Privacy and Cookie Policy

1. What this policy covers

This document IS NOT AN INFORMATION NOTICE and does not take its place. Decision No. 2022/1358 of the Personal Data Protection Board (Kurul), which imposed an administrative fine of TRY 300,000, established that a complex 'privacy statement' covering every subject does not satisfy the obligation to inform under Article 10 of the KVKK. For that reason our obligation to inform is discharged by a separate document.

To learn for what purpose the personal data you send us through the quotation form and the service request form is processed, to whom it is transferred, the method and legal basis of collection, the retention period and your rights under Article 11 of the KVKK, please read the KVKK Information Notice. The two documents do not replace one another; they are read together.

Your cookie preference and the explicit consent you give when submitting a form are also separate from one another. Under Article 5/1-(f) of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Official Gazette 10.03.2018/30356), the information notice and explicit consent are discharged separately; they cannot be combined in a single box. That is how it is applied on this site.

• Covered: ozkoc.com.tr and its sub-pages.
• Not covered: the third-party sites we link to — LinkedIn, Facebook, Instagram, YouTube, Google Maps. Once you click through to those sites, their own cookie policies apply.
• Not covered: our in-house portal. The portal is on the company network, is closed to the internet and is not open to visitors.

2. What a cookie is and what it does

A cookie is a small text file saved in your browser when you visit a site. The site reads that file back on your next request; in this way it can remember you from the previous step.

Cookies are sometimes essential for the site to work — for instance, without the record that stores your cookie preference we would have to ask you the same question again on every new page. At other times they are not essential: they are used to keep visit statistics, to see how the pages are used or to carry out promotional work.

There are two further technologies that do the same job without a cookie: browser local storage (localStorage) and session storage (sessionStorage). Both fall within the scope of this policy, are subject to the same explicit consent rules and are also shown separately in the table below.

3. The full list of the cookies and similar records in use

The table below shows every cookie and similar record that may appear on the site. Apart from the rows marked 'Strictly necessary', no record is written into your browser before you give explicit consent to the category concerned.

The periods in the lifetime column are the maximum time a record can stay in your browser and are taken from the providers' official documentation. Records marked 'Browser session' are deleted when you close the tab. In rows where the provider's documentation gives no period, the commonly accepted value is written and its source is stated. None of these trackers is active on the site yet; when they are activated the periods will be measured live and this table will be updated.

'First party' means that the record is created on our own domain. Note: the _fbp and _fbc cookies written by the Meta pixel are technically first party — they are created on our own domain — but the identifier they contain is sent to Meta. That is why they are in the advertising category.

• None of the Google, Meta, Yandex and Microsoft records in the table is written before you give explicit consent to the category concerned. Until explicit consent arrives, the scripts of these providers are not added to the page at all; there is not a single line belonging to a tracker in the source code of the page.
• When you withdraw your explicit consent, the provider cookies in this table are deleted from your browser. Deletion is not tied to a fixed list of names: cookies whose names change according to the property or the counter, such as those beginning with the prefixes _ga_, _ym_ and _gat_, are also found by scanning and cleared.
• Records written to third-party domains (Yandex domains, c.clarity.ms, clarity.ms, bing.com, facebook.com) cannot be deleted by the site's JavaScript. The only protection is that these records are never written without explicit consent — the whole arrangement is built on that.
• This list has been compiled from the current documentation published by the providers. Providers may change cookie names or periods; when they do, this list is updated and the change is reflected in the preference panel.

4. Cookie categories and their explicit consent status

Cookies are divided into four categories. You decide SEPARATELY for each category; you do not have to accept them as a block. You can permit analytics and refuse advertising, or accept both and leave session recording switched off.

Every category apart from strictly necessary cookies is subject to explicit consent. Under the Guidelines on Cookie Practices (No. 69, July 2025) of the Personal Data Protection Authority (Kurum), third-party analytics cookies require explicit consent; advertising and marketing cookies require explicit consent without exception.

No explicit consent is sought for strictly necessary cookies. The basis for this is the Cookie Guidelines, which govern cookies strictly necessary for the service to be provided; the guidelines count the consent management tool's own cookie within that scope as well. If we do not store your preference, we cannot respect your preference.

• STRICTLY NECESSARY — no explicit consent required. Needed for the site to work. Only the ozkoc_riza record that remembers your cookie preference goes in here. This category is not used for advertising, draws no profile of an individual and cannot be switched off.
• ANALYTICS AND MEASUREMENT — explicit consent is required. Measures how many people came, which pages were read and how visitors reached the site. Providers: Google (GA4), Yandex Metrica. It does not identify you by name.
• ADVERTISING AND RETARGETING — explicit consent is required. It is there so that you can see our promotions on social media after visiting our site. Provider: Meta. No one else's advertising is shown to you on this site.
• SESSION RECORDING AND HEATMAPS — explicit consent is required, and it is a consent SEPARATE from analytics consent. Providers: Microsoft Clarity, Yandex Metrica Session Replay. The details are in the next section.
• Yandex Metrica carries both the click map and the session recording in a single initialisation call of a single script; the two have been separated on this site and session recording has been tied to its own consent box. This has an unavoidable consequence: if you refuse analytics and permit session recording alone, Yandex Metrica is not loaded at all, and in that case session recording is done by Microsoft Clarity alone.
• Not giving explicit consent does not prevent you from using the site. There is no cookie wall: all the content, the product pages, the quotation form and the service form work in full even if you say 'Strictly Necessary Only'.

