Privacy
Privacy and Cookie Policy
Information about personal data, cookies, browser storage and the third-party services actually used on the Umran Makine website.
Last updated: 23 July 2026
Reading this page or continuing to use the site does not mean that you consent to optional categories.
1. Purpose and scope
This policy explains personal-data processing on umranmakine.com, operated by Umran Makine, including cookies, localStorage, sessionStorage and the third-party services actually used. It covers site visitors, people who send contact or quotation requests and authorised admin users.
2. Last updated
Last updated: 23 July 2026. The current version is the text published on this page.
3. Data controller
Umran Makine Sanayi ve Ticaret Ltd. Şti.
Sanayi Mh, Sanayi Cd, Kurtköy Sanayi Sitesi, No:44 / B20, 34906 Pendik / İstanbul
4. Contact
For questions about privacy and personal data: info@umranmakine.com. Phone: +90 532 334 46 18.
5. Categories of personal data
- Identity and contact: name, surname, email and phone.
- Customer and request: company, country, city, postal code, address, subject, message, notes, selected products, variants and quantities.
- Technical and security: IP address, time, request/response information, limited browser and device signals, and the Turnstile verification result.
- Preference and measurement: cookie-category choices and permitted analytics events. Analytics event payloads do not include names, email addresses, phone numbers, messages or target URLs.
6. Collection methods
Data is collected electronically through information you enter directly on the site and forms, communications you initiate by phone, email or WhatsApp, browser storage, security checks and measurement technologies that you permit.
7. Processing purposes
- Receiving, assessing and responding to contact and quotation requests.
- Managing requested product, sales and after-sales processes.
- Maintaining the security and continuity of the site, forms and authorised admin area.
- Subject to your choices, measuring site use and campaign conversions and improving content and performance.
- Meeting legal obligations and establishing, exercising or protecting rights.
8. Legal bases
Depending on the activity, processing may rely on the grounds set out in Article 5 of the KVKK, including necessity for establishing or performing a contract, compliance with a legal obligation, establishing, exercising or protecting a right, and legitimate interests that do not prejudice fundamental rights. Optional functional, analytics and marketing technologies depend on your explicit category choice. This does not mean that one basis automatically applies to every processing activity.
9. Site visits and technical logs
Site requests pass through Cloudflare infrastructure. IP address, timestamp, requested path, response status and limited device/browser information may be processed in technical logs to deliver the service, prevent attacks and troubleshoot errors. These security and delivery logs are independent of the analytics preference in the cookie panel.
10. Contact form
The contact form processes name, company, email, phone, topic and message fields. The information is received through /api/lead to answer and follow up your request and, after Turnstile verification, is delivered to the authorised sales channel. The form remains available with necessary-only preferences.
11. Quotation form
The quotation form processes name, surname, email, phone, company, country, city, postal code, address, notes and product configurations in the request list. This information is used to create the request and allow the sales team to assess it. The form works with necessary-only preferences; reading the policy link is not consent to optional cookies. Information entered in the form fields is held temporarily only in the browser’s sessionStorage under the umran:quote-form-draft:v1:<locale> key so the draft can be restored when you leave and return in the same tab. This draft uses neither cookies nor localStorage; it is not sent to the server, D1, CRM or analytics as a separate record and is deleted after a successful submission. The sessionStorage lifecycle ends when the tab is closed.
12. Phone, email and WhatsApp
When you contact us through these channels, the content and contact details you provide are processed to answer your request. The WhatsApp link does not load a WhatsApp script on this site; WhatsApp/Meta’s own terms and privacy practices apply after you open the link. Phone and WhatsApp click measurement uses only permitted, stable event names without PII.
13. Cloudflare Turnstile
Turnstile is a necessary security service that protects contact and quotation forms from automated abuse. It produces short-lived verification data in the browser and the Worker verifies the result with Cloudflare. Pre-clearance and the cf_clearance cookie are not used in this implementation.
14. Admin area and Cloudflare Access
Only /admin and /api/admin paths are protected by Cloudflare Access. CF_Authorization verifies an authorised session; umran:quote-admin:v1 and temporary sessionStorage keys maintain admin working state. This area is not intended for public visitors and authorisation is also checked server-side.
15. Google Maps
The map on the contact page is not loaded initially. The Google Maps iframe loads only when you accept the functional category or explicitly select “Enable map”. This site cannot delete third-party identifiers on Google domains; withdrawing your choice prevents subsequent map loads.
16. Google Tag Manager and Google Analytics 4
GTM-T5WRR5RM centrally manages measurement tags; the GA4 measurement ID is G-Y1QWGVMNJL. Consent Mode v2 default-denied signals are queued before GTM. analytics_storage is granted only with analytics consent. Product list/view/selection, add-to-quote, quotation start, successful contact/quotation response, PDF download and phone/WhatsApp clicks are measured through a PII-free event contract; form errors are diagnosed only through limited error types. Names, email addresses, phone numbers, addresses, notes and other field values in the quotation-form sessionStorage draft are not added to analytics events.
17. Cloudflare Web Analytics
The Cloudflare Web Analytics beacon is not injected automatically. Its manual script, which does not use cookies or localStorage, is deferred and loaded only after analytics consent to provide aggregate performance and RUM measurement.
18. Google Ads connection and Consent Mode v2
With consent denied by default, Google tags may send limited measurement signals without using cookies. Analytics cookies are enabled only after analytics consent; advertising storage and personalisation signals are enabled only after marketing consent.
GA4 generate_lead remains the sole Primary quotation conversion. Direct Google Ads tags measure phone/WhatsApp clicks, full-catalogue downloads and quotation-form starts only as Secondary observation actions; they are not campaign Primary bidding goals. These tags follow Consent Mode v2 signals; ad_storage, ad_user_data and ad_personalization are granted only with marketing consent.
19. Cookie and technology categories
- Necessary
- Required for security, forms, your request list and cookie preferences; it cannot be disabled.
- Functional
- Enables optional features such as Google Maps.
- Analytics
- Helps us understand how you use the site, measure performance and improve our content.
- Marketing
- Helps us measure advertising campaign performance and, with your permission, show you more relevant advertising.
20. Actual technology and storage inventory
The table below includes only services found during the audit and used in this implementation.
| Category | Service / provider | Cookie / storage | Purpose | Preference / basis | Duration / criterion | Transfer |
|---|---|---|---|---|---|---|
| Necessary | Cookie preference record Umran Makine | localStorage: umran:consent:v2 | Stores category choices and the time of the choice. | Necessary to apply your preference | 180 days | Umran Makine browser storage; not transferred to a third party |
| Necessary | Request list Umran Makine | localStorage: umran:request-list | Stores product configurations added to the request list. | Necessary for the request-list function you choose to use | Until submitted or cleared by the user | Remains in the browser until the form is submitted |
| Necessary | Quotation-form draft Umran Makine | sessionStorage: umran:quote-form-draft:v1:<locale> | Restores the approved form fields when you return to the quotation page in the same tab. | Necessary for the same-tab form continuity you choose to use | Until successful submission or the tab is closed | The draft is not transferred as a separate record; values are processed only when the form is submitted |
| Necessary | Cloudflare Turnstile Cloudflare, Inc. | Short-lived security token; pre-clearance is not used | Protects forms from automated abuse. | Necessary for site and form security | Limited to the request and verification period | Technical security data may be processed on Cloudflare infrastructure |
| Necessary | Cloudflare Access and admin storage Cloudflare, Inc. / Umran Makine | Only on /admin: CF_Authorization, umran:quote-admin:v1 and temporary sessionStorage keys | Maintains authorised admin sessions and draft working state. | Necessary to secure and operate the authorised admin area | Until the session ends or the relevant admin record is cleared | Identity and security data may be processed on Cloudflare infrastructure |
| Functional | Google Maps Google LLC | Identifiers such as NID and __Secure-STRP may be visible on Google domains | Displays the interactive map on the contact page. | Your functional preference or explicit “Enable map” action | Duration determined by Google | A technical request is sent to Google infrastructure when the map is enabled |
| Analytics | Google Tag Manager and Google Analytics 4 Google LLC — G-Y1QWGVMNJL | After consent: _ga and _ga_Y1QWGVMNJL; cookies are not used when denied | Measures site use, performance and successful contact/request conversions. | Your analytics preference | According to the GA4 configuration; up to 2 years | Measurement data may be sent to Google infrastructure with analytics consent |
| Analytics | Cloudflare Web Analytics Cloudflare, Inc. | Does not use cookies or localStorage | Provides aggregate performance and real-user measurement. | Your analytics preference | Current retention settings in the Cloudflare service | Performance data may be sent to Cloudflare infrastructure with analytics consent |
| Marketing | Google Ads conversion measurement and GA4 connection Google LLC | GA4 Primary import and direct Secondary conversion tags; uses Consent Mode signals | Supports campaign conversion measurement and advertising-personalisation signals when permitted. | Your marketing preference | Current retention settings in the Google Ads and GA4 accounts | Advertising signals may be sent to Google infrastructure with marketing consent |
21. International service providers and transfers
When Cloudflare or Google services are enabled, technical, security, functional or measurement data may be processed on those providers’ infrastructure outside Türkiye. The inventory states the conditions under which each service runs. This policy does not claim that a particular standard contract, adequacy decision or other transfer mechanism has been completed for the company; the applicable transfer basis and agreements require legal/KVKK review before production.
22. Retention and disposal
The verified duration or deletion criterion for browser storage is stated in the inventory. Form and business-communication records are retained only as required by the relevant request, sales process, legal obligations and potential dispute periods, then deleted, destroyed or anonymised under the applicable retention and disposal procedure. This policy does not invent an unverified fixed period.
23. Data security
Forms are protected by Turnstile; the admin area is restricted by Access and a server allowlist; transmission uses HTTPS; and admin/archive data is protected by access controls. Analytics events are restricted so they do not carry PII. No technical measure guarantees absolute security; applicable incident-response procedures are used when an event is detected.
24. Your rights under Article 11 of the KVKK
Under Article 11 of the KVKK, you may apply to the data controller to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties to whom it is transferred in Türkiye or abroad;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under Article 7 of the KVKK;
- request that correction, deletion or destruction be notified to recipients;
- object to an adverse result produced solely through automated analysis;
- request compensation for damage caused by unlawful processing.
25. How to apply
You may submit an application, including information that verifies your identity and clearly states your request, in writing to Umran Makine Sanayi ve Ticaret Ltd. Şti., Sanayi Mh, Sanayi Cd, Kurtköy Sanayi Sitesi, No:44 / B20, 34906 Pendik / İstanbul, or by another method permitted under the Communiqué on Procedures and Principles of Application to the Data Controller. You may ask info@umranmakine.com for procedural information; we do not represent that this email address alone is a legally sufficient formal channel for every application. Applications are answered as soon as possible and, as a rule, within thirty days depending on their nature.
26. Changing your cookie preferences
You can change your selection at any time through “Cookie preferences” in the footer. The preference record is valid for 180 days. When analytics consent is withdrawn, the site attempts to remove accessible first-party _ga and _ga_* cookies and performs a controlled reload to stop optional resources. This site cannot directly delete cookies on third-party domains.
27. Inactive services
Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity, YouTube embeds and reCAPTCHA are not active. The GA4–Google Ads connection and direct Secondary conversion tags are disclosed in the active technology inventory. If a new service is added, the inventory and preference version will be updated and visitors will be asked again.
28. Policy updates
This policy is updated if a service, purpose, category or legal assessment changes. A new optional service or material preference change requires a new consent version and a fresh choice from visitors. The date of the latest update appears at the top of the page.
