Cookie Policy under the KVKK

ARTICLE 1 — PURPOSE AND SCOPE

1.1. This Cookie Policy (the “Policy”) governs the processing of personal data through cookies, pixels, local storage, web beacons and integrated external-content tracking technologies on fidanproperty.com (the “Site”), operated by Fidan Property Emlak Danışmanlığı Limited Şirketi (the “Company” or “Data Controller”).

1.2. It has been prepared pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”), the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, and the Personal Data Protection Board’s Guidelines on Cookie Practices, to inform Site visitors (“Data Subjects”) and obtain their freely given explicit consent for non-essential cookies.

1.3. The notice covering the Company’s general activities is provided separately. This Policy applies exclusively to data processed through Site cookies, tracking technologies, the Complianz Consent Management Platform (“CMP”) and cookie preferences.

ARTICLE 2 — DATA CONTROLLER AND CORPORATE DETAILS

2.1. Personal data processed through cookies and related digital tracking technologies is processed by the Company as Data Controller:

ARTICLE 3 — LEGAL NATURE OF COOKIES AND DIGITAL TRACKING TECHNOLOGIES

3.1. Cookies are small text files saved by browsers on user devices, including computers, smartphones and tablets, when a website is visited. Pixel tags (Meta Pixel), web beacons, scripts, content delivery networks (CDNs), serverless workers and external frames (iframes) likewise process device information and user interactions.

3.2. IP addresses, unique client and device identifiers (Client ID, cookie ID), browser type, version and language, operating-system information, referring URLs, access timestamps, network-request headers and page clicks and navigation constitute personal data under KVKK Article 3/1-(d) insofar as they make a Data Subject directly or indirectly identifiable. Such data is processed in full accordance with Article 4: lawfulness and fairness; specific, explicit and legitimate purposes; relevance, limitation and proportionality; and retention only for the period necessary for its processing purpose.

ARTICLE 4 — COOKIE MANAGEMENT, EXPLICIT CONSENT AND PREFERENCES

4.1. Default-off (opt-in): Except for infrastructure cookies essential to the Site’s operation and security, no optional analytics, marketing/retargeting or external-media technology loads, triggers or initiates traffic to third-party servers until the user actively consents. Preselected consent boxes, treating continued browsing as consent, and models treating the reading of a notice as consent are not used.

4.2. Equal and easy choices: The initial Complianz CMP interface presents “Accept All”, “Reject All” and “Manage Preferences” at the same hierarchical level, with the same colour contrast, font size and accessibility. Rejecting non-essential cookies cannot be harder or more complicated than accepting them. Interface designs that manipulate the Data Subject’s decision (“dark patterns”) are not used.

4.3. Independent, granular categories: Functional, Statistics/Analytics, Marketing and External Media are listed separately. Each category’s purpose and scope are clearly displayed; all optional categories are unselected by default.

4.4. Script blocking: The Google Tag Manager container (GTM-WLJDK8PT) and noscript iframe tags have been completely removed from the live system. Google Analytics 4 (G-YBYSJ72QLQ) runs only with explicit consent to Analytics; Google Ads (AW-18283810441) and Meta Pixel (2097979214439106) only with consent to Marketing; and YouTube frames and Leaflet/OpenStreetMap/CARTO maps only with consent to External Media. These integrations are blocked on the client side until that consent is given.

4.5. Changing preferences and withdrawing consent: Data Subjects may withdraw explicit consent at any time, without providing a reason and as easily as they gave it. The persistent “Cookie Preferences” control in the lower left/right corner reopens Complianz with one click, allowing individual or all permissions to be revoked. Withdrawal takes effect immediately; relevant scripts are blocked on subsequent page loads and technical consent-denied/revoke signals are sent to external providers.

