- Home
- Cookie Policy
Cookie Policy
Gazali Aviation's cookie policy: the three strictly necessary first-party cookies (gaSID, gaAdmin, ga_cerez), the Google, Meta and Cloudflare tools used when enabled, analytics and marketing cookies written only with your consent, Google Consent Mode, browser storage and how to delete or block cookies.
Template text notice
The text below is a draft prepared to complete the structure of this site. Before publication it must be reviewed by your legal counsel against the company's actual data processing operations.
1. What a cookie is
A cookie is a small text file that is saved to your browser when you visit a site and sent back to that same site with subsequent requests. Cookies do not by themselves reveal your identity; they allow the site to recognize you during the same visit, for example so that your session continues across pages.
Depending on who places them, cookies can be divided into first-party (the site you are visiting itself) and third-party (an external service on the site) cookies. By duration, there are session cookies, which are deleted when the browser is closed, and persistent cookies, which remain in the browser until a specified date.
2. Types of cookies
- Strictly necessary cookies: are required for the basic functions of the site to work. Maintaining the session, form security and remembering your cookie preference fall within this scope. If they are blocked, basic functions such as forms do not work; for this reason, under the legislation, no prior consent is required for these cookies.
- Analytics / performance cookies: collect statistics such as the number of visitors, which pages are viewed and on-site behavior.
- Marketing (advertising and targeting) cookies: are used to measure the effectiveness of advertising, to display advertising based on your interests and to track you across different sites.
The cookie preferences window on our site follows this classification: strictly necessary cookies are always active; analytics and marketing cookies are used only in the categories you allow.
3. Cookies used on this site
Our site itself writes the following three first-party cookies; all three are strictly necessary cookies. Analytics and marketing cookies are written only when the tools described in Section 4 are enabled on the site and only if you allow the relevant category.
| Name | Scope | Function | Duration | Flags |
|---|---|---|---|---|
| gaSID | Entire site (path=/) | PHP session identifier; carries the CSRF security token used in form submissions and, for administration panel users, the panel session. | Session only — deleted when the browser is closed; the panel session is invalidated on the server after 60 minutes of inactivity. | Secure, HttpOnly, SameSite=Lax |
| OtrmID | Only /yonetim | Written if "Keep me signed in" is selected at the administration panel sign-in; it remembers this device and is matched against the device record on the server. When the panel session ends, signing in again from this device happens automatically or with the password only. It is intended only for panel users; it is not written to visitors' browsers. | 60 days (not extended by use). | Secure, HttpOnly, SameSite=Lax |
| ga_cerez | Entire site (path=/) | A copy of your cookie preference: which categories you have allowed and the date of your decision. The primary record is kept in your browser's local storage (Section 5). | 180 days | Secure, SameSite=Lax |
gaSID and OtrmID are marked HttpOnly; they cannot be read by the scripts on the page. ga_cerez is written by the script of the cookie preferences window and is therefore not HttpOnly; it carries only your consent preference. The Secure flag ensures that they are sent only over an encrypted (HTTPS) connection, and SameSite=Lax ensures that they are not sent with requests triggered from other sites.
4. Third-party measurement, advertising and security tools
The following tools run only when their IDs are configured on the site. A tool whose ID has not been configured is not loaded on the page at all, and no request is sent to its provider.
| Tool | Provider | Category | Cookies it may write |
|---|---|---|---|
| Google Tag Manager | Tag manager; the tags it loads are subject to the consent rules below | Writes no cookies itself | |
| Google Analytics 4 | Analytics | _ga and cookies beginning with _ga_ | |
| Google Ads | Marketing | Cookies beginning with _gcl_ (e.g. _gcl_au) | |
| Meta Pixel | Meta | Marketing | _fbp, _fbc |
| Cloudflare Turnstile | Cloudflare | Strictly necessary (form security) | Writes no cookies on our site's domain |
The retention periods of these cookies are set by the providers; typically, _ga cookies are kept for up to 2 years, and _gcl_au, _fbp and _fbc for 90 days.
If you do not give consent: Google tags are used in the advanced mode of Google Consent Mode (v2). In this mode the tags are loaded on the page regardless of your cookie preference. As long as you have not allowed the relevant category, or have refused it, they neither write nor read cookies; however, cookieless measurement requests containing the address of the page you visit, your IP address and your device and browser information are sent to Google. If you allow the analytics or marketing category, the relevant measurement is carried out with cookies.
Where Meta Pixel is enabled, its script is loaded on the page and your browser connects to Meta's servers while it loads; unless you allow marketing cookies, the pixel is initialized in consent-revoked mode, in which it writes no cookies and sends no measurement events.
Where Cloudflare Turnstile is enabled, a verification runs on our forms and on the administration panel sign-in page to distinguish automated submissions; for the verification your browser connects to Cloudflare's servers, and when a form is submitted the verification result is passed to Cloudflare together with your IP address. This verification is used for form security and does not depend on your cookie preference.
