Cookie Policy and Cookie Settings

This English version is provided for information. In case of any conflict, the Turkish text prevails.

Last updated: 30.10.2026

Document information

Cookie text version: cookie-2026-10-30.

1. About this policy

The website elisabettazanardi.com is operated under the Elisabetta Zanardi brand by ENVERO TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ (Envero Textile Industry and Trade Limited Company) (the Company). This Cookie Policy explains the cookies and similar technologies we use on our site, which personal data is processed with them, for what purpose and on what legal basis, and how you can manage your preferences.

This text is the information notice on cookies under Article 10 of the 6698 sayılı Kişisel Verilerin Korunması Kanunu (Personal Data Protection Law No. 6698, “KVKK”). For those visiting the site from the European Economic Area (EU countries, Iceland, Liechtenstein, Norway), it is also provided as information under Article 13 of the EU General Data Protection Regulation (GDPR); the European Union is one of our target markets.

Our other personal data processing, such as orders, accounts, wholesale applications, the contact form and the newsletter, is described in the Privacy Policy.

This text is prepared in Turkish and the Turkish text prevails. The English and Russian translations are provided for information; the translations have not been reviewed by a lawyer or translator. If there is a difference between a translation and the Turkish text, the Turkish text prevails.

2. Data controller

• Data controller: ENVERO TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ
• Address: Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul
• MERSİS no. (Central Registry System number): 0336042191900019
• Tax office and no.: Beyazıt V.D. / 3360421919
• Trade registry: İstanbul Ticaret Sicili Müdürlüğü (Istanbul Trade Registry Directorate), 515869-0
• Telephone: +90 530 446 67 77
• E-mail: info@elisabettazanardi.com
• Electronic notification address (UETS): 25959-36608-08735
• KEP address (Registered Electronic Mail): none.
• Applications concerning personal data: info@elisabettazanardi.com

3. What is a cookie?

Cookies are small text files that a website saves in your browser when you visit it. Thanks to cookies, the site remembers, for example, the products in your cart or the currency you selected across pages.

• Session cookie: Deleted when you close your browser.
• Persistent cookie: Stays in your browser until the period stated in the table expires or until you delete it.
• First-party cookie: Saved to the domain name of the site you are visiting (elisabettazanardi.com). Some first-party cookies are set by the code of a service provider running on our site. The information collected with these cookies is transmitted to that service provider.
• Third-party cookie: Saved to a domain name other than that of the site you are visiting.
• Browser storage (localStorage, sessionStorage): Small pieces of information that the site saves in your browser other than as cookies. Information in session storage (sessionStorage) is deleted when you close the tab or the browser. This policy covers these as well.
• Pixels and similar technologies: Small pieces of code placed on a page that make your browser send information to a service provider. This policy covers these as well.

4. Cookie groups

We divide the cookies on our site into three groups. Essential cookies are always on. Analytics and marketing cookies run only if you expressly give permission.

