Cookie Policy

This document explains which cookies are placed in your browser when you visit myaromex.com, what those cookies do, what the consent banner does and does not cover, and how you can delete cookies.

The findings set out here are based on an inspection of the live website and of the tag manager container running on it, carried out on 4 September 2026. No tool or cookie that was not verified during that inspection is listed in this document.

Aromex is the brand of a sole proprietorship operated by Esin Deniz. For the purposes of cookies, the data controller is Esin Deniz.

1. Data controller

• Data controller: Esin Deniz, sole proprietorship
• Brand and website: Aromex, myaromex.com
• Line of business: 479114, retail trade over the internet
• Tax office: Başakşehir Vergi Dairesi Müdürlüğü
• Tax identification number: 2911234592
• Business address: Bahçeşehir 1. Kısım Mah. Cenk Koray Cad. Akasya 02.04 Sitesi C2 Blok No: 11 İç Kapı No: 12 Başakşehir / İstanbul
• E-mail: info@myaromex.com
• WhatsApp link: wa.me/905304265799

2. What a cookie is

• A cookie is a small text file that the website you visit stores in your browser.
• It usually contains an identifier value. Information such as your name or telephone number is not written directly inside the cookie.
• That identifier value makes it possible to link the page movements and later visits of the same browser to one another. This is how traffic measurement and advertising measurement work.
• The cookie stays on your device. When you delete it from your browser, it is removed from your device.
• Cookie identifiers qualify as personal data.

3. Measurement tools running on the site

• Google Tag Manager — ID: GTM-NXV9G7SF · What it does: The tag manager that loads the other measurement tools onto the site.
• Google Analytics 4 — ID: G-N2X3P7TV7B · What it does: Collects page view and on-site interaction data.
• Meta Pixel — ID: 1375195121462015 · What it does: Sends the page view event, technically named PageView, and the contact link click event, technically named Contact, to Meta.
• Server-side bridge — ID: aromex-capi.vercel.app · What it does: Carries the event generated by the site to a server endpoint operating on behalf of myaromex.com, and from there forwards it to the Meta Conversions API. Runs on Vercel infrastructure.

The site is hosted on Natro JetSite. The infrastructure for that service is provided by Webnode.

4. Cookies created on the site

• _fbp — Source: Meta Pixel · Purpose class: Advertising · What it does: Carries an identifier value belonging to the browser. Allows page view and contact click events to be linked to the same browser. · Duration: Set by the tool that creates the cookie. Removed the moment you delete it from your browser.
• Google Analytics cookies — Source: Google Analytics 4 · Purpose class: Analytics · What it does: Counts visits and page views. Allows the page movements of the same browser to be measured as a single visit. · Duration: Set by the tool that creates the cookie. Removed the moment you delete it from your browser.

• These are the cookies observed to be created in the browser during a visit in the measurement carried out.
• The server-side bridge also carries the _fbc cookie where it is present in the browser. _fbc is not created on every visit.
• These cookies are created under the site's own domain. For that reason, a browser setting that blocks only third party cookies may not stop them.
• None of the cookies above is strictly necessary for the site to function. For advertising and analytics cookies, the Law requires processing based on explicit consent.

5. Consent state

This section explains how your choice on the cookie banner is reflected in the measurement tools.

• Google side. The Google tools are configured to work with the consent signalling arrangement known as Consent Mode. The default starting value on the site is denied. The permissions that start out as denied are: ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage.
• Cookie banner. The cookie banner on the site offers four categories: Essential cookies, Functional cookies, Performance cookies, and Marketing / third party cookies. Essential cookies are mandatory and cannot be switched off. The other three categories are off by default; the visitor switches them on and off individually and saves that choice.
• What your choice does. When consent is given to the Performance cookies category, the analytics_storage permission moves to the granted state. When consent is given to the Marketing / third party cookies category, the ad_storage, ad_user_data, ad_personalization and personalization_storage permissions also move to the granted state.
• Meta Pixel. The Meta Pixel tag depends on the ad_storage and ad_user_data permissions. As long as these permissions are not granted, the tag does not load, no request is sent to Meta, and the _fbp cookie is not created.
• Legal consequence. For advertising and analytics cookies, the Law requires explicit consent. Because these cookies run only when you give consent to the relevant category, the processing in question rests on your explicit consent.
• Measurement record. In the measurement carried out on 4 September 2026, it was observed that when consent was given only to the Performance cookies category, the Google Analytics cookies were created, no request whatsoever was sent to Meta, and the _fbp cookie was not created.
• What this means in practice. If you do not want the Meta side to run in your browser, it is enough to leave the Marketing / third party cookies category switched off on the cookie banner. You can also use the browser settings described below, or submit a request through the application channels set out in section 10.

6. Fields carried by the server-side bridge

The bridge transmits only the following fields.