5. Session recording and heatmaps — what is recorded and what is not

Session recording is a more intrusive technology than the other cookies; that is why it is set out under its own heading and in plain terms. The aim is to see how the pages are actually used and to correct the interface: only in this way can we measure which button is not being seen, at which step of the form people give up and how far down the page is read.

This category is OFF by default and is switched on only if you give separate explicit consent. Analytics consent alone does not switch session recording on.

The recording is not a video of your screen. The structure of the page and a list of mouse, click and scroll events are recorded; the recording is then replayed by combining these two.

• WHAT IS RECORDED: mouse movements, the places clicked, how far down the page you scrolled, the time you spent on the page, the addresses of the pages you visited, screen size, browser and operating system information, and a general location at country/city level derived from the IP address on the provider's side.
• WHAT IS NOT RECORDED — WHAT YOU TYPE INTO FORM FIELDS: the text you type into the full name, company, e-mail, telephone, address, country, serial number, error code and description fields of the quotation and service forms is masked before the recording is taken. The recording shows that something was typed into a field; it does not show what was typed. Microsoft Clarity states in its own documentation that the contents of input boxes are masked in every mode and that this cannot be switched off; in addition, the data-clarity-mask marker and, for Yandex, the ym-hide-content marker are placed on the wrapper of the forms.
• WHAT IS NOT RECORDED — FILES: the content of the image attachments you upload to the quotation and service forms does not go into the session recording.
• WHAT IS NOT RECORDED — IDENTITY: the recordings are not linked to a name, an e-mail address or a telephone number. The provider assigns you a random identifier; that identifier is not matched with the personal details in our own records.
• RETENTION: session recordings are held not by us but in the provider's systems, and are subject to the provider's own period. The periods published in the providers' official documentation are 30 days for Microsoft Clarity and 15 days for Yandex Session Replay; these tools are not active on the site yet, and when they are activated the periods will be confirmed from the provider panel and this text will be updated. These periods are independent of the period for which your form submissions are kept in the in-house portal.
• HOW TO SWITCH IT OFF: the 'Strictly Necessary Only' button on the cookie banner is enough. To switch it off selectively, leave only the 'Session recording and heatmaps' toggle off in the 'Cookie Settings' panel. If you have permitted it before, you can switch it off through the 'Cookie Settings' link at the foot of the page; the moment you switch it off, the cookies of this category are deleted from your browser.

6. How you give your explicit consent and how you withdraw it

On your first visit to the site a cookie banner appears at the bottom of the screen. The three buttons on the banner sit ON THE SAME LAYER and are EQUALLY EASY TO REACH; none is hidden behind another and each gives a result with a single click: 'Accept All', 'Strictly Necessary Only', 'Cookie Settings'. Refusing is no harder than accepting.

In the 'Cookie Settings' panel there is a separate toggle for each category. There is no pre-ticked box: the panel shows your current state each time it opens, and if you have no record at all, every category that requires explicit consent arrives switched OFF. Your silence does not count as approval; nor does your carrying on using the page.

For as long as you have not given explicit consent, no third-party script is loaded into the page. The scripts are not embedded in the page; they are added only at the moment of consent. Even the preparatory pre-connection to the provider servers is deferred until consent — from the browser of a visitor who refuses, not even a name resolution goes to those providers.

• HOW LONG THE PREFERENCE LASTS: the explicit consent you give is remembered for 12 months. At the end of that period the record is treated as invalid and you are asked again. The date of consent, the categories you chose and the version of the text you approved are stored together in the ozkoc_riza cookie.
• WITHDRAWAL: there is a 'Cookie Settings' link in the footer of every page. By clicking it you open the panel and switch off whichever category you wish, or withdraw all of them by saying 'Strictly Necessary Only'. Withdrawing is as easy as giving.
• THE CONSEQUENCE OF WITHDRAWAL: the provider cookies of the category you switch off are deleted from your browser. Once you have said 'I refuse', a cookie carrying an identifier is not allowed to go on living in your browser. After the page is reloaded, the scripts concerned are not loaded again.
• WHY THE PAGE RELOADS: the session recording flag of Yandex Metrica can be set only at the moment the script is initialised; it cannot be switched on and off while it is running. That is why the page reloads once when you change your session recording preference, and this is announced to you with the sentence 'Your preference has been saved, the page is reloading'.
• WITHDRAWAL TAKES EFFECT FOR THE FUTURE: withdrawal produces its result from that moment onwards. For data collected before you withdrew, you can also apply to the provider directly; if you ask, we will guide you in making that application.
• IF THE TEXT CHANGES YOU ARE ASKED AGAIN: if the set of categories, the list of providers or the purpose text changes, your recorded consent is treated as invalid and the banner appears again. An arrangement you have not approved is not allowed to be treated as approved.
• YOUR BROWSER SETTING ALSO APPLIES: if you block cookies in your browser, the provider cookies cannot be created in the first place. In that case the site carries on working.