• Essential cookies (always on): Necessary for the store to work. They remember your cart, your login session, your currency and language preference, your cookie preference and that you have closed the announcement bar. We do not ask for separate permission for these cookies and records, and they cannot be turned off from the settings panel; however, calling a cookie “essential” does not, by itself, mean that no permission is required. The legal basis of each is written separately in Section 9. If you block them in your browser, functions such as the cart and login may not work.
• Analytics cookies (only with your permission): Help us understand how the site is used and which page or link led to an order. In this group are the WooCommerce order attribution cookies, the Google Analytics 4 cookies and the zanardi_cx_sent record.
• Google Analytics 4 (in the analytics group): Google Analytics 4 is loaded only if you permit analytics cookies; if you do not give permission, the Google Analytics code is not loaded on the page at all. Google’s Consent Mode v2 is used in basic mode. Google signals and the use of Google Analytics data for ad personalisation are off in every case. Besides page views, the events sent to Google Analytics 4 are product views, add to cart, begin checkout, purchase, submission of the contact form and the wholesale application form, newsletter sign-up and clicks on the WhatsApp button. In shopping events, product codes, product names, quantities, prices, the total amount and the currency are included, and in the purchase event the order number as well; no price or amount information is sent for wholesale orders. The order key in the address of the order confirmation page is removed from the address before it is sent to Google. To prevent the same purchase from being sent to Google Analytics 4 twice, the order numbers sent are kept, together with the time of sending, only in your browser, in the zanardi_cx_sent record.
• Marketing cookies (only with your permission): Help us measure the results of our advertisements and show our advertisements on Instagram and Facebook to people who have visited our site (Meta ad audiences, retargeting). This group contains the Meta Pixel cookies and the zanardi_cx_engaged record. This group is shown in the cookie banner and in the settings panel.
• Meta Pixel and the Meta Conversions API (in the marketing group): The Meta Pixel is loaded only if you permit marketing cookies; if you do not give permission, the Meta Pixel code is not loaded on the page at all and no notification is made from our server to Meta. The Meta Pixel transmits to Meta page views and the events of product view, add to cart, begin checkout, submission of the contact form and the wholesale application form, newsletter sign-up and clicks on the WhatsApp, e-mail and telephone links; it also transmits a custom event called “Engaged Visit” (EngagedVisit) when you actually spend time on a page (details below); in shopping events, product codes, quantities, prices, the total amount and the currency are also sent. The Meta Pixel is not loaded on the order confirmation and order payment pages. Automatic collection of button clicks and page information is off. The “automatic advanced matching” feature of the Meta Pixel is on: if you have allowed marketing cookies, the e-mail address, telephone number, first name, last name, city, state/province, postal code and country you type into forms on pages where the Meta Pixel is loaded (including checkout) may be hashed in your browser and sent to Meta through the Meta Pixel; Meta uses them to match you with its own users. Our server does not send this information. Of these events, we also report product views, Engaged Visits, submissions of the wholesale application and contact forms and clicks on the WhatsApp, e-mail and telephone links, and in addition completed orders, from our server to Meta through the Meta Conversions API; page views, add to cart, begin checkout and newsletter sign-up are sent only from your browser. Every notification from our server is made only if you allowed marketing cookies; for the order notification, you must have allowed them at the time of the order. The following events are reported from our server: (1) Purchase: a completed order, that is, when the order changes to “processing” or “completed” and was placed at most 24 hours earlier; for orders of wholesale users, a “Wholesale Order” (WholesaleOrder) event without any price or amount is reported instead. (2) Lead: a successfully submitted wholesale application or contact form, and a click on a WhatsApp, e-mail or telephone link; for a click, only the name of the channel (whatsapp, email or phone) is sent, never the address or the number itself. (3) View Content (ViewContent): your viewing of a product page; the content type (product), the product code (SKU), the quantity (1), the item price, and the value and currency (equal to the retail price) are sent; no price information is sent for wholesale users. (4) Engaged Visit (EngagedVisit, custom event): you stay at least 10 seconds on a visible page and also scroll at least 25% of it or touch, click or press a key; the page type (product, wholesale, shop, home or other) is sent. With every event the following is sent: the event name, the event time, an event ID, the action source (website), the address of the page where the event happened (without the query string and the # fragment; the addresses of my-account subpages are reduced to the base path; events on the order confirmation and order payment pages are not reported from the server at all; for Purchase and Wholesale Order the general checkout page address is sent, for form events the address of the page with the form), and, as user data, your IP address, the user agent of your browser and, if present, the values of the Meta cookies _fbp and _fbc (_fbc is created when the address contains an fbclid parameter). The event ID is generated at random and is the same as that of the matching Meta Pixel event in your browser, so that Meta does not count the same event twice. For an order, the ID is derived from the order number; because the Meta Pixel is not loaded on the order pages, the same order is not also sent from your browser. A Purchase event additionally carries the product codes, quantities, item prices, the total amount, the currency and the order number (inside the event ID); a Wholesale Order event carries the product codes, quantities and the order number (inside the event ID), and no price, amount or currency. Nothing else is sent from our server: your name, e-mail address, telephone number, postal address and any external ID are not sent, and no hashed personal data is sent either. The _fbp and _fbc values are saved on your order for the order notification and are deleted from the order once the notification is made or can no longer be made (if the order is not paid within 24 hours, at the latest at the next daily cleanup; if it is cancelled or fails). The recipient of Meta Pixel and Conversions API data is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); Meta may share this data with Meta Platforms, Inc. in the USA. If you allow marketing cookies, besides measuring the results of our advertisements, this data is also used to show our advertisements on Instagram and Facebook to people who have visited our site: we may add you to our ad audiences at Meta (custom audiences, retargeting). If you do not give permission, we do not add you to these audiences through our site; after you withdraw your permission, no new data is sent from our site to Meta; only if the payment confirmation of an order you placed while your permission was in place arrives outside your browser (from the bank or our order management system) may that order still be reported within at most 24 hours of the order. If you have an Instagram or Facebook account, Meta may match this information with your account and also process it for its own purposes; Meta’s own privacy policy applies to this processing.

