Last updated: 14 September 2026
1. Scope
This Cookie Policy explains the cookies, related browser technologies and technical records used by visas.org.tr. It must be read together with the Privacy Policy.
The policy is based on the deployed application design reviewed for this revision. A cookie or provider that is not deployed must not be listed as active, and a newly deployed non-essential technology must not be activated until the inventory, notice, preference mechanism and security configuration are updated.
2. What a cookie is
A cookie is a small value placed in a browser by a website. A cookie may help maintain a secure workflow, remember a choice or, where separately enabled, measure use of a website.
A cookie is different from a server-side record. Application forms, encrypted drafts, transaction records, payment records and security logs are stored on the Company's servers or in necessary provider systems; they are not all "cookies" merely because they relate to a browser session.
3. Current cookie model
At this revision, visas.org.tr uses first-party cookies for secure form continuity and short-lived transaction functions. The application is designed so that passport details and form answers are not placed in browser cookies, localStorage or sessionStorage.
The actual cookie names are generated per deployment for security and may not be human-readable. The public inventory therefore identifies cookies by purpose rather than exposing internal names.
| Purpose | Category | Data in the browser | Maximum duration | Main safeguards |
|---|---|---|---|---|
| Application, pre-application or insurance draft continuity | Strictly necessary workflow | A signed opaque reference to an encrypted server-side draft; no form content | Up to 7 days, or deleted earlier when the draft is completed or discarded | First party, HttpOnly, SameSite=Lax, Secure in production, signed value |
| Phone-country selection during a form workflow | Functional workflow | A signed country-selection value and issue time; no telephone number | Up to 7 days | First party, HttpOnly, SameSite=Lax, Secure in production, signed value |
| Cookie preference storage | Preference management | Signed analytics and advertising choices, preference revision and issue time; no application form content | Up to 1 hour | First party, HttpOnly, SameSite=Lax, Secure in production, signed value |
| Payment or secure handoff continuity | Strictly necessary transaction | A signed opaque transaction or handoff reference; no card number | Generally no more than 1 hour; some handoff links expire within 30 minutes | First party, HttpOnly, SameSite=Lax, Secure in production, signed and time-limited |
| Return access to a recorded insurance application | Strictly necessary transaction | A signed insurance-request reference and draft-slot identifier; no traveller or card details | Up to 24 hours | First party, HttpOnly, SameSite=Lax, Secure in production, signed and time-limited |
| Deletion marker | Security and lifecycle | Empty value used to remove an expired workflow cookie | Immediate | Max-Age=0 and expiry in the past |
Cookies in this table are not used to build advertising profiles or follow a user across unrelated websites.
4. Server-side technical records
The following are not browser cookies, although they may support the same secure transaction:
- Access to an incomplete encrypted draft expires seven days after the draft was last saved.
- one-time form-token and nonce records, normally valid for no more than one hour;
- payment-intent records, normally valid for no more than one hour;
- application, legal-acceptance, payment, policy, communication and security records retained under the Privacy Policy;
- IP-based rate-limit and fraud-prevention records.
Deleting browser cookies does not automatically erase records that must be retained to perform a completed transaction, meet a legal duty or protect legal rights. Data-subject rights may be exercised as explained in the Privacy Policy.
5. Analytics, advertising and conversion tracking
Yandex Metrica (counter 112543243) loads automatically on public information pages, including when no cookie preference has been saved or permission has been declined. Alongside page visits, it measures website use through Session Replay (Webvisor), click maps, link tracking and bounce measurement. The page content you view, your interactions and browser identifiers from cookies or local storage may be sent to Yandex. It is not loaded on application, status, payment, other private transaction or legal pages. Google Ads (tag AW-18448435823) loads automatically on public information pages, independently of saved cookie preferences. Google may receive your IP address, browser and device information, page visits and advertising identifiers, and may use cookies for advertising measurement and personalization. It is not loaded on application, status, payment, other private transaction or legal pages. Google Analytics, Matomo and the site’s conversion events remain disabled.
If additional analytics, advertising or another non-essential technology is introduced later:
- it must be added to the deployed inventory with provider, purpose, data, duration and transfer details;
- it must remain off until the user makes the legally required choice;
- "Accept" and "Reject" choices must be equally accessible and no non-essential option may be preselected;
- consent must be granular where purposes or providers differ;
- withdrawal must be as easy as giving consent;
- legal and private transaction pages must remain outside tracking unless a separate lawful decision expressly allows it.
6. Legal basis
Strictly necessary cookies are used because they are required to deliver the secure form or transaction requested by the user and to protect the website. They are not used for unrelated marketing.
A functional workflow cookie is used only to remember a choice necessary to continue the user's active form experience. Where a future cookie is not necessary for the requested service and cannot rely on another lawful ground, it is used only after explicit consent.
7. Managing cookies
You may configure your browser to block or delete cookies. Blocking strictly necessary workflow cookies may prevent a multi-step form, secure draft, payment handoff or status-related security function from working.
Where a cookie preference tool is available, you may use it to accept, reject or change non-essential choices. Removing browser cookies may also reset a saved preference, in which case the site may ask again before using non-essential technologies.
8. Third-party pages
When you leave visas.org.tr for an official portal, insurer, bank or another third-party page, that third party may use its own cookies under its own policy. The Company does not control cookies placed directly by an independent third party on that third party's domain.
9. Changes and contact
This Policy is updated when the actual cookie or storage inventory changes. The revision date and inventory basis are shown above.
Questions about cookies or privacy may be submitted through the visas.org.tr contact page, to the Company's registered address or to [email protected].