Legal information
Personal Data Processing Information
This page presents the information about personal data processing through cookies, browser storage and notification technologies from our Cookie Policy.
3. For What Purposes Is Your Personal Data Processed?
Personal data may be processed through the cookies and non-cookie technologies used on our website for the following purposes:
Supporting sign-in and account functions;
Remembering shopping cart contents and language preferences;
Measuring website usage through Firebase Analytics;
Analysing visitor activity;
Improving the user experience;
Sending push notifications to visitors who enable notifications.
4. Categories of Personal Data Processed Through Cookies
Depending on the technology used, the following categories of personal data may be processed through cookies and non-cookie technologies.
Language preferences, sign-in and account information, shopping cart contents and notification registration information are processed. Firebase Analytics may process website usage measurement information and information associated with cookies or similar identifiers. The exact data fields collected by the analytics service have not yet been verified.
Notification registration information is not collected through cookies.
Backend review identified notification registration fields: Firebase installation ID, account reference, platform, optional device identifier, last-seen time and creation/update times. Firebase Cloud Messaging receives target installation IDs, notification titles/bodies and application-defined message data when messages are sent. A controlled local Analytics audit observed request fields for client/session identifiers, page URL/title, language, screen resolution, browser/device/platform information and consent flags; collection requests were blocked during this audit. Additional production event fields still require verification.
5. Method of Collection and Legal Basis for Processing Personal Data
Your personal data is collected electronically through automated methods when you visit our website, using cookies, browser storage, analytics identifiers and, if you enable them, push notification technologies.
Browser storage is used for sign-in, account and shopping cart functions. Personal data required for the account and shopping services requested by the user is processed without seeking explicit consent under Article 5(2)(c) of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, “KVKK”), provided that the processing is directly related to the establishment or performance of a contract and is necessary for processing the personal data of the parties to that contract.
This legal basis does not cover advertising, profiling or additional processing that is not necessary for the service.
The legitimate interest condition under Article 5(2)(f) of the Law may be applied only to activities for which it has been separately assessed and established that processing is necessary for the data controller’s specific legitimate interests and does not harm the fundamental rights and freedoms of the data subject. It is not used as a general legal basis for all these functions.
The falcon_language cookie, which remembers your language preference on subsequent visits, persistent browser storage relating to your language preference and personal data processing activities within Firebase Analytics rely on explicit consent given for the relevant purpose under Article 5(1) of the Law. These optional technologies are not activated before explicit consent is obtained.
Processing notification registration information and device or browser identifiers that qualify as personal data for this purpose also relies on Article 5(1) of the Law. Browser notification permission is a technical permission separate from cookie preferences and does not, on its own, constitute explicit consent.
Refusing explicit consent for optional processing does not prevent access to basic account and shopping services.
For all processing activities, the obligation to inform is fulfilled separately from obtaining explicit consent. In accordance with Article 4 of the Law, data is kept relevant, limited and proportionate to the purposes of processing and retained only for the necessary period.
If personal data is transferred abroad, the transfer conditions under Article 9 of the Law must also be satisfied. Explicit consent to data processing is not, on its own, considered sufficient for an international transfer.
6. To Whom and for What Purposes May Your Personal Data Be Transferred?
Our website uses Google Firebase Analytics to measure website usage and Google Firebase Cloud Messaging (FCM) to send push notifications to visitors who enable notifications.
Notification registration information is sent to Google to deliver notifications. This information is not collected through cookies.
Google/Firebase may process information relating to analytics measurement and push notification delivery outside Türkiye or access such information from outside Türkiye. This may also include information associated with analytics cookies or similar identifiers.
The relevant countries and the international transfer mechanism have not yet been verified.
The conditions for processing data abroad or accessing data from abroad in connection with Google and Facebook sign-in or account-linking functions, as well as hosting and payment services, have not yet been verified either.
Technical provider confirmation: Google and Facebook sign-in use backend OAuth integrations; the reviewed backend does not use Firebase Authentication for these account logins. Mailgun is used for transactional account-security emails, including password-reset messages. The reviewed Mailgun client uses the default api.mailgun.net US-region endpoint; actual domain/account retention and contractual transfer conditions require confirmation. No named external payment-gateway integration was identified in the reviewed code. Hosting, database, cache and backup providers/locations cannot be established from the local configuration.
7. Cookies and Other Technologies Used on Our Website
The table below sets out the cookies and non-cookie technologies used according to the available technical descriptions.
The verified cookie is falcon_language. The exact names, durations and first-party or third-party status of cookies or identifiers that Firebase Analytics may use have not yet been verified.
The inventory is not final because cookies that may be used in connection with hosting and payment services have not yet been verified either.
Browser storage and notification registration information are shown separately from cookies in the table.
A controlled local browser audit on 9 October 2026 using the real Firebase/Google tag resources and current public project settings observed _ga and _ga_JHSWNNRKK7 on the application's own origin, with approximately 365-day expiry. Analytics resources and cookies were absent before consent. Collection and installation-registration requests were blocked during the audit. These findings do not certify production behavior, Google-held data retention or the complete production inventory.