Until you make a choice, no optional cookie is loaded and no external tracking code is loaded. Essential cookies are saved only when you perform the relevant action (when you select a currency or language, add a product to the cart, log in); the Site does not save cookies to your browser without such an action and without a cookie choice. If you continue to use the site without answering the cookie banner, only essential cookies run. Continuing to use the site is not regarded as permission. Not giving permission does not prevent you from using the site and the store.

The products in your cart and the cart total, and the name, e-mail and telephone you write at the payment step, are transferred to our order management system UNALSOFT Panel even if the order is not completed (the address is not transferred; if you are logged in, the name, e-mail and telephone in your account are also transferred whenever your cart changes), and are kept for 90 days at the longest as incomplete cart data. The purpose of this transfer is to detect and resolve technical problems at the payment step and to help you if you tell us that you could not complete your order; details are in the Privacy Policy. A separate commercial message consent is required to send you a reminder (by e-mail or WhatsApp) with this data; since there is no İYS (İleti Yönetim Sistemi, Message Management System) registration at the date this text is published, no commercial messages (including the newsletter and cart reminders) are sent until İYS registration is made.

5. The cookies and similar records we use

The table below shows the cookies and similar records that our site saves to your browser; the cookie and record list in the Privacy Policy is identical to this table. The * sign in a cookie name shows a variable suffix that the site adds to the end of the cookie name. The <kimlik> (<id>) in the _ga_<kimlik> cookie is a suffix derived from our Google Analytics measurement ID.

