Cookie Policy

Last updated date: 15.07.2026
Text version: 1.0
Platform: allbazaardan.com

1. Purpose and scope

This Cookie Policy has been prepared to provide information about the cookies and similar technologies used in the allbazaardan.com website, mobile compatible web pages, user and seller panels and the online services of the platform.

Policy;

• visitors,
• member users,
• buyers,
• sellers and seller candidates,
• people who request support,
• other people using the platform's internet-based services

includes.

This policy applies only to allbazaardan.com.Since the cookies, data streams and service providers used on alpazardan.com and ilan.alpazardan.com may be different, separate cookie policies should be used for these domain names.

2. Data controller

Data controller in terms of personal data processing activities carried out through cookies on allbazaardan.com and whose purposes and methods are determined by the platform operator:

Legal operator: Aydın Kaydin Sole Proprietorship
Tax number: 5370203844
Address: Hamzabey Mahallesi, Karacabey Caddesi No:25/7, Mustafakemalpaşa / Bursa 16500, Turkey
Phone: +90 535 920 73 78
E-mail: [email protected]
KEP: [email protected]

Some third-party service providers may also be data controllers with respect to their own independent data processing activities. The legal role of the provider is also evaluated by taking into account the nature of the service used and the technical structure.

3.What is a cookie?

A cookie is a small data file saved on the user's browser or device by the visited website.

Cookies;

• continuing the session,
• keeping the user logged in,
• protection of the shopping cart,
• remembering language and currency preferences,
• ensuring account and payment security,
• preventing fraud and unauthorized access,
• measuring site performance,
• analyzing user behavior,
• measuring advertising and campaign effectiveness

It can be used for purposes such as

.

Not every cookie directly identifies a person by name. However, personal data processing may occur when the cookie ID is associated with IP address, device information, account information or other records.

4.Technologies similar to cookies

The term “cookie” as used in this policy also includes, as appropriate, the following similar technologies:

• local storage areas,
• session storage areas,
• pixels and tracking tags,
• web beacons,
• conversion tags,
• device and browser identifiers,
• software development kits,
• tag management systems,
• link tracking parameters,
• similar online storage or access methods.

Just because a technology is not called a “cookie” does not mean that it is exempt from consent and personal data protection obligations.

5. Classification of cookies according to their side

5.1. First-party cookies

They are cookies placed directly by the allbazaardan.com domain name or the technical infrastructure controlled by the platform.

These can be used for session, basket, account security, user preferences or core platform functions.

5.2.Third party cookies

Cookies that can be placed by payment, analysis, advertising, security, video, map, social media, live support or similar external service providers.

Just because a third-party tool has been added to the platform does not mean that all of its cookies are mandatory. Each cookie is classified taking into account its actual purpose and technical necessity.

6. Cookies by duration of use

6.1. Session cookies

These are cookies that are generally used throughout the browser session and expire when the browser is closed.

Can be used for session ID, cart contents or temporary security verification.

6.2. Persistent cookies

These are cookies that can remain on the device for a specified period of time or can be stored until deleted by the user.

Can be used for language preference, currency selection, consent recording, session preference or analysis purposes.

Just because a cookie is persistent does not mean it can be stored indefinitely. The duration must be limited and proportionate to the purpose of the cookie.

7.Mandatory cookies

Mandatory cookies are cookies that are absolutely necessary to provide the services explicitly requested by the user or to carry out secure electronic communication.

These cookies may be used for the following purposes:

• creating and maintaining the session,
• secure login to user account,
• storing the shopping cart,
• completion of payment and order steps,
• load balancing,
• network and information security,
• fraud and unauthorized transaction prevention,
• saving cookie preferences,
• protecting form information throughout the process,
• implementation of the language or display selection explicitly requested by the user.

For a cookie to be considered mandatory, it is not enough for it to be useful only for the platform. The cookie must be truly necessary to provide the essential service requested by the user.

In the KVKK guideline, in terms of non-consensual cookie evaluation, strict necessity criteria are taken as basis for the provision of electronic communication and the information society service explicitly requested by the user.

8.Preference and functionality cookies

Preference cookies can ensure that choices made by the user are remembered on subsequent visits.

These are for example:

• language,
• currency,
• country or region,
• list or grid view,
• accessibility settings,
• recently viewed products,
• user interface preferences

Available for

Limited cookies that are strictly necessary to implement a preference expressly requested by the user may be considered as non-consent. However, functionality cookies intended for personalization, behavioral tracking or non-essential profiling are not run without user consent.

