LAST UPDATED: 29.06.2026
Cookie Policy
At KidZania Istanbul, we value the privacy and security of our visitors' personal data.
In this context, we use cookies, pixel tags, and similar technologies to provide a better experience for users who visit our website at https://istanbul.kidzania.com/ (the "Website").
This Cookie Policy has been prepared to provide information regarding the types of cookies used on the Website, the purposes for which they are used, and how users can manage their cookie preferences.
For more detailed information regarding the processing of your personal data, we recommend that you review the Privacy Notice on the Processing of Personal Data.
1. INTRODUCTION AND SCOPE
As Akasya Çocuk Dünyası A.Ş. ("KidZania Istanbul", the "Company", "we", "us", or "our"), we use various cookies and similar tracking technologies when you visit our website at istanbul.kidzania.com. This Cookie Policy explains, within the scope of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the types of cookies we use, the purposes for which they are used, their retention periods, our relationships with third parties, and how you can manage your cookie preferences. This Policy applies to our website, mobile applications, and digital systems used within the park.
2. WHAT ARE COOKIES AND SIMILAR TECHNOLOGIES?
Cookies are small text files that are placed on your device by your browser when you visit our website. In addition to cookies, the following technologies may also be used:
| Technology | Description |
|---|---|
| Cookies | Small text files placed on your browser. |
| Web Beacons (Pixels) | Invisible image files embedded in web pages or emails that are used to monitor user behavior. |
| Local Storage | Larger data sets stored within the browser's storage, beyond the capacity of cookies. |
| Session Storage | Temporary data that is deleted when the browser tab is closed. |
COOKIE CATEGORIES AND PURPOSES OF PROCESSING
The cookies used on our website are categorized as follows. You have the right to manage your consent separately for each category.
3.1 Strictly Necessary Cookies — Always Active
These cookies are essential for the basic functions of the Website. If they are blocked, the Website may not function properly. Your consent is not required for these cookies, and they cannot be disabled.
| Cookie Name / Provider | Type | Purpose | Retention Period | Transfer |
|---|---|---|---|---|
| session_id / KidZania | Session | User session management, maintaining login status | Deleted when the browser is closed | Domestic — TR servers |
| csrf_token / KidZania | Session | Security against cross-site request forgery (CSRF) | Deleted when the browser is closed | Domestic — TR servers |
| language_pref / KidZania | Persistent | Storing language preference (TR/EN) | 1 year | Domestic — TR servers |
| cookie_consent / KidZania | Persistent | Storing your cookie preferences | 1 year | Domestic — TR servers |
| Google reCAPTCHA / Google LLC | Session/Persistent | Bot protection; form security | 6 months | USA — Google LLC (under SCCs) |
| _Secure-BUCKET / Google | Persistent | Verification of access to secure content (CDN) and access control for protected files | Approximately 90 days | International — Google LLC (USA, SCCs) |
| _grecaptcha / Google reCAPTCHA | Persistent | Bot detection and security verification | Approximately 180 days | International — Google LLC (USA, SCCs) |
| AEC / Google | Persistent | Security verification and prevention of abuse | Approximately 1 day | International — Google LLC (USA, SCCs) |
| cf_clearance / Cloudflare | Session / Short-term | Cloudflare security verification and attack protection | Session or short period | International — Cloudflare Inc. (USA, SCCs) |
| Kidzania_SESSION / Kidzania | Session | Management of the user session and login information | Deleted when the browser is closed | Domestic — Site servers |
| PHPSESSID / Kidzania | Session | Ensuring the continuity of the user session | Deleted when the browser is closed | Domestic — Site servers |
