Cookie Policy
Last updated: 20 October 2026
1. Data Controller and Scope
This policy explains the cookies used on the www.steelin.com website and its /en, /fr and /ar language versions, operated by Prefabrik Yapı İnşaat Sanayi ve Ticaret A.Ş., a Hekim Holding company. Steelin is our company's light gauge steel structure brand. Prefabrik Yapı İnşaat Sanayi ve Ticaret A.Ş. is the data controller for personal data processing carried out through cookies.
This policy should be read together with the Personal Data Protection Notice (KVKK) and the Privacy Policy.
2. What Are Cookies?
Cookies are small text files saved on your device through your browser by the website you visit. They may be used for purposes such as managing sessions, securing forms, remembering your preferences, analysing visits and measuring advertising conversions. Session cookies are stored for the duration of the session, while persistent cookies are stored for a specified period or until you delete them.
3. Cookies Used
The periods below indicate how long cookies are stored on your device; they do not represent the retention periods for data processed on providers' servers. Google Analytics 4 is used through Google Tag Manager.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| steelin_session | Prefabrik Yapı İnşaat Sanayi ve Ticaret A.Ş. | To manage the website session. It has the HttpOnly attribute. | 2 hours | Strictly necessary |
| XSRF-TOKEN | Prefabrik Yapı İnşaat Sanayi ve Ticaret A.Ş. | To secure forms and protect against cross-site request forgery. | 2 hours | Strictly necessary |
| cookie_consent (local storage) | Prefabrik Yapı İnşaat Sanayi ve Ticaret A.Ş. | To remember your choice to accept or reject cookies. | 12 months | Strictly necessary |
| _ga | Google — Google Analytics 4 | To distinguish visitors and generate website usage statistics. | 2 years | Analytics — subject to explicit consent |
| _ga_<measurement ID> | Google — Google Analytics 4 | To measure sessions and analyse website usage. | 2 years | Analytics — subject to explicit consent |
| _ym_uid | Yandex — Metrica | To distinguish visitors and analyse website usage. | 1 year | Analytics — subject to explicit consent |
| _ym_d | Yandex — Metrica | To use information about the time of visits in analytics measurements. | 1 year | Analytics — subject to explicit consent |
| _ym_isad | Yandex — Metrica | To support analytics measurements of website usage. | 2 days | Analytics — subject to explicit consent |
| _ym_visorc | Yandex — Metrica | To support analytics measurements of visitor sessions. | Session | Analytics — subject to explicit consent |
| _fbp | Meta — Pixel | To measure the effectiveness of advertising and marketing activities. | 3 months | Marketing — subject to explicit consent |
| _gcl_au | Google — Ads | To measure advertising conversions. | 3 months | Marketing — subject to explicit consent |
4. How Personal Data Is Collected and the Legal Bases for Processing
Your personal data is collected automatically through cookies via your browser when you visit the website.
Strictly necessary cookies: The primary legal basis for cookies used to secure sessions and forms and remember your cookie preferences is Article 5/2-f of the Personal Data Protection Law No. 6698, under which processing must be necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. Article 5/2-c of the Law applies to specific transactions directly related to the establishment or performance of a contract where processing the personal data of the parties to that contract is necessary. Explicit consent is not required for these cookies.
Analytics and marketing cookies: The legal basis for processing personal data through these cookies is your explicit consent under Article 5/1 of the Law. These cookies are not activated before your explicit consent is obtained. Visiting the website or continuing to use it does not, in itself, constitute explicit consent.
5. Transfers Abroad
Personal data processed as part of analytics and marketing services is transferred to Google, Yandex and Meta servers abroad, depending on the use of the relevant service. These transfers are for the purposes of analysis, measuring advertising effectiveness and measuring conversions, as specified in the table above.
Transfer details: Data obtained through analytics and marketing cookies may be transferred to the relevant service providers' (Google, Yandex and Meta) servers abroad. These transfers are carried out in accordance with the conditions set out in Article 9 of Law No. 6698.
6. Managing Your Cookie Preferences
The cookie notice offers Accept and Reject options. Selecting Accept allows analytics and marketing cookies, while selecting Reject allows only strictly necessary cookies to be used. Your preference is stored in your browser's local storage (cookie_consent) for 12 months.
To change your preference or withdraw your explicit consent, you can delete this website's site data (local storage and cookies) in your browser; the cookie notice will then appear again, allowing you to make a new choice. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before the date of withdrawal; future data processing through the relevant cookies will cease.
7. Browser Settings
You can view and delete stored cookies, restrict third-party cookies or block cookies in your browser's privacy, security or site settings. The steps vary depending on your browser; further information is available in your browser's help section.
Blocking strictly necessary cookies may affect session and form functionality. Deleting cookies may also delete your saved choice to accept or reject them. Deleting cookies from your browser does not automatically delete data previously transferred to servers.
8. Your Rights and How to Submit a Request
Under Article 11 of the Law, you may exercise the following rights by submitting a request to the data controller:
- To learn whether your personal data has been processed and, if so, to request information about that processing.
- To learn the purpose of processing and whether your data is used in accordance with that purpose.
- To learn which third parties your data has been transferred to, either domestically or abroad.
- To request the rectification of incomplete or inaccurate data.
- To request the erasure or destruction of your data under the conditions set out in Article 7 of the Law.
- To request that third parties to whom your data has been transferred be notified of its rectification, erasure or destruction.
- To object to a result that is detrimental to you arising from the analysis of your data solely through automated systems.
- To seek compensation for damage suffered as a result of the unlawful processing of your data.
You may send your requests to kvkk@prefabrikyapi.com using an email address that you have previously provided to our company and that is registered in our system. You may send written requests to our company's registered office address as recorded in the trade registry. Other methods of submission provided for in the Communiqué on the Procedures and Principles for Applications to the Data Controller also remain available.
Your request must include your first name and surname, your signature if the request is submitted in writing, your Turkish identity number if you are a citizen of the Republic of Türkiye; for foreign nationals, your nationality, passport number or identity number, if any; your residential or business address for service of notices; your email address for notifications, if any; your telephone and fax numbers; and the subject of your request. Relevant information and documents must be attached to the request.
Requests are resolved as soon as possible, depending on their nature, and within 30 days at the latest, generally free of charge. If processing the request incurs an additional cost, a fee may be charged in accordance with the tariff set by the Board. If your request is rejected, you consider the response inadequate or no response is provided within the prescribed period, you may lodge a complaint with the Board under the conditions and within the time limits set out in Article 14 of the Law.
9. Updates
This policy may be updated to reflect changes in cookie practices or legislation. The current version is published on this page, together with the date of the update. Where explicit consent is required for a new purpose, your explicit consent will be obtained separately before the relevant processing begins; an update to the policy does not, in itself, constitute consent.