9.Analytics and performance cookies

Analytical cookies can help understand how the platform is used and improve technical performance.

The following information can be measured with these cookies:

• pages visited,
• time spent on page,
• number of visits and sessions,
• traffic sources,
• links clicked,
• error messages,
• device and browser type,
• approximate location or country,
• page load and performance data,
• Technical stages of the order funnel.

Non-obligatory analytical cookies on allbazaardan.com are not activated without the user giving consent to the relevant category.

The fact that the analytical service only provides aggregate reports does not automatically make the cookies used mandatory. The purpose, scope, provider, storage period and impact of the technology used on the user are also evaluated.

10.Advertising and marketing cookies

Advertising and marketing cookies may be used to measure or personalize advertisements and campaigns based on the user's interactions on the platform or other websites.

With these cookies:

• advertising display,
• ad click,
• order or conversion,
• campaign performance,
• retargeting,
• interest profile,
• advertising frequency,
• interaction between different devices or sessions

measurable.

Advertising, retargeting and personalized marketing cookies are not run without prior valid consent from the user.

The user's rejection of advertising cookies may not mean that all advertising will disappear. However, personalization of ads and association with user behavior are limited.

11.Social media, video and map content

Third party video, maps, social media sharing, login or embedded content tools may be used on the platform.

These tools with their installation:

• device information,
• IP address,
• page address,
• session information,
• third party account information,
• interaction information with content

can process or create cookies on the device

Non-mandatory embedded content is kept behind a clickable placeholder until the user gives permission, if necessary.

The third party's own privacy and cookie rules may also apply when the user activates the relevant content.

12. Payment and fraud prevention technologies

Payment institutions, banks or security service providers; may use some cookies or similar technologies for transaction processing, strong authentication, fraud prevention and transaction security.

Limited technologies that are strictly necessary to process the payment may be considered mandatory.

However, if the payment provider uses the same technology for independent advertising, cross-site tracking or other non-essential purposes, these purposes are evaluated separately.

13.Separation of legal bases

Placing the cookie on the user's device or accessing the information on the device and the subsequent processing of personal data obtained through the cookie may be related to each other but may require separate legal evaluations.

Mandatory cookies, depending on the specific operation:

• establishment or execution of the contract,
• fulfillment of legal obligation,
• establishment, exercise or protection of a right,
• Legitimate interest, provided that it does not harm the fundamental rights of the person concerned,
• Other processing conditions stipulated in the relevant legislation

Can be used within the scope.

Explicit consent of the user is relied upon to the extent necessary for non-obligatory analytics, advertising, retargeting and similar cookies.

The same legal basis is not used for every cookie. The legal basis is determined by the actual purpose and use of the cookie, not by its name or provider.

14. Separation of information and explicit consent

This Cookie Policy and the explanations provided in the cookie panel inform users about the use of cookies.

Providing information does not mean that the user consents to non-essential cookies.

An active and positive selection is also taken from the user for cookies that require consent.The “I have read the cookie policy” option cannot be used as consent to analytics or advertising cookies alone.

The principle decision of the KVKK Board dated February 18, 2026 stipulates that the information and explicit consent processes should not be intertwined and should be regulated separately.

15.Cookie panel

The user may encounter the cookie preference panel when he first enters the site or when a significant change occurs that requires re-consent.

In the first layer, the following options are presented clearly and accessible:

• Accept All
• Reject All
• Manage Preferences

Accept and reject options;

• color,
• size,
• font,
• visibility,
• number of clicks,
• ease of access

It is not differentiated in a way that would lead the user to acceptance.

Presenting acceptance, rejection and preference options with equal visibility in KVKK's decisions regarding cookies; It is stated as good practice to provide information about the name, purpose, duration and party of the cookie.

16.Not using pre-selected options

Analytics, functionality, advertising and other non-essential categories are initially turned off.

The following methods do not constitute valid consent:

• pre-checked boxes,
• pre-activated keys,
• silence,
• inactivity,
• scrolling the page,
• continue to use the site,
• just close the window,
• Accepting membership or contract terms.

Consent is obtained by an affirmative action that clearly indicates the purposes to which the user consents. KVKK requires that explicit consent be specific, informed and based on free will; The European approach to data protection also provides that pre-ticked boxes and inactivity do not constitute valid consent.

