Current state: active on 2026-08-24
Last revised 25 August 2026.
Current storage and services
- First-party cookies/sessionStorage:
- none found in the verified frontend.
- First-party localStorage:
- icb-theme, written only after the visitor changes appearance; values dark, light or system; purpose: remember that local display choice. The value is not an identifier and localStorage does not send it to the server by itself. It remains until the visitor/site clears it.
- Tracking:
- no first-party analytics, advertising pixel, A/B-testing tag or behavioural tracker found. No shortlist/compare, calculator, account or payment storage is active.
- Zoho CRM:
- not browser storage. /api/enquiry sends form data server-side to Zoho CRM EU when configured; on failure the visitor's device opens an email draft.
- Zoho SalesIQ:
- not loaded automatically. It may place its own chat, visitor, preference, consent/reporting and security cookies/storage only after the visitor chooses to load chat. Keep the just-in-time opt-in and an equally usable form/phone/WhatsApp route.
- Mapbox:
- map pages contact Mapbox directly. Mapbox may receive request data and use cookies/similar technologies under its policies. The actual storage set in the production configuration must be confirmed; gate any non-essential storage for consent or remove it.
On these verified first-party facts, do not show a site-entry banner merely for icb-theme: it is a visitor-requested, local display preference with no identifier, tracking or server transmission. This conclusion must be revisited if any fact changes; the chat gate and third-party production audit remain required.
DORMANT modules: no current storage
- S1: shortlist/compare:
- activate when verified keys, planned as icb.shortlist.v1 plus any compare key, ship. Insert exact key, values and lifespan. Intended values are selected property/project references, order and compare settings, local only until cleared. Provide “Clear shortlist” and a just-in-time notice when Save is first used. Pre-drafted basis if the data are personal: KVKK 5/2(c), only to deliver the visitor-requested pre-contract feature. If the storage is automatic, reused, synchronized, profiled or not directly necessary, obtain counsel-approved opt-in before writing it. WhatsApp transmission is covered separately in Privacy/Consent.
- C1: calculators:
- activate only for total-cost and instalment-viewer tools whose inputs/results remain in volatile browser memory, with no cookie, localStorage, server request or third-party SDK. If implementation persists any value, list the exact key, purpose and expiry and reassess consent before release.
- A1: accounts:
- activate before signup/authentication. Inventory every session/auth/CSRF/device/preference key, issuer, domain, purpose and duration. Strictly necessary account/security storage may use KVKK 5/2(c) or, after balancing, 5/2(f); all optional storage needs separate assessment and, where no other condition applies, prior opt-in.
- N1: analytics:
- activate before any analytics network request or storage. Keep tags off by default; present Accept and Reject with equal prominence, obtain granular opt-in, record the choice, and make withdrawal as easy as consent. Advertising, cross-site tracking and profiling are outside this module.