BEYOĞLU PROFESSIONAL COOKIE AND SIMILAR TECHNOLOGIES POLICY

BEYOĞLU PROFESSIONAL COOKIE AND SIMILAR TECHNOLOGIES POLICY

Version: 1.0
Effective Date: 1 October 2026
Last Updated: 1 October 2026

1. Purpose and Scope

This Cookie and Similar Technologies Policy explains how THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ (“Beyoğlu Professional”, “we”, “us” or “our”) uses cookies and comparable browser or device-storage technologies in connection with the Beyoğlu Professional PPWR-EPR Compliance platform.

This Policy applies to the authenticated Client, Authorised Representative (“AR”) and HQ applications and to authentication, integrations, browser notifications and other web functionality forming part of the Platform.

For general information about our Processing of Personal Data, please refer to our Privacy Policy.

2. What We Mean by Cookies and Similar Technologies

A cookie is a small item of information stored through a web browser and associated with a website or application.

The Platform also uses technologies that are not technically HTTP cookies but can store or retrieve information from the user's terminal equipment, including browser local storage and session storage.

References in this Policy to “Storage Technologies” therefore include cookies, localStorage, sessionStorage and comparable browser storage mechanisms.

Where applicable law requires consent for a Storage Technology, we will apply the applicable consent requirements unless the technology falls within an exemption, including where storage or access is strictly necessary to provide a service explicitly requested by the user.

3. Strictly Necessary Authentication Cookies

The Platform uses authentication and security cookies required to establish and protect authenticated sessions.

__Host-bp_session

Purpose: maintains the authenticated Beyoğlu Professional application session after successful authentication.

Production properties:

Duration: 45 minutes
HttpOnly: Yes
Secure: Yes in production
SameSite: Lax
Path: /

This cookie contains or represents an authenticated server session and cannot ordinarily be read by browser-side application JavaScript because it is configured as HttpOnly.

When the session expires, re-authentication is required.

__Host-bp_csrf

Purpose: provides protection against cross-site request forgery during sensitive authentication and state-changing operations.

Production properties:

Duration: 10 minutes
HttpOnly: Yes
Secure: Yes in production
SameSite: Strict
Path: /

The CSRF token is intentionally short lived and is deleted after the relevant authentication or workspace-changing operation where applicable.

__Host-bp_workspace

Purpose: identifies the organisation or workspace in which the authenticated user is currently operating.

Production properties:

Duration: up to 45 minutes
HttpOnly: Yes
Secure: Yes in production
SameSite: Lax
Path: /

The Platform independently verifies that the authenticated user is entitled to access the selected workspace. Possession or manipulation of the cookie does not itself confer access to another organisation.

4. Local Development Cookies

Development and local full-stack environments may use application-specific names such as:

bp_client_session;
bp_client_csrf;
bp_client_workspace;
bp_ar_session;
bp_ar_csrf;
bp_ar_workspace;
bp_hq_session;
bp_hq_csrf; and
bp_hq_workspace.

These names are development-environment implementation details and are not the production cookie contract.

Secure-cookie behaviour can be relaxed only in the dedicated local development environment.

5. OAuth and Integration Security Cookies

Certain third-party integrations require temporary security state to be preserved while the browser is redirected to and from the external provider.

For example, the Amazon integration uses temporary pending-connection and OAuth-state cookies.

These cookies are:

used only for the integration authorisation flow;

HttpOnly;

Secure in production;

SameSite Lax;

restricted to the relevant integration path where implemented; and

configured with a 10-minute maximum lifetime in the currently inspected implementation.

They are used to associate the returning OAuth response with the integration request initiated by the authenticated user and to protect against unauthorised or mismatched authorisation flows.

Similar integration mechanisms may be introduced for additional providers where technically necessary.

6. Firebase Authentication Persistence

The Platform uses Firebase-based identity functionality.

The browser authentication layer is deliberately configured with in-memory persistence.

This means Firebase browser authentication is not intentionally persisted as a long-lived Firebase login session in local storage merely to keep a user signed in between browser sessions.

After authentication, the Platform establishes its own protected server-side application session.