Cookie or record name	Provider	Group	Purpose	Duration	Party
zanardi_consent	Our site	Essential	Stores your cookie preference: the version of the cookie text and the short code of the tools active on the site at the time of the choice, your analytics and marketing choice, the date of the choice and a consent ID (made up of the creation time and random characters).	1 year	First party
zanardi_currency	Our site	Essential	Remembers the currency you selected; saved when you select a currency. Cannot be read by code on the page (HttpOnly). SameSite=Lax.	1 year	First party
zanardi_lang	Our site	Essential	Remembers the language you selected; saved when you select a language in the language selector. It is written by code on the page, so it is not HttpOnly. SameSite=Lax.	1 year	First party
zanardi_currency (the browser’s session storage, sessionStorage)	Our site	Essential	Saved when you select a currency in the currency selector; remembers the currency you selected in this tab, so that a page you return to with the browser’s back or forward button is shown in the currency you selected.	Session (deleted when the tab or browser closes)	First party
woocommerce_cart_hash	Our site (WooCommerce)	Essential	Tracks changes in the contents of your cart so that the cart is shown correctly. Saved when you perform a cart action (for example, when you add a product to the cart).	Session (deleted when the browser closes)	First party
woocommerce_items_in_cart	Our site (WooCommerce)	Essential	Remembers whether there are products in your cart. Saved when you perform a cart action.	Session (deleted when the browser closes)	First party
wp_woocommerce_session_*	Our site (WooCommerce)	Essential	Recognises your cart session and remembers the products in your cart. Saved when you perform a cart action.	2 days	First party
wordpress_logged_in_*	Our site (WordPress)	Essential	Remembers that you have logged in to your account. Set only for those who log in.	Session; 14 days if “Remember me” is selected at login	First party
wordpress_sec_*	Our site (WordPress)	Essential	Securely verifies your login session. Set only for those who log in.	Session; 14 days if “Remember me” is selected at login	First party
wordpress_test_cookie	Our site (WordPress)	Essential	Tests, during login, whether your browser accepts cookies.	Session	First party
zanardi_announcement_dismissed (the browser’s session storage, sessionStorage)	Our site	Essential	Remembers that you have closed the announcement bar at the top of the page, so that the bar is not shown again in the same session.	Session (deleted when the tab or browser closes)	First party
zcx_saved (the browser’s persistent storage, localStorage)	Our site	Essential	Keeps, only in this browser, the list of products you saved with the heart icon (product number, name, address, image, the colour you selected and the time of saving). The list is not sent to the store; it contains no price, stock or personal information.	No set period; stays until you remove the products from the list or delete browser data	First party
zcx_probe (the browser’s persistent storage, localStorage)	Our site	Essential	Tests, before the saved list, whether the browser’s persistent storage is usable; deleted immediately after being written.	Deleted immediately	First party
sbjs_current, sbjs_first, sbjs_current_add, sbjs_first_add, sbjs_udata, sbjs_session, sbjs_migrations	Our site (WooCommerce order attribution)	Analytics (only with your permission)	Records the source from which you came to the site (referring site and campaign link information), the first page you entered the site on, and the page or link that led to the order. If you place an order, this information is added to your order and deleted 13 months after the order.	Session (deleted when the browser closes); sbjs_session 30 minutes	First party
zanardi_cx_q	Our site	Analytics or marketing (only with your permission)	Passes an event verified by the server (for example add to cart, form submission) on the next page to the measurement tools you have permitted. Written only if you gave permission, contains no identifier, and is deleted after being read.	At most 5 minutes	First party
zanardi_cx_sent (the browser’s persistent storage, localStorage)	Our site	Analytics (only with your permission)	Keeps the order numbers of the purchase events sent from this browser to Google Analytics 4 and the time of sending, so that the same purchase is not sent a second time when the order confirmation page is reopened. Not sent to the store.	At most the last 20 orders; records older than 30 days are disregarded and removed from the list at the next write. The list is deleted when you withdraw your analytics permission.	First party
zanardi_cx_engaged (the browser’s session storage)	Our site	Marketing (only with your permission)	Remembers that the Engaged Visit event was sent once in this session; holds only the value “1” and is not sent to the shop; deleted when you withdraw marketing permission.	Session (deleted when the tab or browser is closed)	First party
_ga	Google (Google Analytics 4)	Analytics (only with your permission)	Distinguishes visitors from one another to produce visit statistics.	At most 13 months	First party; data is transmitted to Google (third-party service)
_ga_<kimlik>	Google (Google Analytics 4)	Analytics (only with your permission)	Stores session information for visit statistics.	At most 13 months	First party; data is transmitted to Google (third-party service)
_fbp	Meta (Meta Pixel)	Marketing (only with your permission)	Recognises your browser; used to measure the results of our Instagram and Facebook advertisements and to show our advertisements on these platforms to people who have visited our site (Meta ad audiences).	90 days	First party; data is transmitted to Meta (third-party service)
_fbc	Meta (Meta Pixel)	Marketing (only with your permission)	If you came to the site by clicking a Facebook or Instagram advertisement, stores the information of that click; used to measure advertisement results and for ad audiences.	90 days	First party; data is transmitted to Meta (third-party service)
fr	Meta (Meta Pixel)	Marketing (only with your permission)	According to Meta’s description, used to show, measure and improve the relevance of Meta advertisements.	90 days	Third party (facebook.com)
datr	Meta (Meta Pixel)	Marketing (only with your permission)	Recognises your browser for security and fraud prevention.	400 days	Third party (facebook.com)

When the Meta Pixel runs, your browser may also send to Meta cookies previously saved on Meta’s own domain (for example the fr and datr in the table), for instance if you have logged in to Instagram or Facebook. These cookies are subject to Meta’s own policy. You can manage them through your browser settings or your Meta account.

The third-party cookies in the table (Meta’s cookies on the facebook.com domain) are saved to Meta’s domain when Meta’s code runs, or those previously saved in your browser are sent to Meta. These cookies are subject to Meta’s own policy and our site cannot delete them. You can delete or block them in your browser settings.

Google Search Console, which we use to monitor our site’s performance in Google search (search queries, clicks and impressions), does not save cookies to your browser and does not take data from your browser; it is therefore not in the table.