7. Seeing and deleting cookies from your browser settings

Independently of the preference panel on the site, you can also see cookies in your browser's own settings, delete them one by one or all at once, and block them for the future. The routes below are for the desktop versions; menu names may differ slightly from version to version.

• Google Chrome: the three dots at the top right > Settings > Privacy and security > Third-party cookies. To delete, use 'Delete browsing data' > 'Cookies and other site data' in the same section. Shortcut: chrome://settings/cookies
• Mozilla Firefox: the three lines at the top right > Settings > Privacy & Security > 'Cookies and Site Data' > 'Clear Data', or 'Manage Data' for a single site. Shortcut: about:preferences#privacy
• Safari (macOS): in the menu bar, Safari > Settings > Privacy > 'Manage Website Data' > select the site and Remove. On iPhone and iPad: Settings > Safari > 'Clear History and Website Data'.
• Microsoft Edge: the three dots at the top right > Settings > Cookies and site permissions > 'Manage and delete cookies and site data' > 'See all cookies and site data'. Shortcut: edge://settings/content/cookies
• WARNING: if you delete all cookies from your browser, the ozkoc_riza cookie is deleted too. That means your preference is forgotten and the cookie banner appears again. It is not a fault; it is you who deleted the record. When you see the banner again, all you need to do is state your preference once more.
• If you block the strictly necessary cookies as well, the site's security protection and the remembering of your preference may not work; the content will still be displayed.

8. Transfer of data abroad

The data generated by the cookies you have given explicit consent to is transferred to the providers' systems abroad. Hosting of the site and holding of form records, on the other hand, take place at a provider established in Türkiye; no data is transferred abroad for that work.

There is one further channel, independent of cookies: the channel set up so that a WhatsApp notification arrives on ÖZKOÇ's own telephone when a quotation, service or Human Resources form is filled in. The message is not sent to you; it goes to ÖZKOÇ's own number. However, because it travels over the WhatsApp Business Platform, Meta is a new recipient and the transfer is made abroad. THE CHANNEL IS CLOSED TODAY: not a single message is being sent. The message carries no full name, telephone, e-mail, address, fault description, quotation text or CV; all it carries is the type of request, the company name, the record number and, for a service request, the production-stopped indication. The details are in Sections 2 and 11 of the KVKK Information Notice.

Article 9 of the KVKK changed in 2024. As of today the Personal Data Protection Board has issued an adequacy decision for NO COUNTRY; our transfers cannot be based on an adequacy decision.

These transfers are of a continuous nature; they are neither incidental nor one-off. Because the exception of transfer on the basis of explicit consent (Art. 9/6) is provided only for incidental transfers, explicit consent cannot be relied on for continuous transfers. Our basis is the STANDARD CONTRACT in Article 9/3-(b) of the KVKK; it is notified to the Personal Data Protection Authority within 5 business days of the date of signature.

Do not confuse these two things: your cookie consent is the basis for PLACING THE COOKIE, while the standard contract is the basis for TRANSFERRING THE DATA ABROAD. If you do not permit a category, no data goes to that provider and no transfer arises at all. If you do permit it, the transfer is made within the scope of the standard contract.

• The personal data you send through the quotation and service forms passes only through our hosting provider's infrastructure in Türkiye; once it has been taken into the in-house portal, it is again kept in our systems in Türkiye. This data IS NOT TRANSFERRED to the cookie providers — to Google, Yandex and Microsoft. There are two exceptions and both are shown separately in the KVKK Information Notice: the arrival of the notification e-mail in our corporate mailbox, and the WhatsApp notification channel described above, which is closed today.
• To obtain information about the status of the standard contracts signed with the providers, you can write to ozkoc@ozkoc.com.tr.

9. Contact and updating of this policy

You can send any question about this policy to the data controller: ÖZKOÇ HİDROLİK MAKİNA SAN. VE TİC. A.Ş., Ömerli Mah. Hadımköy-İstanbul Cad. No:196, 34555 Arnavutköy / İstanbul — +90 212 550 48 06 — ozkoc@ozkoc.com.tr. Our working hours are 07:00–17:00 (UTC+3).

The route to follow in order to exercise your rights under Article 11 of the KVKK is explained in detail in Section 14 of the KVKK Information Notice.

The version of this policy is 2026-09-03. The criterion for your cookie consent is a separate number: the version of the cookie schema is 2026-08-26, and that number changes when a provider, a category or a purpose changes; when it does change, your recorded cookie consent is treated as invalid and the banner asks again.