ARTICLE 5 — COOKIE CATEGORIES, PURPOSES AND LEGAL BASES

The following categories and processing conditions apply under KVKK Article 5:

ARTICLE 6 — TECHNICAL SERVICES AND COOKIE INVENTORY IDENTIFIED ON THE LIVE SITE

6.1. Essential system and security infrastructure

6.1.1. Server and hosting infrastructure — Premier Data Center / Hostmaden Bilişim Teknolojileri:

• Data: client source/destination IP addresses, HTTP request headers, User-Agent, access timestamps, requested URLs, referrers, connection status and server error logs.
• Purpose: uninterrupted Site operation, hardware/software integrity, prevention of computer crime and information security.
• Provider/location: dedicated Windows web and MS SQL database servers at Premier Data Center, İstanbul, Türkiye, provided through Hostmaden Bilişim Teknolojileri.
• Retention: access/error logs have been archived at account level since the Site’s migration on 30 April 2026. Under Law No. 5651 and related legislation, they are kept for at least one and at most two years, then deleted through log rotation.

6.1.2. Edge network and cloud security — Cloudflare, Inc., Free Plan:

• Data: IP address, request URL, HTTP status codes, TLS encryption parameters, cyber-threat and bot-detection telemetry.
• Purpose: global CDN delivery, DDoS prevention, malicious-bot blocking and TLS termination.
• Provider/retention: Cloudflare, Inc., USA/global points of presence. The Free Plan does not retain raw per-visitor requests through Logpush/Logpull. Aggregated security events and analytics are visible in the Cloudflare dashboard for at most 30–31 days and are then automatically deleted by Cloudflare.

6.2. Functional services and preference cookies

6.2.1. WPML (WordPress multilingual plugin):

• Cookie identifier: wp-wpmlcurrentlanguage.
• Provider/type: first party, fidanproperty.com; functional cookie.
• Data: selected language code, such as “tr” or “en”.
• Purpose: preserve the selected language between pages.
• Retention: one day (persistent cookie).

6.2.2. Complianz CMP:

• Cookie identifiers: cmplzbanner-status, cmplzfunctional, cmplzpreferences, cmplzstatistics, cmplzmarketing, cmplzpolicyid, cmplzconsent_status.
• Provider/type: first party, fidanproperty.com; essential preference cookie.
• Data: category-specific accept/reject choices, consent timestamp and active Policy version.
• Purpose: store choices on the client side and prevent repeated banner display.
• Retention: 365 days in the browser.

6.2.3. intl-tel-input, version 18.2.1:

• Data: country code and formatting information in the telephone field.
• Safeguard: all library files are downloaded into the theme locally, as first-party resources. There are no external CDN connections, including jsDelivr, and no external data transfer to third parties.

6.3. Analytics — only with explicit consent

6.3.1. Google Analytics 4:

• Measurement ID: G-YBYSJ72QLQ.
• Identifiers: ga, ga_* and related Google Analytics client cookies.
• Provider/type: third party, Google Ireland Limited / Google LLC; analytics cookies.
• Data: Client ID, network-layer IP address (IP masking enabled), device/screen resolution, browser information, visited pages, time on Site and form/button interactions. Names, surnames, telephone numbers and messages entered into contact forms are never sent to Analytics tags.
• Operation: blocked by default; loads only after active explicit consent to Analytics in the CMP. No data is collected without consent or after withdrawal.
• Retention: _ga remains in the browser for at most two years. Event/user-level data is kept for the standard retention period configured in the Analytics administration panel.

6.4. Marketing and advertising tracking — only with explicit consent

6.4.1. Google Ads / DoubleClick:

• Conversion ID: AW-18283810441.
• Provider/type: third party, Google LLC / Google Ireland Limited; marketing cookies.
• Data: online advertising identifiers, referring campaign URL and conversion events, including form submission and clicks on WhatsApp/Telegram contact buttons. Personal data entered in form fields is not transferred to advertising tags.
• Operation: tags do not load and transfers are blocked unless Marketing permission is given in the CMP.
• Retention: managed according to the corporate Ads account’s conversion windows and retention policies.

6.4.2. Meta Pixel:

• Pixel ID: 2097979214439106.
• Identifiers: fbp and, in active sessions, fbc.
• Provider/type: third party, Meta Platforms Ireland Ltd. / Meta Platforms, Inc.; marketing cookies.
• Data: client-side IP address, browser/device information, page URL and basic PageView event.
• Limitation: server-side Meta Conversions API (CAPI) is not active on the live Site. Traffic is limited to the client browser; form text is not sent to Meta. The pixel does not run without CMP consent.
• Retention: according to Meta’s current commercial retention schedule, generally between 90 days and two years.

