Last Updated: October 12, 2026 | Version: 2.4-Enterprise | Publisher: Omurga Bilişim ve Yapay Zeka Teknolojileri A.Ş.
omurgasystems.com) and enterprise SaaS application consoles (app.omurgasystems.com and refleks.omurgasystems.com), the purposes for which they are processed, and how you can manage your preferences, in strict compliance with Turkish KVKK No. 6698, the EU General Data Protection Regulation (GDPR), and the e-Privacy Directive.
Cookies are small text files placed on your device (computer, smartphone, tablet) by websites you visit via your browser. In addition to HTTP cookies, modern web applications utilize HTML5 LocalStorage, SessionStorage, and IndexedDB client-side storage to optimize performance, maintain resilient authenticated state across page reloads, and cache user workspace configurations without incurring repetitive network overhead.
Under Article 5 of the KVKK and Article 6 of the GDPR, personal and technical data collected via cookies and client-side storage are processed under the following legal bases:
We strictly segregate tracking between our public corporate website and authenticated enterprise cloud consoles:
| Cookie Identifier | Category | Provider / Domain | Processing Purpose | Retention Lifespan |
|---|---|---|---|---|
| omurga_cookie_ack | First-Party (omurgasystems.com) | Persists visitor's granular cookie consent selection (All Accepted vs Strictly Necessary) to prevent duplicate modal prompts. | 365 Days | |
| omurga_lang | First-Party (omurgasystems.com) | Remembers the visitor's selected language (TR / EN) across navigation and subsequent visits. | 365 Days | |
| omurga_attr | First-Party (omurgasystems.com) | Stores campaign source (utm_source, utm_medium, referrer) strictly to evaluate lead conversion origin. Active only when analytics cookies are consented. | 90 Days | |
| cf_clearance | Cloudflare Inc. (CDN/WAF) | Validates browser integrity challenges and mitigates Distributed Denial of Service (DDoS) threats. | 1 Year |
| Storage / Cookie Identifier | Type & Category | Scope & Origin | Processing Purpose | Retention Lifespan |
|---|---|---|---|---|
| __Host-gbp_session | (HTTP Cookie) | First-Party (app & refleks.omurgasystems.com) | Stores encrypted JWT auth credentials, CSRF anti-forgery tokens, and RBAC permission state (HttpOnly, Secure, SameSite=Strict). | Session Duration |
| trusted_device | (HTTP Cookie) | First-Party (app.omurgasystems.com) | Identifies authenticated enterprise devices following Multi-Factor Authentication (2FA) to safeguard against Account Takeover (ATO) threats. | 30 Days |
| omurga_tenant_ctx | (LocalStorage) | First-Party (Client Console) | Isolates client-side multi-tenant organization context to prevent cross-tenant data bleed in multi-branch views. | Persistent / Until Logout |
| omurga_active_loc | (LocalStorage) | First-Party (Client Console) | Caches administrator's active location filter ID so users do not have to reselect their operational branch on page reload. | Persistent / Until Logout |
| refleks_table_filters | (SessionStorage) | First-Party (Client Console) | Maintains review dashboard filtering parameters (star rating, reply status, sentiment tags) during an active browser session. | Tab Close |
Omurga Systems is an enterprise B2B software infrastructure provider. We do NOT sell, rent, or trade your browsing history or console usage records to third-party ad networks (such as Google AdSense, Meta Pixel, or Criteo) or commercial data brokers. All diagnostic and analytical tools operate exclusively for platform stability, security, and operational integrity.
Conditional Script Execution & Pixel Gating: Advertising conversion tags (Meta Pixel, Google Ads) on our public marketing site execute solely after explicit user consent is granted via the cookie banner. If rejected, scripts are never downloaded to client browsers, and zero telemetry data is transmitted to third-party ad networks.
Zero Third-Party Trackers in Embedded Widgets: Customer review carousels, badges, and QR scan interfaces provided by Refleks for client websites do NOT drop third-party tracking cookies on client consumers; they operate strictly on a first-party, performance-optimized basis.
Omurga Systems may utilize web beacons (also known as clear GIFs or pixel tags) in transactional system notifications, such as critical 1-star negative review alerts, weekly executive reputation digests, and billing invoices. These transparent 1x1 pixel graphics are processed to:
To disable email tracking pixels, you may configure your email client to "Block external image loading" by default.
Some browsers transmit "Do Not Track" (DNT) or "Global Privacy Control" (GPC) HTTP header signals:
You can customize your cookie preferences, delete existing cookies, or block new cookies at any time via your browser settings. Please note that disabling technical cookies will prevent secure access to the authenticated SaaS console.
6.1. Browser-Specific Cookie Controls:
6.2. Independent Opt-Out Programs:
To manage broad commercial tracking preferences across participating ad networks, visit:
Pursuant to Article 11 of the KVKK and Articles 15-22 of the GDPR, data subjects have the right to learn whether personal data is processed, request information regarding processing, and request rectification or erasure. For any inquiries regarding our cookie practices, please contact us at: