Cookie Policy

This Cookie Policy has been prepared to inform users about the cookies and similar tracking technologies used by Relax by Espeki on www.espeki.com.tr (the “Site”). It is compliant with KVKK and with electronic communications legislation.

1. What Is a Cookie?

A cookie is a small text file placed on your device through your browser by the websites you visit. Cookies are used to make the Site work correctly, to remember your preferences, and for usage analysis and marketing purposes.

For the purposes of this Policy, the term “cookie” covers, in addition to classic HTTP cookies, other tracking and information-gathering technologies performing a similar function. These include flash cookies (LSOs), web beacons, tracking pixels, HTML5 local/session storage, mobile application software development kits (SDKs) and fingerprinting techniques. Such technologies are also assessed according to the categories defined below and are subject to the same explicit consent principles.

2. The Cookie Categories We Use

2.1. Strictly Necessary Cookies

These are required for the essential functions of the Site. They are processed within the scope of our legitimate interest and the performance of the contract, provided that they do not harm the fundamental rights and freedoms of the data subject; no explicit consent is sought. If they are blocked through browser settings, some parts of the Site may not work.

Note: a security technology that uses no cookies. Cloudflare Turnstile bot protection verification runs on the forms on the Site. On this site Turnstile places no cookies and leaves no persistent record in your browser; it evaluates only the IP address and browser signals at the moment of the request. It is therefore outside the scope of cookie preferences and cannot be refused. Without verification, the forms do not work.

2.2. Functional Cookies

These are used to remember settings such as your language and display preferences. They are subject to your explicit consent.

2.3. Analytics Cookies

These collect visit statistics in order to understand how the Site is used (Google Analytics 4). The IP address is anonymised before processing. They are active only when you give explicit consent.

2.4. Marketing / Targeting Cookies

These are used through Google Ads and the Meta (Facebook/Instagram) Pixel to display advertising matched to your interests and to measure advertising performance. They are active only when you give explicit consent.

3. The Explicit Consent Requirement (Important)

Categories other than strictly necessary cookies, namely functional, analytics and marketing cookies, are not activated without your explicit consent. Third-party tracking scripts and tags, including Google Analytics 4, Google Ads and the Meta Pixel, are not loaded and collect no data until you give explicit consent. Google Tag Manager “Consent Mode v2” and equivalent consent management mechanisms are used for this purpose.

If you do not give explicit consent, the essential functions of the Site continue to work; only the tracking in the category you have chosen is disabled. You may change your decision at any time through the “Cookie Settings” link in the Site footer.

4. Cookie List

The table below summarises the principal cookies used on the Site.

The current cookie list is updated regularly and the latest version can be accessed through this page. You can inspect the cookies loaded at any given moment through your browser’s developer tools (Application > Cookies).

5. Third-Party Cookies, Transfer Abroad and Security Measures

Analytics and marketing cookies are placed by the relevant providers (Google LLC and Meta Platforms Ireland Ltd.); the data collected by those cookies may be processed on those providers’ servers located abroad. The transfer is based on the provisions of the Standard Contract (SCC) within the framework of KVKK art. 9 and the Regulation on the Transfer of Personal Data Abroad dated 10.07.2024.

The technical and administrative measures applied during transfer: TLS 1.2+ encryption, IP anonymisation (GA4), authorisation-based access control and an authorisation termination procedure, regular backup, provider compliance checks (DPA, ISO 27001, SOC 2) and periodic risk assessment. You may withdraw your consent to consent-based transfer abroad at any time.

6. Managing Your Cookie Preferences

Through the cookie notice (consent management tool) presented on your first visit to the Site, you may accept or refuse the categories other than strictly necessary cookies, or make a selection on a category basis. You may update your preferences at any time through the “Cookie Settings” link in the Site footer.

You may also manage cookies, or block them entirely, through your browser settings:

• Google Chrome: Settings > Privacy and security > Cookies and other site data

• Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data

• Safari: Preferences > Privacy > Cookies

• Microsoft Edge: Settings > Cookies and site permissions

• Cloudflare, Inc. (USA): form security verification (Turnstile). No cookies are used; the IP address, TLS fingerprint and User-Agent header are processed at the moment of the request. Details: Turnstile Privacy Addendum and KVKK Privacy Notice §6.

In addition, you may use the opt-out tools of industry self-regulation programmes for interest-based online behavioural advertising. These tools are operated by third parties and are not managed by us; the links below are for information only:

• Network Advertising Initiative (NAI): http://www.networkadvertising.org/choices/

• Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

• Your Online Choices (EDAA, including Meta): https://www.youronlinechoices.com/tr

We remind you that browser-based preference management applies only to that browser/device, and that the same preference must be set again on another browser or device.

7. Retention Periods

The retention periods of the cookies are stated separately for each cookie in the table above. The periods are limited to the end of the session (temporary) or to a maximum of 24 months (persistent).

8. Your Rights and Complaints

Data Controller: ESRA PERUZE KIZILTUĞ TİNER, ESPEKİ · Address: Yakacık Yeni Mah. Samandıra Cad. No:49/A Kartal / İstanbul · Telephone: +90 540 010 24 34 · E-mail: merhaba@espeki.com.tr

You may exercise your rights under KVKK art. 11 in respect of the personal data processed through cookies by the methods set out in the KVKK Privacy Notice: merhaba@espeki.com.tr. We recommend writing “KVKK Application” in the subject line of your application. Your right to complain to the Personal Data Protection Authority under KVKK art. 14 in respect of your application is reserved.

9. Updates

This Cookie Policy is updated if the content or the legal framework changes. Effective date: 01.05.2026. The version history can be followed in the Version History table at the beginning of the document.