6. Fonts (connections that do not use cookies)

Our pages load fonts from our own server. No connection is made to third-party servers for fonts, and your IP address is not transmitted to anyone for this purpose. Fonts do not save cookies.

7. How we obtain and record your consent

When you first enter our site the cookie banner opens, and it is shown on every page until you make a choice. The banner has three buttons: “Necessary only” (rejects the optional cookies), “Accept all” and “Choose”. The reject and accept buttons look the same and are the same size. Rejecting is as easy as accepting.

With the “Choose” button you can turn the analytics and marketing groups on separately, and you can save your choice with the “Save choices” button. These boxes are unticked at the start. The banner is shown in Turkish, English, Russian and Spanish. You can change the language with the buttons above the banner.

Your choice is saved in the zanardi_consent cookie in your browser. This record contains the version of the cookie text and the short code of the tools active on the site at the time of the choice, your analytics and marketing choice, the date of the choice and a consent ID (made up of the creation time and random characters). When you place an order, your cookie preference at that moment is also saved to your order.

No separate cookie consent record is kept on our server. The cookie consent stamp (_zanardi_cx_consent) saved to your order when you place an order contains the version of the cookie text, your analytics and marketing choice, an always-off personalisation flag, the date of the choice and the consent ID in the cookie; whether the purchase notification is made to Meta depends on the marketing choice in this stamp; this stamp is kept with the order record for as long as the order record is kept (Section 11).

Your consent is valid for 1 year. When the period expires we ask for your choice again. We also ask for your choice again when we make a substantial change to the cookie text or the cookie banner, or when the measurement and marketing tools we use on the site change (for example when a tool is activated or removed).

8. Withdrawing your consent and managing cookies

• Click the “Cookie settings” link at the bottom of every page. The settings panel opens with your current choice. You can untick the boxes and press the “Save choices” button, or use the “Necessary only” button.
• When you withdraw your permission, analytics and marketing cookies are deleted from our site’s domain and the page is refreshed. These tools are not loaded until you give permission again. If their code is running on that page, the permission you withdrew is also notified to the company concerned (Google, Meta) before the page is refreshed.
• We cannot delete, when you withdraw your permission, the third-party cookies that Google and Meta save to their own domains (see Section 5); you can delete them in your browser settings.
• You can withdraw your permission at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing based on your permission before the withdrawal.
• From your browser’s settings you can see, delete or block cookies and the records in browser storage. These settings are usually in the “Privacy” or “Cookies” section of the browser’s “Settings” menu. If you block essential cookies, functions such as the cart and login may not work.
• If you delete the zanardi_consent cookie, your choice is asked again at your next visit.
• Your preference is stored in the cookie in the browser you use. The choice is therefore made separately on each device and in each browser, such as computer, telephone and tablet.