6.5. External media and interactive content — only with explicit consent

6.5.1. YouTube embeds — two-stage placeholder model:

• Video IDs: Amgp5NkvuY, Wp-FxwO_TM, BqaSNU0U1V0 and other property-presentation videos published on the Site.
• Operation: until External Media permission is given, the iframe source stays about:blank, no external script is called and only a local image placeholder hosted on the Site’s server is displayed.
• Consent trigger: granting External Media permission in the CMP or clicking “Play Video / Confirm” on the image loads the player. The CMP records this button click as consent to External Media.
• Data: IP address, referrer, device/browser information and playback interactions. Where the browser has an active Google/YouTube account, data may be associated with that profile.
• Provider/retention: subject to Google LLC / YouTube LLC corporate data policies.

6.5.2. Leaflet / OpenStreetMap / CARTO maps:

• Operation: map libraries and dynamic tiles do not load before External Media consent; a static local-image interface protects the area. Explicit CMP consent activates the dynamic coordinate service.
• Data: IP address, browser headers and coordinate requests for viewed locations.
• Providers: OpenStreetMap Foundation and CARTO infrastructure.

6.6. Removed or disabled dependencies

For data security and full regulatory compliance, the live Site has undergone the following cleanup:

a) Google Tag Manager GTM-WLJDK8PT and noscript tags completely removed.

b) Server-side Meta CAPI disabled.

c) External AWS / Amazon S3 data flows and old template dependencies terminated.

d) External Google Fonts API and Font Awesome CDN calls removed; system fallback fonts adopted.

e) 836 image/content records pointing to the old test domain, moddbeta.online, moved to the local fidanproperty.com environment.

f) External jsDelivr connection terminated; telephone library moved to a local directory.

ARTICLE 7 — SEPARATION OF COOKIES AND FORM INTERACTIONS

7.1. Personal data submitted through contact, listing and consultancy-request forms is governed by the Company’s general KVKK Notice. Completing or submitting forms can never be conditional on consent to optional analytics/marketing cookies or approval of commercial electronic messages.

7.2. Even when GA4, Google Ads or Meta Pixel tags are triggered with explicit consent, names, surnames, telephone numbers and messages in form fields are never transferred to those tags or third-party trackers. Only anonymised/technical conversion events are measured.

ARTICLE 8 — EQUAL ACCESS TO CORE SERVICES AND SITE CONTENT

8.1. Selecting “Reject All” or withholding Analytics, Marketing and External Media consent does not prevent or restrict access to core functions, property portfolios, listing details, filters or contact forms.

8.2. For users who reject cookies, the telephone library remains fully functional through local files. Local image placeholders replace YouTube videos and interactive maps. Core consultancy service quality cannot be reduced because consent is withheld, and services cannot be conditional on accepting non-essential cookies.

ARTICLE 9 — RETENTION AND DESTRUCTION

Under Article 4’s data-minimisation and time-limitation principles, cookies, tracking technologies and associated technical records are kept for the following periods and destroyed when they expire:

9.1. First-party Complianz preference records: accept/reject choices (cmplz_*) remain in the browser for 365 days. Records of Consent used to document and prove consent are kept for at most three years.

9.2. Site access/security logs: logs on the dedicated Premier Data Center web server in İstanbul are retained through log rotation for at least one and at most two years under Law No. 5651, Articles 2/1-j and 6, and deleted through periodic destruction upon expiry.

9.3. Cloudflare records: the Free Plan retains no raw requests; aggregated security events are visible for approximately 30–31 days and are automatically deleted afterwards.

9.4. Optional third-party identifiers: GA4 (ga, default maximum two years), Ads and Meta Pixel (fbp, maximum 90 days to two years) cookies are retained for provider-configured periods. Their operation stops immediately on subsequent page loads after withdrawal.

9.5. Periodic destruction: data whose retention expires or whose processing condition ends following withdrawal is periodically deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

ARTICLE 10 — TRANSFERS ABROAD

10.1. Cross-border transfers are carried out in full accordance with KVKK Article 9 and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.