• Event name
• Event ID
• Page address
• The _fbp cookie in your browser
• The _fbc cookie, where present
• The IP address and browser identification string added by the server, technically known as the user agent

No data outside this list is passed to the bridge. The IP address and the browser identification string are processed server-side together with the request itself, independently of any cookie.

7. How to delete or block cookies

The most decisive control over cookies is in your browser.

• In the settings section of your browser, under privacy or cookies, you can delete existing cookies, block them for particular sites, or configure the browser to reject them all. Because menu names differ between browsers and versions, the exact steps are in your browser's own help pages. The same settings appear in the settings section of the browser app on mobile devices.
• Because the cookies created on this site are written under the site's own domain, a setting that blocks only third party cookies may not be enough. You will need to use a site-specific cookie block or switch off all cookies.
• If you browse in an incognito or private window, the cookies created in that window are deleted when you close it.
• Deleting removes cookies created in the past. If you visit the site again with the same settings, the cookies may be created again. For a lasting result, you need to keep the blocking setting switched on.
• If you have a Google or Meta account, you can also manage your preferences regarding the personalisation of the ads shown to you from those platforms' own account and advertising settings.

8. What happens if you block cookies

• You can continue to browse the site's pages and to use the contact links.
• No cookie-based measurement records are created.
• To be explicit: blocking cookies does not silence the server-side bridge entirely. While carrying the event generated by the site, the bridge adds the IP address of the request and the browser identification string. When the _fbp cookie is not created, the data carried is incomplete and the matching in advertising measurement weakens.

9. Other information about cookies

• Purpose of processing. Data collected through cookies is processed in order to measure site usage, to measure the results of advertising activity, to prevent the same event from being counted twice, and to track the use of the contact links.
• Collection method. Data is collected electronically and by fully automated means, through the tag manager, the measurement tags and cookies.
• Transfer. Measurement data arising from cookies is processed in Google's and Meta's systems. The server-side bridge runs on Vercel infrastructure. The site is hosted on Natro JetSite, whose infrastructure is provided by Webnode.
• Processing abroad. These providers are international service providers and it is possible that data is processed abroad. As our business has no verified information about the countries in which the servers are located, no country or region is named here. The conditions set out in Article 9 of the Law apply to transfers abroad.
• Retention period. Data arising from cookies is retained for as long as the purpose of processing requires and for the statutory limitation periods laid down in the relevant legislation. When the purpose ceases to exist, it is deleted, destroyed or anonymised. When you delete a cookie from your browser yourself, that cookie is removed from your device.
• There is no form on the site. None of the eight pages contains a form. Getting in touch is only possible through the WhatsApp link, the telephone link and the e-mail link. If you write over WhatsApp, your telephone number and the content of your message reach the business. This happens through your own choice of contact channel, not through a cookie. The content of your message is not sent to the measurement tools.

10. Your rights and how to apply

Under Article 11 of Law No. 6698, you have the following rights.

• To learn whether your personal data is being processed
• To request information about it if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom your data is transferred
• To request correction if the data has been processed incompletely or inaccurately
• To request deletion or destruction within the conditions laid down in the Law
• To request that correction, deletion and destruction operations be notified to the third parties to whom your data has been transferred
• To object to an outcome to your detriment arising from the analysis of processed data exclusively by automated systems
• To claim compensation for damage suffered as a result of unlawful processing

Where processing is based on explicit consent, you may withdraw your consent at any time. Withdrawal takes effect prospectively. You can manage your cookie preferences category by category from the advanced settings screen of the cookie banner, and withdraw the consent you have given from there. You can also delete or block cookies from your browser settings. In addition, you may submit a request through the channels set out below.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests as follows.

• A written application bearing a wet signature, delivered in person, through a notary or by post to the business address stated above.
• A message signed with a secure electronic signature or mobile signature, sent to info@myaromex.com.
• A message sent from the e-mail address you have previously notified to our business and which is registered in our system, sent to info@myaromex.com.

Your application must include your name and surname and, if the application is in writing, your signature; for citizens of the Republic of Türkiye the national identity number, and for foreign nationals nationality and passport number or identity number, if any; your residential or business address for the purposes of notification; your e-mail address, telephone and fax number for notification, if any; and the subject of your request. Where we cannot verify your identity, we may ask for additional information.

Your application is concluded as soon as possible and in any case within thirty days of it reaching us. Applications are free of charge as a rule. Where the process incurs an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, if you find the response insufficient, or if no response is given within the time limit, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application.

11. Related documents

• Aromex Privacy Notice (KVKK). The information required under Article 10 of the Law is provided through that document.
• Aromex Privacy Policy. Describes the full data flow on the site.

12. Updates to this document

• This document is updated whenever the measurement setup or the cookies on the site change.
• Section 5 is rewritten whenever the categories on the cookie banner, or the way those categories are reflected in the measurement tools, change.
• The current document is always published at myaromex.com.

Last updated: 4 September 2026