9. Which data we process, for what purpose and on what legal basis

Data processed	Source	Purpose	Legal basis
Your cookie preference (in the browser): text version and short code of the active tools, analytics and marketing choice, date of the choice, consent ID	zanardi_consent cookie; the consent stamp in the order record (_zanardi_cx_consent) if you place an order	To respect your preference; not to ask for your choice again on every page	KVKK Art. 5/2-f (legitimate interest)
The cookie consent stamp saved to your order: text version, analytics and marketing choice, a personalisation flag that is always stored as off, date of the choice, consent ID	Your cookie preference at the moment you place the order	To determine, and prove where needed, which permission the recording of the order source and the purchase notification to Meta are based on	KVKK Art. 5/2-f (legitimate interest)
Your currency preference	zanardi_currency cookie; zanardi_currency record in this tab (sessionStorage)	To show prices in the currency you selected (USD, EUR or TRY); the order is placed in this currency and the amount in this currency is charged to your card (Turkish lira is charged in USD or EUR orders with a delivery address in Türkiye)	KVKK Art. 5/2-f (legitimate interest: showing the currency you selected in your later visits too)
Your language preference	zanardi_lang cookie	To remember the language you selected	KVKK Art. 5/2-f (legitimate interest: remembering the language you selected)
Cart session and the products in your cart	WooCommerce cookies (woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*)	The working of the cart and the payment step	KVKK Art. 5/2-c (directly related to the formation or performance of a contract)
Incomplete cart: the products and the total; the name, e-mail and telephone you write at the payment step (the address is not transferred); if you are logged in, the name, e-mail and telephone in your account (transferred to UNALSOFT Panel even if the order is not completed; kept for 90 days at the longest)	Your cart and the payment step form	To detect and resolve technical problems at the payment step; to help if you tell us that you could not complete your order. A reminder is sent only with your separate consent and after İYS registration	KVKK Art. 5/2-f (legitimate interest); for the reminder, explicit consent (KVKK Art. 5/1) and commercial electronic message consent
Your login session (only those logged in to their account)	wordpress_logged_in_* cookie	To remember that you have logged in to your account	KVKK Art. 5/2-c (performance of the account contract)
Security of your login session (only those logged in to their account); testing of the browser’s cookie acceptance	wordpress_sec_* and wordpress_test_cookie cookies	Security of the account and the site against unauthorised access; the correct working of the login process	KVKK Art. 5/2-f (legitimate interest)
The information that you have closed the announcement bar (in the browser’s session storage; not sent to our server)	zanardi_announcement_dismissed record	Not to show again in the same session the announcement bar you closed	KVKK Art. 5/2-f (legitimate interest)
The list of products you saved (only in your own browser; not sent to the store)	zcx_saved and zcx_probe records	To keep in your browser the products you saved with the heart icon (a function you requested)	Because the list stays only in your browser and does not reach us, there is no personal data processing by us
The source from which you came to the site (referring site and campaign link information), the first page you entered the site on, the page or link that led to the order	sbjs_* cookies; the order record if you place an order	To measure which pages and links lead to orders	Explicit consent (KVKK Art. 5/1)
The address of the pages you visit, your movements within the site and shopping events (product codes, product names, quantities, amounts; the order number in the purchase event), the source from which you came to the site, device and browser information, IP address (transmitted to Google), cookie ID	Google Analytics 4 (_ga, _ga_<kimlik>)	To produce visit statistics and improve the site	Explicit consent (KVKK Art. 5/1)
The order numbers of purchases sent to Google Analytics 4 and the time of sending (only in your browser; not sent to the store)	zanardi_cx_sent record	To prevent the same purchase from being sent to Google Analytics 4 twice	Explicit consent (KVKK Art. 5/1)
The value “1” that records that the Engaged Visit event was sent in this session (only in your browser; not sent to the shop)	zanardi_cx_engaged record	To prevent the same Engaged Visit event from being sent twice in one session	Explicit consent (KVKK Art. 5/1)
Event information carried to the next page if you gave consent (for example add to cart, form submission; contains no identifier)	zanardi_cx_q cookie	To pass the event verified by the server to the measurement tools you have permitted	Explicit consent (KVKK Art. 5/1)
Through the Meta Pixel: the full address of the page you view (including campaign parameters and fbclid) and the address of the referring page, shopping, form and click events (product codes, quantities, prices, amount, currency; for clicks also the type of page on which the click was made; the Meta Pixel is not loaded on the order confirmation and order payment pages), advertisement click information (_fbc), browser ID (_fbp), IP address and browser information; from the server, only with marketing permission: in a completed order, the product codes, quantities, item prices, amount, currency and order number (inside the event ID; for wholesale users without price, amount and currency); on a product view, the product code, the quantity and the retail price (without price, amount and currency for wholesale users); in a wholesale application, a contact form and a click on a WhatsApp, e-mail or telephone link, only the source of the event or the name of the channel; in an Engaged Visit, the page type; with every server event, the event name, event time, event ID, page address (without the query string and the # fragment; my-account subpages are reduced to the base path; events on the order confirmation and order payment pages are not reported; for orders the general checkout page address, for forms the address of the page with the form), IP address, browser information and the _fbp/_fbc values (from the server, name, e-mail, telephone, postal address and hashed personal data are not sent; because automatic advanced matching of the Meta Pixel is on, the e-mail address, telephone number, first name, last name, city, state/province, postal code and country you type into forms on pages where the Meta Pixel is loaded (including checkout) may be hashed in your browser and sent through the Meta Pixel)	Meta Pixel (_fbp, _fbc) and the Meta Conversions API	To measure the results of our Instagram and Facebook advertisements; to show our advertisements to people who have visited our site, with Meta ad audiences (retargeting)	Explicit consent (KVKK Art. 5/1)

In processing based on legitimate interest, our interest is this: to secure your account and the site against unauthorised access, to be able to show when necessary that we respected your cookie preference, and to make it easier for you to use the site by remembering simple preferences such as the currency you selected.