| form_token (CSRF) / Kidzania | Session | Providing security against CSRF attacks | Session or short period | Domestic — Site servers |
| cookieconsent_status / Kidzania | Persistent | Storing the user's cookie preferences | Approximately 1 year | Domestic — Site servers |
| msToken / TikTok | Session | Security verification and verification of requests in TikTok services | Approximately a few days | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| passport_csrf_token / TikTok | Session | Providing protection against CSRF attacks and secure user operations | Approximately a few days | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| passport_csrf_token_default / TikTok | Session | Supporting user verification and security controls | Approximately a few days | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| tt_csrf_token / TikTok | Session | Secure request verification and prevention of abuse | Session duration | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| tt_chain_token / TikTok | Persistent | Ensuring security, request verification, and platform integrity in TikTok services | Approximately a few months | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| ttwid / TikTok | Persistent | Supporting user session, regional routing, and service security processes | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| checkoutId / Kidzania | Persistent | Ensuring the secure management of the user's payment and order process | Approximately 1 month | Domestic — Site servers |
| checkoutUser / Kidzania | Persistent | Ensuring that the user's identity and session information are associated during payment transactions | Approximately 1 month | Domestic — Site servers |
3.2 Functional Cookies
| Cookie Name / Provider | Type | Purpose | Retention Period | Transfer |
|---|---|---|---|---|
| booking_pref / KidZania | Persistent | Remembering the booking basket and preferences | 30 days | Domestic — TR servers |
| user_timezone / KidZania | Persistent | Time zone and regional content customization | 1 year | Domestic — TR servers |
| chat_widget / tawk.to | Session | Live support / chatbot functionality | End of session | Cloudflare |
| twk_uuid_* / Tawk.to | Persistent | Ensuring the operation of the live support service and recognizing the user across visits | Approximately 6 months | International — Tawk.to Inc. (USA, SCCs) |
| TawkConnectionTime / Tawk.to | Session | Ensuring the continuity of the live support session and managing the connection | Session duration | International — Tawk.to Inc. (USA, SCCs) |
| remember_web_* / Kidzania | Persistent | Remembering the user's login status and preferences during subsequent visits | Approximately 6 months | Domestic — Site servers |
3.3 Analytics Cookies
| Cookie Name / Provider | Type | Purpose | Retention Period | Transfer |
|---|---|---|---|---|
| _ga / Google Analytics | Persistent | Measurement of user count and interaction (anonymous) | 2 years | USA — Google LLC (SCCs + Consent Mode v2) |
| _ga_XXXXXX / Google | Persistent | Measurement ID (GA4 session) | 2 years | USA — Google LLC (SCCs) |
| _gid / Google | Persistent | 24-hour unique user identification | 24 hours | USA — Google LLC (SCCs) |
| _gat / Google Analytics | Short-term | Optimizing performance by limiting the request rate | 1 minute | International — Google LLC (USA, SCCs) |
| hjSession* / Hotjar | Session | Analyzing user behavior on a session basis | Browser session | International — Hotjar Ltd. (Malta/EU) |
| hjSessionUser* / Hotjar | Persistent | Anonymously recognizing the same user across different sessions | Approximately 1 year | European Union — Hotjar Ltd. (Malta) |
| ar_debug (google-analytics.com) / Google Analytics | Persistent | Collecting measurement and debugging data | Approximately 30 days | International — Google LLC (USA, SCCs) |
⚠ Important: Google Analytics is only activated for parent/guardian accounts with IP anonymization enabled. Analytics cookies are disabled in sessions directly used by children.
