ACSISCO Procurement Office Cookie and Browser Technology Policy
Document version: EN-2026-09-09-38-R2
1. Scope and information
1.1. This policy concerns cookies, browser storage and measurement technologies on Office registration/joining, customer and authorised-work screens and their shared components. The data controller is UK ELEKTRİK MALZEMELERİ SANAYİ TİCARET LİMİTED ŞİRKETİ (Acsisco). Address: Bahçelievler Mahallesi 5083 Sokak No:11/A Altıeylül/Balıkesir. Email: info@acsisco.com; registered electronic mail (KEP): uk.acsisco@hs09.kep.tr.
1.2. This policy is not a service contract, explicit consent or commercial-message approval. Registering/joining Office, opening the cookie page or obtaining information from a notice does not accept optional categories. The Office Privacy Notice, general platform policy and specific-purpose texts complement one another; linking one does not prove that all others were displayed or accepted.
1.3. An HTTP cookie can be sent by the browser with relevant requests; localStorage and sessionStorage are not automatically added to every request. Code, tags or pixels can process data without leaving cookies. The same domain, a masked identifier or a “cookieless” label does not by itself establish anonymity, domestic processing or exemption from consent.
2. Sessions, security and Office context
2.1. Supabase session cookies may carry authentication sessions, a pending-application cookie supports the registration/verification transition, and active security steps use their relevant records. These do not all arise for every visitor. Actual name/domain, lifetime/renewal and erasure behaviour must be verified in the enabled application and browser; it cannot be said that all session data disappears when the browser closes or all server records are erased at sign-out.
2.2. The apo_acting cookie used by Office staff in a customer work context carries a session identifier rather than direct personal details; it grants no authority on its own. Cookie lifetime and session inactivity limits differ: in a configuration defining an eight-hour maximum cookie lifetime and a thirty-minute inactivity limit, an unexpired cookie does not mean the session remains usable. The applicable limits are disclosed with the relevant cookie and session information. Actual staff identity, account scope and session state are assessed on the server. This record neither turns the consultant into the customer nor makes a binding decision reserved to the customer.
2.3. Necessary security and preference-memory activities are limited to what is actually needed for the requested function. The appropriate specific processing condition may be Article 5/2-c for a person party to the contract, or Article 5/2-f where a security/access interest satisfies its conditions. Not all technical records are collectively necessary. Blocking necessary records through the browser may affect the associated function; it does not create a requirement to accept optional measurement or marketing.
3. Preference records and their scope
3.1. The localStorage record cookie-consent stores whether a choice was made and your functionality, analytics and marketing choices. It has no automatic expiry; it is removed when you reset preferences, clear site data or the application removes it. “A choice was made” does not mean yes to every category. Deleting the local record does not delete historical choices or evidence from your account. Names and device lifetimes of shared registration/verification and security cookies are in section 2 of the general Cookie Policy.
3.2. NEXT_LOCALE may remember your language preference, and apo_face the view preference of a person with access to both customer and staff views. Defining a 365-day lifetime for these cookies does not mean the same period applies to every interface record; the lifetimes of cookies in use are explained separately. apo_face only selects an existing customer or staff view and grants no new authority. The ui-preferences:v3 local record and theme preference may also store interface choices. Using the relevant function does not permit advertising or behavioural tracking with this data.
3.3. Refusing the functional category may not automatically stop every operation necessary to fulfil a language, theme or Office-view preference you expressly request. Fulfilling that request is assessed separately from long-term personalisation or tracking for other purposes. The purpose, lifetime and applicable processing condition of preference records are explained separately; preferences cannot collectively be treated as operations that require no consent.
4. Analytics, tag management and telemetry
4.1. Vercel Analytics and Speed Insights require an affirmative analytics choice. Google Analytics or Google Tag Manager additionally requires the relevant service identifier to be enabled. For a signed-in user, the tools wait until the current account international-transfer choice has loaded and do not start if it is refused. Visitors without an account are not subject to the account-choice check; this does not establish that international-transfer conditions are met. Enabling a tool does not mean that different purposes or marketing tags have also been accepted.
4.2. Vercel Analytics measures page use through the page address/route, event time and, where present, external referring-page information; Vercel Speed Insights measures performance through data such as the metric name/value, related page/route, technical context and connection type. Collection takes place automatically through measurement code in the browser; the recipient group is the measurement provider supplying the relevant usage or performance report. Explicit consent under Article 5/1 is the ground for personal-data processing in optional measurement. Enabled Google Analytics/GTM events and tags are assessed within their own scope; a tool’s name alone does not establish that a particular cookie or all its tags are used.