Method of collection: This data is collected by automatic means, through cookies, browser storage, pixels and connections your browser makes, when you visit the site.

No separate permission is requested for essential cookies; the legal basis of each under KVKK Art. 5/2 is written separately in the table above. Calling a cookie “essential” does not, by itself, show that no permission is required.

Analytics and marketing cookies rely only on your explicit consent. Your explicit consent is given on a specific subject, based on information, and of your free will. The permission boxes are not pre-ticked, and not giving permission does not prevent you from using the site.

For visitors in the European Economic Area: Optional cookies rely on your consent under Article 5(3) of the EU ePrivacy Directive and the national law of your country that implements it, and under Article 6(1)(a) GDPR. Essential cookies are outside this permission rule; the processing carried out with them relies on Article 6(1)(b) (contract) and Article 6(1)(f) (legitimate interest) GDPR. Storing your cookie preference in your browser and saving your preference at the time of the order to the order rely, as regards the obligation to demonstrate consent (Article 7(1) GDPR), on Article 6(1)(f) GDPR (legitimate interest).

10. Parties to whom data is transferred and transfers abroad

• Our hosting service provider Hostinger International Ltd.: The Site and the data processed with essential cookies are on our server in Hostinger’s Frankfurt am Main (Germany) data centre. Backups are also kept on the same server.
• Our order management system UNALSOFT Panel: Cart and order information is transferred to this system. The Panel runs on the same server (Frankfurt, Germany); the service is operated by UNALSOFT, which processes data on our behalf and on our instructions (data processor).
• Google: Measurement data through Google Analytics 4 with your analytics permission.
• Meta: Data used for advertisement measurement and ad audiences (retargeting) through the Meta Pixel and the Meta Conversions API with your marketing permission. Meta may also process this data for its own purposes as an independent data controller (see Section 4).

For visitors in the European Economic Area: With respect to the collection of data with the Meta Pixel and the Meta Conversions API and its transmission to Meta, we are joint controllers with Meta. The essentials of this joint responsibility are in the controller addendum attached to Meta’s business tools terms; for processing after this stage Meta is itself responsible. The recipient of Meta Pixel and Conversions API data is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); Meta may share this data with Meta Platforms, Inc. in the USA.

Because the Hostinger server and UNALSOFT Panel are in Germany, the data on these servers is transferred from Türkiye abroad. Google and Meta also process data outside Türkiye, in many countries including the USA. Because these transfers take place regularly and continuously each time you use the site, we do not present them as incidental transfers.

• Google Analytics 4: Google may process data in any country, including the USA, where it or its sub-processors have facilities.
• Meta Pixel and the Meta Conversions API: Meta processes data in countries outside Türkiye, including the USA.

Transfer mechanism for Hostinger and UNALSOFT Panel: For the regular transfers to this server in Germany, the use of a standard contract is envisaged among the appropriate safeguards listed in Article 9/4 KVKK. At the date this text is published, a standard contract has not been signed with Hostinger and UNALSOFT and has not been notified to the Kişisel Verileri Koruma Kurulu (Personal Data Protection Board). Transfers to Google and Meta: Your data is transferred to these companies only with your permission (Google Analytics 4, Meta Pixel and the Meta Conversions API) or if you write to us on WhatsApp. At the date this text is published, there is no standard contract notified to the Personal Data Protection Board for these transfers. Your data may not be protected in countries outside Türkiye, such as the USA, at the same level as the safeguards in Türkiye, the public authorities of these countries may access the data, and exercising your rights there may become difficult.