3.4 Targeting / Advertising Cookies — Currently Disabled (Child Safety)
| Cookie Name / Provider | Type | Purpose | Status | Activation Condition |
|---|---|---|---|---|
| _fbp / Meta Platforms | Persistent | Facebook Pixel — behavioral targeting and Custom Audiences | DISABLED | May only be activated following explicit parental consent, implementation of SCCs, and notification pursuant to Article 9 of the KVKK |
| _fbc / Meta | Persistent | Facebook click ID tracking | DISABLED | The same conditions apply |
| GTM / Google Tag Manager | Persistent | Tag management infrastructure | RESTRICTED | Only triggers tags belonging to permitted categories |
3.5 Marketing Cookies
| Cookie Name / Provider | Type | Purpose | Retention Period | Transfer |
|---|---|---|---|---|
| _gcl_au / Google Ads | Persistent | Measuring advertising conversions | Approximately 90 days | International — Google LLC (USA, SCCs) |
| IDE / DoubleClick | Persistent | Displaying interest-based advertising | Approximately 1 year | International — Google LLC (USA, SCCs) |
| NID / Google | Persistent | Google preferences and ad personalization | Approximately 6 months | International — Google LLC (USA, SCCs) |
| OTZ / Google | Persistent | Ad targeting and user behavior analysis | Approximately 7 days | International — Google LLC (USA, SCCs) |
| ar_debug (doubleclick.net) / DoubleClick | Persistent | Debugging and diagnosis of advertising systems | Approximately 30 days | International — Google LLC (USA, SCCs) |
| C / Adform A/S | Persistent | Ad delivery, anonymous identification of the user identity, measurement of ad performance, and delivery of interest-based advertising | Approximately 1 year | International — Adform A/S (Denmark / EU) |
| CM / Adform A/S | Persistent | Supporting ad targeting and performance measurement by storing advertising preferences and ad display information | Approximately 1 day | European Union — Adform A/S (Denmark) |
| CM14 / Adform A/S | Session / Short-term | Storing technical information for the verification of advertising campaigns and conversion measurement | Browser session or up to 1 day | European Union — Adform A/S (Denmark) |
| TPC / Adform A/S | Persistent | Measuring the effectiveness of advertising campaigns, analyzing user interactions, and ensuring ad optimization | Approximately 7 days | European Union — Adform A/S (Denmark) |
| uid / Adform A/S | Persistent | Assigning an anonymous unique ID to the user in order to perform ad personalization, conversion measurement, frequency capping, and ad performance analysis | Approximately 13 months | European Union — Adform A/S (Denmark) |
| datr / Meta Platforms (Facebook) | Persistent | Ensuring user security, supporting account verification processes, and assisting user identification processes in Meta services | Approximately 1 year | International — Meta Platforms Inc. (USA, SCCs) |
| fr / Meta Platforms (Facebook) | Persistent | Displaying Facebook ads, measuring ad performance, conversion tracking, and delivering personalized advertising | Approximately 90 days | International — Meta Platforms Inc. (USA, SCCs) |
| ps_l / Meta Platforms (Facebook) | Persistent | Supporting user preferences and the experience across Meta services | Approximately 1 year | International — Meta Platforms Inc. (USA, SCCs) |
| ps_n / Meta Platforms (Facebook) | Persistent | Optimizing user preferences and the advertising/service experience | Approximately 1 year | International — Meta Platforms Inc. (USA, SCCs) |
| sb / Meta Platforms (Facebook) | Persistent | Ensuring security controls, session security, and the proper functioning of Meta services | Approximately 1 year | International — Meta Platforms Inc. (USA, SCCs) |
| wd / Meta Platforms (Facebook) | Persistent | Optimizing the content and advertising experience by using device screen information | Approximately a few days / short-term | International — Meta Platforms Inc. (USA, SCCs) |
| _tt_enable_cookie / TikTok | Persistent | Enabling the TikTok Pixel, measuring advertising, and tracking conversions | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| ttcsid / TikTok | Persistent | Associating user sessions and advertising interactions, measuring conversions, and analyzing campaign performance | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| ttcsid_* / TikTok | Persistent | Providing advertising measurement and user interaction tracking through different TikTok Pixel IDs | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| _ttp / TikTok | Persistent | Identifying users anonymously, personalizing ads, retargeting, and measuring conversions | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| from_way / TikTok | Persistent | Analyzing user traffic source, campaign, and advertising referral information | Approximately a few months | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
| tta_attr_id_mirror / TikTok | Persistent | Ad attribution, campaign performance, and conversion measurement | Approximately 1 year | International — TikTok Technology Limited / TikTok Inc. (SCCs) |
4. THIRD-PARTY DATA TRANSFERS
Personal data collected through cookies may be transferred to the following third parties. The necessary mechanisms for each transfer have been established within the scope of Article 9 of the KVKK:
| Recipient | Country | Subject Matter of Transfer | Legal Basis | Safeguard Mechanism |
|---|---|---|---|---|
| Google LLC | USA | Analytics data, reCAPTCHA security data | KVKK Article 9/2-b (Undertaking) | Standard Contractual Clauses (SCCs) — signed [date] |
| KidZania International S.A.R.L. | Luxembourg | Membership and loyalty program data | KVKK Article 9 — mechanism to be determined | Joint data controller agreement is being prepared; SCCs will be applied |
| Meta Platforms Inc. | USA | Currently disabled — pending parental consent | — | SCCs will be prepared; compliance with KVKK Decision No. 2026/347 will be ensured prior to activation |
| Macellan (Mobile Application) | Türkiye | Application usage data and reservation data | KVKK Article 8 (Data Processor) | KVKK Data Processor Agreement has been signed |
