Cookie Policy
Last updated: 1 October 2026 · Text version 3
1. Summary
Measurement and advertising cookies are on by default until you make a choice. When you press “Reject”, all of them are switched off and deleted; your decision is remembered for 12 months and the site keeps working fully. This rule is the same whichever country you connect from.
2. Necessary cookies (no consent required)
Required for the site to function and for actions you explicitly request (cart, login, language, your cookie preference itself). They do not depend on your consent and cannot be switched off.
| Name | Purpose | Duration |
|---|---|---|
| lsf_riza | Remembers your cookie choice (acceptance or rejection); this is how a rejection stays in force for 12 months. | 12 months |
| lsf_locale | Your language preference. | 1 year |
| ec_session | Customer account session (if you are logged in). | 30 days |
| lsf_sayma | Your “Do not measure this browser” preference. | 2 years |
| ec_admin, ec_admin_2fa | Admin panel session and two-step verification (site staff only). | 7 days / 5 minutes |
| lsf_cart_v1, lsf_locale, lsf_popup_seen_* | Browser storage: your cart, your language preference, and not showing again a campaign pop-up you have closed. | Until you delete it |
3. Measurement and advertising cookies (on by default, you can reject them)
Analytics
Measures how the site is used. On by default; if you press “Reject” or switch off “Analytics”, these cookies are deleted and not set again.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Visit statistics (Google Analytics 4, via Google Tag Manager). | 2 years | |
| lsf_sid | Last Summer Florist (our own server) | Unique-visitor count. A random identifier; it contains no information such as your name, e-mail or IP address. Set unless you reject; deleted when you press “Reject”. | 13 months |
Marketing
Measures the results of our ads and enables remarketing to you. On by default; if you press “Reject” or switch off “Marketing”, these cookies are deleted and the Meta and TikTok pixels are no longer loaded on the page.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_aw, _gcl_au | Google Ads | Matching an ad click to an order (Google Ads conversion measurement) and remarketing. | 90 days |
| _fbp, _fbc | Meta | Meta (Facebook/Instagram) ad measurement and remarketing. | 90 days |
Enhanced conversions and advanced matching: the e-mail, phone number and name of the person placing the order are irreversibly hashed (SHA-256) and sent to Google and Meta; the delivery recipient’s name, phone number and address are not sent. This data is not sent if you pressed “Reject” or switched off “Marketing”.
There is no separate “functional” cookie category on the site: language and basket are strictly necessary cookies.
4. Google tags and Consent Mode
We use Google Consent Mode v2. Until you make a choice, measurement and advertising permission for Google tags is on by default. When you press “Reject” or switch off the relevant category, Google is told that permission is off; Google tags then no longer set or read cookies and only send an anonymous signal (page, time, browser type, permission status).
5. On-site traffic measurement
From the request your browser already sends to open the page, our server records the following in our own database: the page opened, time, device class (mobile/tablet/desktop), language, the domain of the site you came from and, if the link carries an advertising or campaign marker, its type and campaign label (e.g. “Google ad”, “email campaign — newsletter”).
Your IP address and browser identifier are not stored, and this record is not combined with other data. The ad click identifier itself (e.g. gclid) is not written to this record. The record is used only for aggregate statistics and is not shared with third parties. It is kept for 25 months.
If you have not rejected, a random visitor identifier (lsf_sid, 13 months) is set on your device to count unique visitors. If you have rejected, nothing is written to your device and your visit is counted only anonymously.
Search engine and AI crawlers, link previews, prefetches and browsing by site staff are not counted.
If you want to be left out of this measurement entirely, use the “Do not measure this browser” page: the lsf_sayma cookie is set, the visitor identifier is deleted and no records are kept from that browser. Do not measure this browser →
6. Transfers abroad
Data is transferred to Google (USA), Meta (USA), TikTok and Hotjar unless you press “Reject” or switch off the relevant category. Transfers take place under the transfer safeguards of KVKK Art. 9 and the GDPR (standard contractual clauses, EU–US Data Privacy Framework). On-site traffic data stays on our server in the European Union, provided by our hosting provider, accessible only to us.
7. Rejecting and changing your choice
You can change your decision at any time: the “Cookie preferences” link at the bottom of every page opens the preferences panel. “Reject”, or switching a category off, deletes those cookies immediately and prevents them from being set again for 12 months. You can also delete or block cookies in your browser settings.
8. Your rights and contact
Under KVKK Art. 11 and GDPR Arts. 15–22, you have the right to access your data, to request its rectification or erasure, to object to processing and to lodge a complaint (in Türkiye, the Personal Data Protection Authority; in the EU, the competent data protection supervisory authority). Applications: info@etilercicekcisi.com