Cookie Policy.

1. Cookies and Similar Technologies

Cookies are small text files that a website stores in your browser to keep the site working, remember your choices and protect its forms. Browser storage (localStorage) serves a similar purpose but is not sent to the server with each request. This policy covers both, as used on tsyenergy.com by TSY Energy, Köşklü Çeşme Mah. 563. Sk. No: 17 İç Kapı No: 1, Gebze / Kocaeli, Türkiye. The Turkish version of this policy is the governing text.

2. Consent Categories

Every cookie, storage entry and third-party service on this site belongs to one of four categories. Only strictly necessary items are active by default; the other three stay switched off until you allow them.

• Strictly necessary: required for the site to work, for session security and for form submission. Always on; cannot be switched off.
• Preferences: the embedded Google Maps frame on the contact and factories pages.
• Analytics: measurement of page views and site performance (Google Analytics 4 and Google Tag Manager, where used).
• Marketing: measurement of advertising conversions and retargeting (Google Ads and LinkedIn Insight Tag, where used).

3. Cookies and Storage Entries Used

The cookie preferences panel lists the items currently in use in each category. They are:

• laravel-session (necessary): first-party session cookie that keeps your session and secures form submission; HttpOnly, SameSite=Lax; expires after 120 minutes of inactivity.
• XSRF-TOKEN (necessary): first-party cookie carrying the anti-forgery (CSRF) token for forms; SameSite=Lax; expires with the session.
• tsy_consent (necessary, localStorage): stores your choice in the cookie panel; kept for 12 months, or until the policy version changes.
• tsy_lang_suggest_dismissed (necessary, localStorage): remembers that you dismissed the language suggestion strip; written only when you press the dismiss button and kept until you clear it.
• Google Maps embed (preferences): when the map frame loads, Google sets its own cookies, whose names and lifetimes are determined by Google.
• Google Analytics 4 / Google Tag Manager (analytics): loaded only after you allow the analytics category.
• Google Ads / LinkedIn Insight Tag (marketing): loaded only after you allow the marketing category.

4. Nothing Loads Before You Allow It

If you have not allowed a category, the scripts in that category are not added to the page at all and no request is sent to the provider. The map is handled the same way: until you allow the preferences category or press "Load map", a notice is shown in its place and no request reaches Google. Fonts are served from our own server, so no font provider receives your visit.

5. Legal Basis

Strictly necessary cookies and storage entries are used because they are required to provide the site you request and to keep its forms secure (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)). Preference, analytics and marketing items are used only with your explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)), which you can withdraw at any time without affecting earlier processing.

6. How Your Consent Is Recorded

When you make a choice, a consent record is created containing a random consent identifier, the categories you allowed, the policy version, the page language, a truncated IP address (the last octet of an IPv4 address, or the last 64 bits of an IPv6 address, set to zero) and the date and time. The record is kept for 12 months as proof of your choice. After that period, or whenever this policy changes, you are asked again.

7. Changing Your Preferences

You can review, change or withdraw your consent at any time using the cookie button at the bottom left of every page or the "Cookie preferences" link in the footer. You can also block or delete cookies and browser storage in your browser settings; blocking strictly necessary items, however, prevents forms from being submitted.

8. International Transfers

This website is hosted on servers in Türkiye. If you allow the analytics or marketing category, or load the map, the relevant providers (Google and LinkedIn) receive data such as your IP address and browser details on their own servers, which may be located outside Türkiye. Such transfers take place only on the basis of your explicit consent.

9. Related Documents and Contact

For the personal data we process and your rights, see our privacy notices. Requests can be submitted through the Data Controller Application Form or by e-mail to kvkk@tsyenergy.com.