17.Selection by category

The user can accept or reject categories of non-essential cookies independently of each other.

For example user:

• You may allow preference cookies,
• You can reject analytics cookies,
• may reject advertising cookies.

There is no single general consent that is “all or nothing”.

It is essential that cookies serving different purposes are not combined under a single general option.

18.Impact of rejection on service

Rejecting non-essential cookies:

• product viewing,
• basic membership procedures,
• shopping cart,
• ordering,
• payment process,
• exercise of consumer rights

does not block.

The user is not asked to accept advertising or non-essential analytics cookies in order to use the core marketplace service.

However, if a particular optional third-party feature is not technically available without running the relevant technology, that feature alone may not be available. The user is informed about this situation before activating the feature.

When evaluating whether consent is given freely within the scope of GDPR, it is taken into account whether data processing that is not necessary for the performance of the service has been converted into a contractual condition.

19.Withdrawal of consent

The user can change or withdraw his/her previously given cookie consent at any time.

Cookie preference center:

• from the "Cookie Preferences" link in the site footer,
• privacy or account settings,
• cookie icon or similar persistent access tool

available.

Withdrawal of consent is not designed to be more difficult or require further action than giving consent.

Withdrawal of consent has prospective consequences. It does not automatically cancel the validity of transactions carried out lawfully before withdrawal.

GDPR clearly provides that withdrawing consent should be as easy as giving consent.

20.Not repeatedly pressuring the user who refuses

If the user rejects non-essential cookies, the acceptance request will not be displayed repeatedly during the same visit or each page transition.

Requesting the preference is limited to the following cases:

• expiry of the valid preference registration,
• adding a new cookie purpose,
• a significant change of provider or data processing,
• legislation requires re-consent,
• user to delete cookie records,
• The user opens the preference center himself.

Continuous notifications are not displayed in order to erode the user's rejection decision. EDPB states that designs that force the user to give consent repeatedly may put pressure on free will.

21. Blocking tags before consent is given

Code that creates analytics, advertising, retargeting and other non-essential cookies will not be run before the user consents.

Just appearing “closed” in the cookie panel is not enough.Related:

• JavaScript codes,
• pixel labels,
• tag manager triggers,
• embedded contents,
• third party network requests

Technically it should also be blocked.

When the user gives permission, only technologies belonging to the approved category are activated.

When the user withdraws his/her consent, new data transmission is stopped and appropriate technical action is applied to delete or invalidate the relevant cookies under the control of the platform.

22.Consent records

The Platform may retain the following limited records to prove that consent was validly obtained or rejected:

• user's choice of acceptance or rejection,
• selected cookie categories,
• preference date and time,
• policy and panel version,
• preferred method,
• the required technical login or confirmation ID,
• The date the preference was changed or withdrawn.

Consent recording is not used to subject the user to additional advertising tracking.

The limited preference cookie used to record consent can be considered as a mandatory cookie in order to implement the user's choice.

23.Cookie inventory

In the cookie preference panel presented to the user or in the linked current cookie list, at least the following information is displayed for each cookie or similar technology actually used:

• the name of the cookie or technology,
• provider,
• is first or third party,
• domain name,
• category,
• clear purpose of use,
• residence or permanent status,
• storage period,
• relevant third party service,
• international transfer status to the extent possible.

A general statement like “Analytical cookies may be used” is not sufficient on its own. Real cookies in the live system should be scanned regularly and recorded in the inventory.

In the KVKK application, it is envisaged to provide information about the name of the cookie, its purpose, duration and whether it is a first or third party.

24.Storage periods

Each cookie is stored only for the period necessary for its intended use.

Session cookies may expire when the browser is closed or the session ends.

Duration of persistent cookies;

• necessity of the function,
• user expectation,
• need for security,
• data minimization,
• technical settings of the provider,
• applicable legislation

is determined by taking into account.

The duration in the cookie inventory must be the same as the actual technically set duration of the cookie.

Cookies that have expired, are no longer in use or whose purpose has been lost are removed.

25.Third party service providers

To the extent used, the platform may include third-party providers in the following service groups:

• payment and banking services,
• content distribution and security services,
• analytics and performance measurement,
• advertising and conversion measurement,
• map and location services,
• video and media content,
• live support and communication,
• social media tools,
• bug tracking and technical monitoring.