11. Retention periods

• Cookies and records in browser storage are deleted from your browser at the end of the period stated in the table in Section 5. When you withdraw your permission, analytics and marketing cookies on our site’s domain are deleted immediately.
• Your cookie preference at the time of the order is saved to your order and kept with the order record for as long as the order record is kept. If you have analytics permission, the order source information added to the order is deleted from the order 13 months after the order; if you withdraw your analytics cookie permission, it is deleted earlier on your request (see Privacy Policy 4.1).
• Incomplete cart and payment step data transferred to UNALSOFT Panel is deleted after 90 days at the latest. If this data turns into an order, it is subject to the retention period of the order record.
• Our server’s access logs (IP address, requested page and browser information) are kept for 14 days and then deleted; the system log is kept for 7 days. The Site’s database is backed up every day, the Site’s files (the wp-content folder and configuration files) once a week (on Sundays), and the UNALSOFT Panel database and uploaded files every day. These backups are automatically deleted after 14 days; backups taken manually before updates are deleted after 30 days. Backups are kept only on our server.
• IP addresses that make failed login attempts are blocked for 1 hour; the block records are deleted after 1 day.
• Measurement data transmitted to Google Analytics is deleted at the end of the period set in the data retention setting of our Google Analytics account.
• For data transmitted to Meta through the Meta Pixel and the Meta Conversions API, Meta’s own retention rules also apply.

12. Your rights and how to apply

Under Article 11 KVKK, you can exercise the following rights by applying to us as the data controller:

• to learn whether your personal data is processed,
• to request information about it if it has been processed,
• to learn the purpose of processing and whether the data is used in accordance with its purpose,
• to know the third parties to whom it is transferred in Türkiye or abroad,
• to request correction if it is processed incompletely or inaccurately,
• to request erasure or destruction within the framework of the conditions in Article 7 KVKK,
• to request that correction, erasure or destruction operations be notified to the third parties to whom the data has been transferred,
• to object to a result against you arising from the analysis of the processed data exclusively by automated systems,
• to claim compensation for the damage if you suffer damage due to unlawful processing.

You can withdraw your permission for cookies at any time (see Section 8). Visitors in the European Economic Area also have, under the GDPR, the rights of access, rectification, erasure, restriction of processing, data portability and objection, and can complain to the data protection authority of their country of residence.

Right to object: Visitors in the European Economic Area can object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (Article 21 GDPR).

In accordance with the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ (Communiqué on the Procedures and Principles of Application to the Data Controller), you can send your application in writing to Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul, with a secure electronic signature or mobile signature, or to info@elisabettazanardi.com from your e-mail address that you have previously notified to us and that is registered in our system. The Company has no registered electronic mail (KEP) address.

Your application must include your name and surname, your signature in a written application, your T.C. identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or identity number, if any, if you are a foreigner, your address for notification, your e-mail address and telephone number, if any, and the subject of your request.

We conclude your application, according to its nature, as soon as possible and within 30 days at the latest, free of charge. If the process requires a separate cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, if you find our reply insufficient, or if no reply is given in time, you may complain to the Personal Data Protection Board within 30 days from the date you learn of the reply and in any case within 60 days from the date of application.

13. When you move to other sites

When paying by card, you are redirected through our order management system UNALSOFT Panel to Denizbank’s 3-D Secure payment page. Your card details are entered only on the bank’s page and do not reach our servers. The bank’s page is outside the scope of this policy; for the cookies on that page, the bank’s own notice applies.

The WhatsApp link on the site redirects you to WhatsApp (Meta). We process, as data controller, the messages you write to us on WhatsApp in order to answer your question (see Privacy Policy). Because messages are transmitted and stored on WhatsApp’s infrastructure, WhatsApp’s (Meta’s) own privacy policy also applies and data may be processed abroad.

14. Changes

We update this policy as the use of cookies on our site changes. The current text is always on this page. The date of last update and the text version are written at the top of the page. When we make a substantial change to this text or to the cookie banner, we change the text version and ask for your choice again. Your choice is also asked again when the measurement and marketing tools we use on the site change. The English and Russian translations of the policy are updated at the same time as the Turkish text.

15. Contact

For questions about cookies and your personal data, you can write to info@elisabettazanardi.com or reach us at the telephone number +90 530 446 67 77. Our postal address: ENVERO TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul. We reply to your complaints within 3 business days at the latest. In this text, “business day” means days other than Saturdays, Sundays and official holidays in Türkiye; this definition applies only to periods we ourselves undertake and does not change the calculation of periods set by law.