Cookie Policy
DRAFT — pending legal review. This text is a draft prepared for GEOSYS's new website. It must not be treated as final until our legal counsel has reviewed and approved it; its content may change as a result of that review. The Turkish version prevails in case of any discrepancy.
Last updated: 23 October 2026 · Version: 2026-10
Scope of this policy
This Cookie Policy is provided by GEOSYS BİLİŞİM SİSTEMLERİ ANONİM ŞİRKETİ (the “Company”) as data controller to inform you, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, about the personal data processed through cookies and similar technologies (such as local storage) on www.geosys.com.tr. It forms part of our Privacy Notice.
Data controller
- Company: GEOSYS BİLİŞİM SİSTEMLERİ ANONİM ŞİRKETİ (“Company”, “GEOSYS”)
- MERSIS No: 0394127612000001
- Address: Ortadoğu Teknik Üniversitesi Teknokent Yerleşkesi Üniversiteler Mahallesi İhsan Doğramacı Bulvarı No:33 K1-5 Çankaya/ANKARA, Türkiye
- Registered e-mail (KEP): geosys@hs01.kep.tr
- E-mail: info@geosys.com.tr
- Web: https://www.geosys.com.tr
What are cookies and similar technologies?
A cookie is a small text file placed in your browser by a website you visit and sent back to that site with later requests. Local storage (localStorage) is a similar technology that stores data in your browser. In this policy, “cookies” also covers such similar technologies unless stated otherwise.
Cookies may be first-party cookies set directly by us, or third-party cookies set by a provider whose content or service is used on our site. By duration, session cookies are deleted when you close your browser, while persistent cookies remain until they expire or you delete them.
Cookie categories
The cookies on our site are grouped into the following categories:
| Category | What is it used for? | Consent |
|---|---|---|
| Necessary | Operating and securing the site, preventing abuse, remembering your cookie choices and the admin panel session of authorised staff. | Exempt from consent; cannot be switched off. |
| Preferences | Remembering preferences such as language. No cookies are currently used in this category. | With your explicit consent. |
| Statistics | Visitor and usage statistics. No cookies are currently used in this category; the site does not use Google Analytics or similar analytics tools. | With your explicit consent. |
| Marketing & third-party content | Displaying third-party content such as Google Maps. These providers may set their own cookies. No advertising or tracking pixels are used. | With your explicit consent. |
Cookies in the non-necessary categories are not loaded until you consent. For example, the Google Maps map on the contact page is not shown and no connection is made to Google until you consent.
The current list of cookies used on our site is shown in the table below.
Cookies We Use
| Name | Provider | Category | Type | Duration | Purpose |
|---|---|---|---|---|---|
geosys-consent | GEOSYS (www.geosys.com.tr) | Necessary | localStorage | 12 months | Stores your cookie preferences. |
__cf_bm | Cloudflare | Necessary | cookie | 30 minutes | Protects the site against malicious bot traffic. |
cf_clearance / Turnstile | Cloudflare | Necessary | cookie | Session – 30 minutes | Performs the anti-spam security check on forms (only when a form is used). |
__Host-geosys_admin | GEOSYS (www.geosys.com.tr) | Necessary | cookie | 8 hours | Admin panel session for authorised staff only. |
NID, AEC, SOCS | Google (google.com) | Marketing & third-party content | cookie | 6 – 13 months | Displays the embedded Google Maps map; loaded only after you consent. |
Purposes and legal bases
- Necessary cookies: processed to provide the service you request (displaying the site, submitting forms, signing in to the admin panel) and to keep the site secure, based on Article 5/2-c KVKK (directly related to the establishment or performance of a contract) and Article 5/2-f KVKK (legitimate interest of the data controller, provided your fundamental rights and freedoms are not harmed). In line with the Board's Guide on Cookie Practices, these cookies are exempt from explicit consent.
- Preferences, statistics and marketing/third-party content cookies: used only with your explicit consent under Article 5/1 KVKK. Not giving consent does not prevent you from using the core functions of the site.
How we obtain and manage your consent
In line with the principles of the Personal Data Protection Board's Guide on Cookie Practices (2022):
- No pre-ticked boxes are used for non-necessary categories; every category is off by default.