4.3. A tag manager may run different tools and tags. Allowing the analytics category does not give permission for marketing tags. Tags in use must be matched to their relevant category and your withdrawal must be effective within that scope. A domain being verified or permitted does not by itself establish that a marketing tag runs or that none exists; the tools actually used and their purposes are explained separately.
5. Other measurement and external content
5.1. Selecting “Necessary only” does not start Vercel Analytics or Speed Insights. Withdrawing analytics permission or the relevant account transfer choice blocks subsequent measurement sends. If you give permission again in the same page, your choice is saved; measurement starts after a new full page load when the required choices allow it. Measurements accumulated in the page session after withdrawal are not reopened for sending merely by giving permission again; previously transmitted information is not recalled. This control does not mean that all browser code, security processing or every network request stops. See section 7 of the general Cookie Policy.
5.2. Where security verification, maps, fonts, avatars or other external content is actually used, the recipient can see the request and data sent to it. An external client request and the server sending address text to an external service are different data paths. It is not assumed that every Office page loads the same content, that all providers named in code are active, or that no IP information is transferred. The actual recipient, method, data, purpose and duration must be explained.
5.3. Following an official WhatsApp link and an active official integration processing message/delivery events in Office are not the same activity as a cookie choice. The Office Privacy Notice addresses that channel separately; rejecting cookies does not erase a previously sent message. This policy gives no access to personal accounts, authority to import unrelated correspondence or new commercial-message approval.
6. Preferences and withdrawal
6.1. The shared preference tool permits selecting optional categories individually, accepting all or continuing with necessary processing only. Processing requiring consent must not begin before a free affirmative choice based on specific, understandable information. Refusing a category must not by itself prevent access to an independent core Office service. The tool's short explanation must match the scope of the relevant full text and actual processing.
6.2. Local preferences and account consents are separate records; complete, immediate alignment across devices, browsers or account changes is not assumed. Suitable account consents can be managed in the agreements/consents area, and device data through browser site-data settings. Lack of account access does not remove the right to apply to the controller.
6.3. Withdrawal is prospective and requires the relevant activity relying solely on consent to stop. Removing a script from the screen does not alone prove that previously executed code, third-party processing or all devices have stopped. Browser clearing does not erase server records. These distinctions do not shift the effective-withdrawal obligation onto the user; expanded scope cannot be silently added to an earlier choice.
7. Recipients, transfers and retention
7.1. Actually used hosting, authentication, security, content and measurement recipients are explained with purpose, transmitted data and role. Consent-based analytics/marketing requires a separate choice under Article 5/1; other activities require their specific applicable condition. Not every service of a provider has the same legal basis; not every named company is assumed to act only as a processor.
7.2. International transfers require the Article 9 condition in addition to the domestic processing condition. Adequacy, appropriate safeguards and statutorily limited occasional-transfer routes cannot be interchanged arbitrarily. Regular measurement and infrastructure transfers do not collectively become lawful through general cookie acceptance or occasional-transfer consent. This policy asserts no unverified country, standard contract or other safeguard for any provider.
7.3. Device cookie/storage lifetime differs from server, event-record and provider retention. Each is determined by the necessary purpose and applicable statutory obligation; unnecessary data is not kept indefinitely. Disposal takes place when required, not only on a person's request. Preserving earlier choice/withdrawal and version evidence is not new tracking permission. An application can change local records it can access; no absolute technical claim is made that all local records are incapable of remote deletion.
8. Rights, versions and the contract boundary
8.1. Where a cookie or similar technology processes personal data, all KVKK Article 11 rights apply, including processing/recipient information, correction, qualifying erasure/destruction and recipient notification, objection to an adverse solely automated-analysis result and compensation. This summary is not exhaustive. Applications may use the stated channels in the Office Privacy Notice and the Communiqué's permitted methods; the maximum thirty-day response period and applicable Board complaint rights remain preserved.
8.2. A technology or purpose change requires understandable information before processing and separate new consent where necessary. TR and EN explain the same activity; silent Turkish redirection in place of a missing English text is not proof of disclosure. Earlier documents and preferences retain their own version evidence; notice display is not converted into contract acceptance.
8.3. Your cookie choice is neither an Office service-contract signature, a payment instruction nor a binding decision on a customer’s behalf. Membership and consultancy terms are governed by sections 2.3 and 4 of the User Agreement and the separate service contract to which you are a party.