A provider that is not actually used will not be added to the inventory solely on the grounds of possible use. Before a new service provider is activated, its cookies, data flow, storage period, legal role and international transfer conditions are examined.

26.Data transfer abroad

The use of third-party analytics, security, advertising, content distribution, cloud or similar services may result in cookie data being transferred to servers outside Turkey.

Transfer abroad is not automatically considered lawful based solely on cookie consent.

In terms of transfer also:

• qualification decision,
• standard contract,
• binding company rules,
• appropriate method of assurance,
• Exceptional transfer conditions regulated by law

evaluated.

The current KVKK regime in Turkey envisages appropriate assurance methods such as standard contracts and binding company rules in international transfers.

In case the data of European Union or European Economic Area users are transferred to third countries, the transfer conditions within the scope of GDPR are also evaluated.

27.Users in the European Union and other countries

If allbazaardan.com offers goods or services to people in the European Union or the European Economic Area or monitors the behavior of these people, GDPR and electronic communications privacy rules are taken into account to the extent applicable.

In this context:

• Non-essential cookies are not run without prior consent,
• consent is specific and informed,
• categories are managed separately,
• pre-checked boxes are not used,
• the user can easily withdraw his/her consent,
• The service is not subject to acceptance of non-essential data processing.

European electronic communications regulations provide users with the opportunity to refuse the retention of cookies or similar records on their devices.

28.Browser and device settings

Users can set cookies via browser or device settings:

• can view,
• can delete,
• can prevent,
• You can limit it to certain sites,
• can turn off third-party cookies.

Browser settings do not replace the cookie preference panel on the platform. The platform offers the user the opportunity to choose on a category basis through its own preference center.

Blocking mandatory cookies from the browser;

• account login,
• basket,
• security verification,
• payment,
• order,
• protection of preferences

It may cause basic functions such as

to not work.

29.Consequences of deleting cookies

When the user deletes all cookies in the browser:

• The session may end,
• the basket may be empty,
• language or currency preference can be reset,
• cookie consent record can be deleted,
• The platform may ask for preferences again.

Deleting cookies may not automatically delete data previously lawfully obtained by the third-party service provider. Requests for deletion of personal data are evaluated separately within the scope of the relevant privacy policy and application procedures.

30. Tracking technologies of vendors and third parties

Independent sellers are not allowed to include their own tracking codes, advertising pixels, externally linked invisible images, or unauthorized scripts in product descriptions or store pages.

Sellers:

• cannot track customers outside the platform,
• cannot place cookies on user devices without permission,
• cannot use hidden tracking links in product descriptions,
• cannot transfer customer behavior to their own advertising systems.

If a merchant tool authorized by the platform is used, this tool is also included in the cookie inventory and preference system.

31. Information security

Technical and administrative measures proportional to the risk are applied for cookies and their associated records.

To the extent these measures are appropriate:

• use of secure connection,
• Secure attribute,
• HttpOnly attribute,
• appropriate SameSite setting,
• renewing session IDs,
• unpredictable session values,
• access authorization,
• recording and event monitoring,
• time limit,
• security tests

may contain.

It is essential that no passwords, open card information or unnecessary personal data are recorded in cookies.

32.Updating policy and inventory

This policy may be updated in the following cases:

• use of a new cookie or similar technology,
• change of service provider,
• Changing the cookie purpose,
• change of storage period,
• adding a new advertising or analytics tool,
• change in international data flow,
• Change of platform features or legislation.

A new purpose that expands the scope of existing consent will not apply as if it were within the scope of the old consent. When necessary, the user is informed again and a new selection is made.

The current version date of the policy is shown at the top of the page.

33.Relationship to other texts

This Cookie Policy;

• Privacy Policy,
• Information Text Regarding the Processing of Personal Data,
• Open Consent Policy,
• International Data Transfer explanations,
• membership and terms of use

This policy alone is not an express statement of consent.

The active selection made in the cookie panel is valid only for the categories and purposes disclosed to the user.

34.Application and contact

Questions regarding cookies, personal data processing activities or cookie preferences can be submitted through the following channels:

E-mail: [email protected]
KEP: [email protected]
Phone: +90 535 920 73 78
Address: Hamzabey Mahallesi, Karacabey Caddesi No:25/7, Mustafakemalpaşa / Bursa 16500, Turkey

Digital support requests can be submitted at any time through online channels.

Telephone and live support services are provided according to the current work and support calendar published on allbazaardan.com.