If you later withdraw your consent, the identifiers written on our site's domain that belong to a category you have not allowed (_ga, those beginning with _gcl_, _fbp, _fbc) are deleted from your browser; our pages cannot access cookies on the providers' own domains, which you can delete from your browser settings (Section 7).
Apart from these tools, the scripts, style files, fonts and images of our site are served from our own server; there are no social media embeds or external map, video or font services on the site.
5. Browser storage that is not a cookie (local storage and session storage)
Some of your preferences and records are kept not in a cookie but in your browser's local storage (localStorage) or session storage (sessionStorage). The difference matters: data in these stores is not sent automatically to the server with requests; it remains only on your device. Data in local storage is deleted when you clear your browser data, and data in session storage when you close the tab.
| Key | Storage | Function |
|---|---|---|
| ga_cerez_riza | Local storage | Your cookie preference: which categories you have allowed and the date of your decision. It is the primary record of the preference; after 180 days it is treated as expired and you are asked again. |
| gazali-teklif-sepeti | Local storage | The contents of the quote basket you create on the parts sales page. Unless you submit the request, this list is only in your own browser; when you submit the request, the parts in the basket are transmitted to us with your request. |
| gazali-parca-gorunum | Local storage | The grid or list view you select in the parts catalog. |
| gazali-sepet-gonderilen | Session storage | A short-lived marker kept after your parts request is submitted so that only the submitted parts are removed from the basket; it is deleted when you return to the page. |
| gazaliOnYukleyici | Session storage | A marker kept so that the opening animation is shown only once in the same tab. |
| theme, sidebar-mini | Local storage | Appearance preferences of the administration panel only (light/dark theme, collapsed sidebar). |
The ga_cookie_ack record used by the previous version of the cookie notice is no longer used; if it remains in your browser, the site deletes it and asks for your preference again.
6. Cookie notice and your preferences
On your first visit to the site, and when your preference record expires, a cookie notice is shown at the bottom of the screen. The notice presents three options with equal prominence: accepting all, rejecting all, or opening the cookie settings to choose categories. In the preferences window, strictly necessary cookies are always active; analytics and marketing cookies are off unless you turn them on. Your decision is stored in your browser for 180 days, as described above.
Continuing to use the site or leaving the notice unanswered does not count as consent; as long as you have not made a decision, analytics and marketing cookies are not written. The cookieless measurement requests that Google tags send even without consent are explained in Section 4.
You can change or withdraw your preference at any time through the cookie icon that appears in the corner of the page once you have made a decision, or through the cookie settings button on the legal notice pages. Withdrawal does not affect the lawfulness of the processing carried out up to that point.
7. Deleting and blocking cookies from your browser
You can delete cookies at any time or have your browser block them from being written. The paths below reflect the general settings layout of browsers; menu names may vary by version.
- Google Chrome: Settings → Privacy and security → Third-party cookies / Delete browsing data. For a single site: the lock icon in the address bar → Site settings → Cookies and site data.
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data / Manage Data. For a single site: the shield and lock icons in the address bar → Clear cookies and site data.
- Safari (macOS): Safari → Settings → Privacy → Manage Website Data → Remove. On iOS: Settings → Safari → Clear History and Website Data.
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data → See all cookies and site data.
You can also clear local storage (localStorage) data from the same screens; browsers mostly present these two kinds of data together under the heading "site data". If you clear local storage, your cookie preference is also deleted and the notice is shown again.
8. What happens if you block strictly necessary cookies
If you block the gaSID cookie, your session cannot be maintained across pages. In that case the form security token is renewed with every request, so the request and contact forms on the site cannot be submitted and signing in to the administration panel is not possible; the site remains readable but form submission does not work. Blocking the OtrmID cookie only disables the "Keep me signed in" option: the e-mail address and password are asked at every panel sign-in; it does not affect visits to the site. If you block the ga_cerez cookie, your preference continues to be kept in local storage; if local storage is also blocked, your preference applies only to that page and the notice is shown again on the next page.
9. Legal basis
Strictly necessary cookies are required for the site to perform the function you have requested and are used on the legal grounds of legitimate interest and performance of the service under Article 5(2) of the KVKK; no prior consent is required for such cookies. Analytics and marketing cookies, on the other hand, are used only on the basis of your explicit consent; you can withdraw your consent at any time through the cookie settings. For general information concerning the technical data processed through cookies and the tools in Section 4, you may consult the Privacy Policy and the KVKK Disclosure Notice.
10. Changes
This text may be updated when necessary. If a new cookie starts to be used on the site or a third-party service is added, the tables above are updated before that change. The current version is always published on this page.
Last updated: 8 October 2026