5. HOW CAN YOU MANAGE YOUR COOKIE PREFERENCES?
Under the scope of the KVKK, you have the right to manage your cookie preferences at any time, free of charge and easily.
5.1 Cookie Management Center
By clicking on the "Cookie Preferences" link located at the bottom of each page of our Website:
- You can reject all optional cookies with a single click,
- You can enable or disable each cookie category separately,
- You can view and modify your existing preferences.
5.2 Management Through Browser Settings
You can also manage cookies through your browser settings:
| Browser | Cookie Settings Path |
|---|---|
| Google Chrome | Settings → Privacy and Security → Cookies and Other Site Data |
| Mozilla Firefox | Settings → Privacy & Security → Cookies and Site Data |
| Apple Safari | Preferences → Privacy → Manage Cookies and Website Data |
| Microsoft Edge | Settings → Cookies and Site Permissions → Manage and Delete Cookies and Site Data |
Warning: If you block strictly necessary cookies through your browser settings, certain Website functionalities may not operate properly.
5.3 Third-Party Opt-Out Links
- Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout
- Google advertising preferences: https://adssettings.google.com
- Meta advertising preferences: https://www.facebook.com/ads/preferences
- Digital Advertising Alliance opt-out: http://www.youronlinechoices.eu
6. SPECIAL NOTICE FOR PARENTS: PROTECTION OF CHILDREN'S DATA
This section has been prepared for parents and legal guardians.
KidZania Istanbul services are intended for children between the ages of 4 and 14. Under the KVKK, children's personal data is subject to special protection:
- Only you (the parent/legal guardian) may create a membership account for your child.
- You will be provided with separate consent checkboxes regarding the purposes for which your child's data will be processed.
- Explicit and separate consent will be obtained from you for the use of your child's data for advertising or marketing purposes — such processing will not be carried out without this consent.
- Within the scope of the B-KidZanian loyalty program, your child's in-park activity data is collected; this data is used solely for program management purposes, and no analytical profiling will be conducted without your explicit consent.
- You may use the Contact Information below to request the deletion, access, or update of your child's data.
7. APPLICATION AND CONTACT
You may exercise your rights regarding your Personal Data under Article 11 of the KVKK through the contact methods provided below.
| Application Method | Details |
|---|---|
| Written Application | Akasya Çocuk Dünyası A.Ş., Akasya Shopping Mall, Acıbadem/Üsküdar Istanbul — signed written petition |
| [email protected] (via secure electronic signature or registered electronic mail) | |
| KVKK Application Form | You can access the KVKK Application Form and information regarding the application process on the Application and Information page. |
| Response Period | Your request will be answered within 30 days. This period may be extended by an additional 30 days depending on the complexity of the request; any delays will be notified to you in writing with the reasons provided. |
| Parental Application | For applications made on behalf of your child, a copy of the identity document and proof of custody must be attached to the application. |
10. POLICY UPDATES
This Cookie Policy may be revised due to legal changes, the implementation of new cookies, or technology updates. Any changes will be published on our Website; significant changes will be communicated to registered members via email.
Your continued use of the Website after the update shall be deemed as your acknowledgment that you have reviewed the updated Policy; however, for new cookies requiring consent, your consent will be requested again through the cookie banner.
Share
Come on, you share Kidzania, where children experience education and fun, real life.