| Category / Technology Type | Provider | Cookie / Technology Name and Nature | Purpose | Legal Basis | Retention Period |
|---|---|---|---|---|---|
| Session and account / Browser storage | Falcon Range | authToken and user; localStorage browser records, not cookies | Storing sign-in and account information | Processing personal data necessary to provide the account service requested by the user and maintain the session is not subject to explicit consent because it is directly related to the establishment or performance of a contract. This scope is limited to session and account records necessary for the service. | No automatic browser-storage expiry is configured. Browser records are removed when the application clears the authentication session or site data is cleared/evicted. Backend JWT validity is 43,200 seconds (12 hours); expiry does not itself erase browser or database records. Stored backend tokens are replaced on new token issuance; no database TTL is configured in the reviewed token schema. |
| Shopping cart / Browser storage | Falcon Range | shoppingCart; localStorage browser record, not a cookie | Storing shopping cart contents | Processing shopping cart information necessary to carry out the shopping transaction requested by the user and establish the contract is not subject to explicit consent. Using shopping cart information for advertising, profiling or purposes unrelated to the shopping transaction is not covered by this legal basis. | No configured automatic expiry. Updated or cleared through cart operations, or removed when browser site data is cleared/evicted. |
| Preference/Functionality | Falcon Range | falcon_language; first-party cookie | Remembering the language preference | Optional storage of the user’s language preference for subsequent visits relies on explicit consent given for the preference/functionality category. No cookie is placed for this purpose unless explicit consent is given. | 365 days from the latest write (Max-Age=31536000). Removed earlier when functionality consent is withdrawn or expires. |
| Analytics/Performance | Google / Firebase Analytics | _ga (browser/client identifier) and _ga_JHSWNNRKK7 (session state); first-party cookies observed on the local application origin with the configured Firebase project. Production names/domain and additional provider-managed identifiers still require verification. | Measuring website usage | Processing usage records containing personal data for analytics and performance measurement relies on explicit consent given for this category. The client is configured to initialize Firebase Analytics only after a valid analytics-category consent has been recorded. This consent gate has been checked in local automated tests; the deployed configuration must also be verified before publication. If an international transfer occurs, an appropriate transfer condition under Article 9 of the KVKK must also be satisfied. | Analytics cookie lifetime is configured to 365 days without renewal on visits. Actual deployed cookie names and expiry must be verified. Retention of other Firebase identifiers and Google-held event/user data must be confirmed separately. Firebase-created IndexedDB databases were still present after Analytics withdrawal in the controlled local audit; their record contents, sharing and deletion lifecycle require separate verification. |
| Preference/Functionality / Browser storage | Falcon Range | falcon-language; localStorage record containing the language code and expiry timestamp, not a cookie | Storing the language preference in the browser | Optional browser storage of the user’s language preference for subsequent visits relies on explicit consent given for the preference/functionality category. No persistent preference record is created for this purpose unless explicit consent is given. | 365-day application expiry from the latest write, checked on read. Removed earlier when functionality consent is withdrawn or expires. Browser clearing/eviction may remove it sooner. |
| Sign-in / Temporary browser storage | Falcon Range for authReturnUrl; other sign-in provider records require separate verification | authReturnUrl; sessionStorage browser record, not a cookie. Other provider-managed sign-in records require separate verification. | Supporting sign-in processes | Processing temporary records necessary to sign in to the account service requested by the user is not subject to explicit consent because it is directly related to the establishment or performance of a contract. Records are limited to the scope and period necessary for sign-in. If data is transferred to a provider, the relevant transfer conditions must also be satisfied. | Client authReturnUrl: until consumed after sign-in or the tab session ends, subject to session restoration. Server-side OAuth account-link state in Redis: up to 600 seconds (10 minutes), deleted earlier when consumed. This server lifetime is separate from browser storage and provider-managed records. |
| Push notifications / Non-cookie technology | Google / Firebase Cloud Messaging (FCM) | falcon-firebase-installation-id in localStorage; backend push_registrations contains installationId, user reference, platform, optional deviceId, lastSeenAt, and creation/update timestamps. Browser permission and service worker are separate non-cookie technologies. | Sending push notifications to visitors who enable notifications, including when the website is not open | Processing notification registration information and device/browser identifiers that qualify as personal data to send optional push notifications relies on separate explicit consent obtained for the notification purpose. Browser notification permission is obtained separately and is not, on its own, considered explicit consent under the KVKK. If an international transfer occurs, an appropriate transfer condition under Article 9 of the KVKK must also be satisfied. | Browser installation record: no automatic expiry; removed through unregistration or browser site-data clearing. Backend registration: no TTL or scheduled deletion is configured; removed by successful explicit unregistration or invalid-registration cleanup during delivery. Registrations last seen more than the configured age (default 45 days) are excluded from delivery, not deleted. Browser permission persists until revoked. Google publishes installation-ID retention until an ID deletion API request, then removal within 180 days; whether registration unregistration erases the installation ID must be confirmed separately. |
| Necessary / Preference administration / Browser storage | Falcon Range | falcon-cookie-consent; localStorage record, not a cookie | Remembering the latest category selection, notice version, language, decision source and selection/expiry timestamps | Necessary to remember and apply the user's cookie selection. Saving this record does not activate optional categories without the relevant consent. | 180 days from the recorded selection. Invalidated and deleted by the application on expiry when the website runs; replaced when a new selection is saved. |
9. Your Rights as a Data Subject
Under Article 11 of Law No. 6698 on the Protection of Personal Data, you have the following rights by applying to the data controller:
To learn whether your personal data is processed;
To request information if your personal data has been processed;
To learn the purposes of processing and whether your personal data is used in accordance with those purposes;
To know the third parties to whom your personal data is transferred in Türkiye or abroad;
To request correction of incomplete or inaccurate personal data and to request its deletion or destruction;
To request that the actions taken be notified to third parties to whom your personal data has been transferred;
To object to a result against you arising from the analysis of your personal data exclusively through automated systems and to claim compensation for damage suffered due to unlawful processing.
You may submit your requests in this respect to our Company in writing through the Company’s email address, [email protected], or at Merkez Mahallesi Begonvil Sokak Nef 03 A ve B Blok 1/1I Kağıthane/İstanbul.
11. Contact
Data Controller: Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi
Address: Merkez Mahallesi Begonvil Sokak Nef 03 A ve B Blok 1/1I Kağıthane/İstanbul
Email: [email protected]