded map frame	Not used	The location graphic on the contact page is drawn by the page itself; the directions link opens only if you click it.
   reCAPTCHA / bot verification	Not used	Form protection runs inside the page, using a trap field and a timestamp.
   Advertising and remarketing tags	Not used	There is no pixel, no conversion tag and no audience list configured.
   Social media plugins	Not used	Instagram and WhatsApp appear as plain links; nothing is requested from those services until you click.
   Heatmap / session recording	Not used	No tool collects pointer movement, clicks or screen recordings.
   Content delivery network (CDN)	Not used	Every file is served from a single origin; no external library is called.
   Analytics measurement	Switched off	Detail is in clause 06; if enabled, it runs only after consent.

   0

   Third-party domain requests made on the first load of this page. Every resource — the document, the stylesheet, the fonts and the JavaScript — is served from bakibilisim.com.

   Source: Baki Bilisim measurement, browser network panel · Measured: 2026-07-29 · Proof page

   How is that boundary enforced on the server?

   The site is published with a content security policy header that tells the browser which sources it may request. The header below prevents the page from making requests outside its own domain. The two Google domains listed are defined for analytics measurement, and no request is made to those addresses until you give explicit consent.

   Content-Security-Policy:
     default-src 'self';
     img-src 'self' data:;
     font-src 'self';
     style-src 'self' 'unsafe-inline';
     script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;
     connect-src 'self' https://www.google-analytics.com;
     frame-ancestors 'self'; form-action 'self'; object-src 'none';
     upgrade-insecure-requests
   
   Permissions-Policy:
     camera=(), microphone=(), geolocation=(), payment=(), usb=(),
     interest-cohort=()

   The interest-cohort=() directive in the second header states that browser-based interest group assignment is disabled on this site. Referrer information is also restricted, with strict-origin-when-cross-origin: when you follow an external link, the other site is told our domain, not the page you were reading.

   Once you click through to an external site, that site's own cookie and privacy policy applies. This policy covers the bakibilisim.com domain only.

6. Clause 06

   How does analytics measurement work here?

   Answer

   Analytics measurement is not active on this site: no measurement code is loaded, no consent banner is shown and no request goes to Google domains. If it is enabled later the order is fixed — nothing is requested until you allow it, Google Analytics 4 loads, the IP address is anonymised, and this page is updated.

   Our approach is minimal analytics. Measurement is not loaded when the page opens; it loads after consent has been given and while the browser is idle. That way no data is collected without permission, and page load performance is not affected by measurement code. If you refuse, the code is never downloaded, and nothing on the site stops working.

   Which cookies would appear if measurement were enabled?

   With permission granted, Google Analytics 4 writes first-party cookies: _ga, used to distinguish visitors, and a cookie with a _ga_ prefix that carries the measurement identifier. Google's own documentation gives the default lifetime of these cookies as two years. Source: Google — How Google uses cookies ↗(opens in a new tab) · Accessed: 29 July 2026.

   Those cookies are not created today. If measurement is enabled, the table in clause 03 will be updated with the real cookie names, durations and transfer details, and the effective date and version number at the top of this page will change. A cookie running on this site that is not documented in this policy counts as a breach of the policy.

7. Clause 07

   How do you give, change or withdraw consent?

   Answer

   If analytics measurement is enabled, a consent banner appears at the foot of the page, and no measurement request is made until you choose «Allow» or «No thanks». Your decision is held in the bb-consent record. To withdraw it, clear this site's data in your browser: the record disappears, the banner returns and measurement stops.

   No pre-ticked boxes are used. Closing the banner is not treated as acceptance, and scrolling the page is not interpreted as consent. Accept and refuse are given the same visual weight, the same keyboard accessibility and the same click distance. Refusing disables no function of the site.

   Steps to withdraw consent

   1. Click the padlock or site information icon to the left of the address bar.
   2. Open «Cookies and site data» or «Site settings».
   3. Delete the data stored for bakibilisim.com.
   4. Reload the page: the consent record and the theme preference are reset, and no measurement takes place.

   You may withdraw your consent at any time. Deleting the bb-consent record brings the consent banner back, and no measurement request is made until you allow it again. If you never granted consent, there is nothing to withdraw.

8. Clause 08

   How do you manage cookies from browser settings?

   Answer

   Every browser offers options to block cookies and site data, allow them selectively and delete them, under «Privacy and security». Because this site sets no cookie, blocking them changes nothing here. Only if you clear site data entirely will your theme preference reset and the site follow your operating system's light or dark setting.

   Settings paths · wording varies by version

   Browser	Settings path
   Chrome, Edge (desktop)	Settings → Privacy and security → Cookies and other site data
   Chrome (Android)	Menu → Settings → Site settings → Cookies
   Firefox	Settings → Privacy & Security → Cookies and Site Data
   Safari (macOS)	Safari → Settings → Privacy
   Safari (iOS, iPadOS)	Settings → Safari → Privacy & Security

   Local records kept in a private or incognito window are deleted when the window closes, so in that mode your theme preference resets on every visit. Server access logs are not cookies and are not governed by browser settings; how they are processed is explained in the privacy policy and KVKK notice.

9. Clause 09

   What happens if this policy changes?

   Answer

   The policy is updated whenever the records kept by the site change. If a new cookie or measurement tool is added, it is written into this page before the change goes live, the effective date and version number change, and separate consent is requested for every new non-essential record. The date at the top identifies the current version.

   The date shown at the top of the page is identical to the dateModified field in the page's structured data; a divergence between the two is treated as a defect. The version history follows.

   • Version 1.0 — 29 July 2026: first publication. Documents the state in which no cookie is used, two local records are defined and analytics measurement is switched off.
   • Version 1.1 — 30 July 2026: Google Analytics 4 measurement configured. Measurement runs only with explicit consent; the consent banner is shown on the first visit and no third-party request is made until a decision is made.

§ 02 · DATA CONTROLLER AND CONTACT

Who do you contact about this policy?

Data controller

Baki Bilisim

Address

Karabaş Mah. Salim Dervişoğlu Cad., Ncity AVM, Kat 2 (Bowlingo katı), İzmit / Kocaeli, Türkiye

Telephone

+90 507 817 27 17

E-mail

bilgi@bakibilisim.com

Domain covered

www.bakibilisim.com (all Turkish and English pages)

Effective date: 29 July 2026 Last updated: 29 July 2026 Version: 1.0