Current state: active on 2026-08-24
Last revised 4 September 2026.
Current storage and services
- First-party cookies/sessionStorage:
- none found in the verified frontend.
- First-party localStorage:
- icb-theme, written only after the visitor changes appearance; values dark, light or system; purpose: remember that local display choice. The value is not an identifier and localStorage does not send it to the server by itself. It remains until the visitor/site clears it.
- Tracking:
- no first-party analytics, advertising pixel, A/B-testing tag or behavioural tracker found. The shortlist tool (see S1 below) stores locally; no calculator, account or payment storage is active.
- Zoho CRM:
- not browser storage. /api/enquiry sends form data server-side to Zoho CRM EU when configured; on failure the visitor's device opens an email draft.
- Zoho SalesIQ:
- not loaded automatically. It may place its own chat, visitor, preference, consent/reporting and security cookies/storage only after the visitor chooses to load chat. Keep the just-in-time opt-in and an equally usable form/phone/WhatsApp route.
- Mapbox:
- map pages contact Mapbox directly. Mapbox may receive request data and use cookies/similar technologies under its policies. The actual storage set in the production configuration must be confirmed; gate any non-essential storage for consent or remove it.
On these verified first-party facts, do not show a site-entry banner merely for icb-theme: it is a visitor-requested, local display preference with no identifier, tracking or server transmission. This conclusion must be revisited if any fact changes; the chat gate and third-party production audit remain required.
DORMANT modules, except S1 (now live, described below): no current storage for the rest
- S1: shortlist/compare, live:
- the key is icb.shortlist.v1, with no separate compare key. Values are each saved project or offer's reference, name, district and price, and, where available, its area and delivery status, kept locally until the visitor removes them individually on the shortlist page; there is no one-click clear-all for a normal, readable list. If the saved shortlist cannot be read, because storage is unavailable or its saved data is invalid, the shortlist page shows a reset control instead, which clears it completely so the visitor can start again. Basis, where the data are personal: KVKK 5/2(c), only to deliver the visitor-requested pre-contract feature. The storage is not automatic, reused, synchronised or profiled; a WhatsApp contact button may pre-fill an outgoing message with each saved item's name, district and price, but only the visitor's own send inside WhatsApp transmits it, covered separately in Privacy/S1 above.
- C1: calculators:
- activate only for total-cost and instalment-viewer tools whose inputs/results remain in volatile browser memory, with no cookie, localStorage, server request or third-party SDK. If implementation persists any value, list the exact key, purpose and expiry and reassess consent before release.
- A1: accounts:
- activate before signup/authentication. Inventory every session/auth/CSRF/device/preference key, issuer, domain, purpose and duration. Strictly necessary account/security storage may use KVKK 5/2(c) or, after balancing, 5/2(f); all optional storage needs separate assessment and, where no other condition applies, prior opt-in.
- N1: analytics:
- activate before any analytics network request or storage. Keep tags off by default; present Accept and Reject with equal prominence, obtain granular opt-in, record the choice, and make withdrawal as easy as consent. Advertising, cross-site tracking and profiling are outside this module.