- Rejecting is as easy as accepting: “Accept” and “Reject” are offered on the same layer with equal prominence.
- You can choose per category (“View preferences”).
- Necessary cookies are exempt from consent and are shown as “Always active” in the preferences panel.
- You can change or withdraw your consent at any time with the “Manage consent” button at the bottom right of every page. Withdrawal does not affect the lawfulness of processing before the withdrawal.
- Your choices are kept for 12 months. When this period ends, or when the version of this policy changes, you will be asked again.
You can also delete or block cookies in your browser settings. If you block necessary cookies, some parts of the site (e.g. forms) may not work.
Consent log
To be able to prove the consent you have given or refused, a consent record is stored on our servers when you save your choices. It contains:
- a randomly generated consent ID (which does not identify you directly),
- your choices per category,
- the version of the cookie policy you consented to (e.g. 2026-10),
- a timestamp,
- a one-way hash of your IP address, salted with a secret value — your IP address itself is not stored,
- a truncated browser identifier (user-agent).
The consent record is processed based on Article 5/2-ç KVKK (compliance with a legal obligation of the data controller) and Article 5/2-f KVKK (legitimate interest) and is deleted or anonymised after 3 (three) years.
Recipients and cross-border transfer
- Cloudflare, Inc.: provides content delivery (CDN), DNS, security and form spam protection (Turnstile) for our site. In connection with
__cf_bm,cf_clearanceand Turnstile, your IP address and browser information may be processed on Cloudflare servers worldwide. - Google Cloud (Google LLC / Google Cloud EMEA): the servers hosting our site and the consent records are located in the USA (us-east1 region).
- Google LLC (Google Maps): only if you consent to marketing & third-party content cookies, your IP address and cookie data are sent directly to Google when the embedded map loads. Google processes this data under its own privacy policy.
There is no adequacy decision announced by the Personal Data Protection Board for the USA. For cross-border transfers the Company relies on standard contracts under Article 9 KVKK as amended by Law No. 7499, notified to the Personal Data Protection Authority within 5 (five) business days of signature, or on another appropriate mechanism provided for in Article 9. See our Privacy Notice for details.
Your personal data may also be disclosed to competent public authorities where we are legally required to do so.
Your rights and how to apply
Under Article 11 KVKK you have the right:
- to learn whether your personal data is processed,
- to request information about the processing if it is,
- to learn the purpose of the processing and whether the data is used in line with that purpose,
- to know the third parties in Türkiye or abroad to whom your personal data is transferred,
- to request rectification if your personal data is incomplete or inaccurate,
- to request erasure or destruction of your personal data under the conditions of Article 7 KVKK,
- to request that rectification, erasure or destruction be notified to the third parties to whom your data was transferred,
- to object to a result to your detriment arising from analysis of your data exclusively by automated systems,
- to claim compensation if you suffer damage because of unlawful processing of your personal data.
You can submit requests concerning your rights under Article 11 KVKK, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by any of the following methods:
- Online request form: the KVKK request form at /en/data-request,
- Written application: a wet-signed letter delivered by hand to the address above or sent by post or notary,
- KEP: from your registered electronic mail (KEP) address to geosys@hs01.kep.tr,
- E-mail: to info@geosys.com.tr from an e-mail address you have previously provided to us and that is registered in our systems.
Under the Communiqué, your application must state your first and last name, your signature if the application is in writing, your Turkish ID number (for Turkish citizens) or your nationality and passport number (or ID number, if any) for foreign nationals, your residential or business address for notifications, your e-mail address, telephone and fax number if any, and the subject of your request.
Your request will be concluded free of charge as soon as possible according to its nature and within 30 (thirty) days at the latest, as required by Article 13 KVKK. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, the reasons will be given in writing or electronically.
If your request is rejected, if you find our answer insufficient or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 KVKK within 30 (thirty) days of learning of our answer and in any case within 60 (sixty) days of your application.
Changes
We update this policy when the cookies used on our site or the applicable legislation change. If a new non-necessary cookie is introduced, the policy version will change and your consent will be requested again. The current version is always available on this page.