10.2. Essential infrastructure/security — Cloudflare, Inc.: Cloudflare is essential for protection against global cyber threats, bots and DDoS attacks, and for TLS encryption and DNS routing. Necessary cross-border network-security traffic relies on Article 5/2-(f), legitimate interests, and the corporate Data Processing Agreement (DPA) and Board-approved Standard Contract safeguards concluded under Article 9/4.

10.3. Optional cookies/tracking — Google, Meta, YouTube, CARTO: because these services’ servers are abroad, online identifiers and behavioural data collected through GA4, Ads, Meta Pixel, YouTube and maps are transferred abroad under Article 9 exclusively when the Data Subject freely gives explicit opt-in consent to the relevant CMP category. If consent is withheld or rejected, there is no cross-border data flow to these providers.

ARTICLE 11 — CHANGING, MANAGING AND DELETING PREFERENCES

11.1. CMP management: Data Subjects can reopen Complianz at any time using the always-accessible cookie control, revoke individual category permissions or select “Reject All”. Changes are detected immediately; relevant external code is blocked on subsequent navigation.

11.2. Browser management: existing cookies may be deleted and new cookies blocked through browser settings:

• Chrome: Settings > Privacy and security > Third-party cookies.
• Firefox: Settings > Privacy & Security > Cookies and Site Data.
• Safari: Preferences > Privacy > Block Cookies and Website Data.
• Edge: Settings > Cookies and site permissions > Manage cookies and site data.

Blocking all cookies may also disable essential functional/security cookies and cause technical navigation problems.

ARTICLE 12 — CONSENT RECORDS, BURDEN OF PROOF AND AUDITABILITY

12.1. Client-side preferences: CMP choices are stored in the browser through first-party cmplz_* cookies, preserving preferences on future visits and preventing repeated banners.

12.2. Banner/Policy versions: cmplzpolicyid identifies the Policy version under which the visitor chose. A material Policy or cookie-inventory change automatically refreshes the CMP and requests updated preferences.

12.3. Proof: under the KVKK, the Controller must document and prove explicit consent. Complianz retains auditable technical Records of Consent in system logs, containing an anonymised user identifier, consent date, timestamp and approved categories.

ARTICLE 13 — DATA SUBJECT RIGHTS AND APPLICATION PROCEDURE

13.1. Under KVKK Article 11, Data Subjects may apply to the Company to:

1. Learn whether their personal data is processed.
2. Request information if it has been processed.
3. Learn processing purposes and whether data is used accordingly.
4. Learn the third parties receiving data in Türkiye or abroad.
5. Request correction of incomplete or inaccurate data.
6. Request deletion or destruction under Article 7.
7. Request notification of correction, deletion or destruction to receiving third parties.
8. Object to a result to their detriment arising exclusively from automated analysis.
9. Claim compensation for damage caused by unlawful processing.

13.2. Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, applications may be made:

a) By a wet-signed written petition delivered personally or through a notary to Ataköy 7-8-9-10. Kısım Mah. Çobançeşme E-5 Yan Yol Cad. B No:6/1 D:43 Bakırköy / İstanbul.

b) To the Company’s KEP address, [email protected].

c) To [email protected] using a secure electronic/mobile signature, or from an email address registered in the Company’s system.

13.3. Applications must legally include name, surname, signature, Turkish identity number (nationality and passport number for foreign nationals), residential/business address for service, notification email/telephone and the request. The Company resolves applications free of charge within at most 30 days, according to their nature. If the procedure incurs an additional cost, the Board’s tariff applies.

ARTICLE 14 — EFFECTIVE DATE, UPDATES AND VALIDITY

14.1. This Policy entered into force on 02.10.2026, the date of publication on fidanproperty.com.

14.2. Legislative changes, Board decisions, case law or updates to the Site’s tracking inventory may require revisions. Updated text becomes valid upon publication on the Site.

14.3. For easy access at all times, the Policy is permanently available in the Site footer, Complianz banner and beneath contact forms.

Data Controller: Fidan Property Emlak Danışmanlığı Limited Şirketi