7. “Remember Me” Storage

If a user elects to have the Platform remember a login identifier, the Platform may store that identifier using the browser key:

bp.rememberedIdentifier

Purpose: to pre-populate or remember the user's login identifier.

This storage does not contain the user's password or authenticated session.

When the user disables the corresponding remember option, the Platform removes the stored identifier.

The user can also remove it by clearing the site's browser storage.

8. Functional Browser Storage

The Platform uses local browser storage for certain application preferences and operating context.

Examples identified in the current application include:

interface panel and split-view sizes;

sidebar collapsed/expanded preference;

selected AR document/compliance-account context;

Country Accounts layout preference;

notification workspace layout preference;

Products & Packaging workspace layout preference;

regulatory operations workspace layout preference;

integration workspace layout preference;

and similar user-interface presentation settings.

These values generally represent interface configuration rather than authentication credentials.

Some values remain until they are changed, removed by the application or cleared through the browser.

9. Local Draft Cache

Certain authorised regulatory-authoring functionality may temporarily or persistently cache draft information in browser local storage to support continuity of an editing workflow.

The current application includes local draft-cache functionality for Country Adapter authoring.

Depending on what is being edited, cached information may contain regulatory or business information.

Such browser storage remains subject to the user's local browser security and to any applicable terminal-storage consent requirements.

Sensitive credentials must not be intentionally stored in these draft caches.

10. Browser Push Notification Storage

Where a user activates browser notifications, the Platform may store:

a Platform subscription identifier; and

an installation identifier

in local browser storage.

These identifiers support registration and maintenance of the browser-push subscription.

Where browser push is disabled or the subscription is removed through the relevant application functionality, the Platform is designed to remove the corresponding stored identifiers.

Browser notification delivery may additionally involve Firebase Cloud Messaging where enabled.

11. Session Storage

The Platform uses browser session storage for transient workflow state.

Examples include:

temporary dashboard dismissal states;

background reporting synchronisation timestamps;

temporary integration/OAuth workflow state; and

initial integration synchronisation indicators.

Session storage is ordinarily scoped to the browser tab or browsing session and is cleared by the browser according to browser session-storage behaviour.

12. Analytics and Advertising

The inspected authenticated Platform source does not currently implement general-purpose behavioural advertising trackers or common third-party advertising/analytics tags such as Google Analytics, Google Tag Manager advertising tags, Meta Pixel, Hotjar, Mixpanel, PostHog or Amplitude.

The Platform does not use authentication cookies for advertising.

If we introduce non-essential analytics, advertising or behavioural tracking technology, we will update this Policy and implement the consent controls required by applicable law before deploying such technology where consent is required.

13. Legal Basis and ePrivacy Rules

Authentication, CSRF, workspace-security and temporary OAuth-security cookies are used to provide and secure functionality expressly requested by the user.

Where the applicable implementation of Article 5(3) of the ePrivacy Directive permits strictly necessary storage without consent, we rely on that exemption.

Functional browser storage that does not qualify for a strict-necessity exemption will be subject to consent where required by applicable national law.

Where stored information constitutes Personal Data, subsequent Processing is additionally governed by the GDPR and our Privacy Policy.

14. Managing Storage Technologies

Users can terminate the Platform session by signing out.

Signing out removes the relevant Platform authentication, workspace and CSRF cookies.

Users may clear local browser storage through their browser settings.

Removing storage may reset remembered identifiers, workspace layout preferences, browser-push state, saved interface preferences and local workflow state.

Blocking strictly necessary authentication or security cookies may prevent the Platform from functioning correctly.

15. Third-Party Integrations

A provider connected by the user may independently use cookies or other technologies on its own website during OAuth, login or account-management processes.

Those technologies are governed by that provider's privacy and cookie practices where the provider acts independently.

16. Changes

We may update this Policy where the Platform's Storage Technologies, legal requirements or integrations materially change.

The current version and effective date will be made available through the Platform or associated legal-information page.

17. Contact

Questions about this Policy may be addressed to:

THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ
Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye
https://beyogluprofessional.com/contact