Privacy and data protection
Cookie Policy
Explains which cookies are used on the www.enatto.com website and in the EnaTTO app, and why.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This Cookie Policy explains how cookies are used on the www.enatto.com website, operated by ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation"), and in the EnaTTO app used by organizations. In short: our website does not use cookies. The EnaTTO app uses only cookies that are strictly necessary for the service to work, plus a few interface preferences (language, theme and menu); no advertising, marketing or tracking cookies are used.
1. What is a cookie?
Cookies are small text files saved in your browser when you visit a website. They are used to keep you signed in or keep a site secure. Similar technologies, such as the browser's local storage, are also treated as "cookies" in this policy.
2. Our website (www.enatto.com)
2.1. Use of cookies
As of the effective date of this policy, our website does not place any cookies in your browser. Language is chosen through the address (Turkish pages at the root, English pages under /en, German pages under /de), and no cookie is used for language preference.
If a cookie strictly necessary for the security or operation of the site is needed in the future, it will be listed on this page with its name, purpose and duration. If we ever use a cookie that is not strictly necessary, we will ask for your consent before using it.
2.2. Cookieless visit statistics
We use Vercel Web Analytics and Vercel Speed Insights to understand how the site is used and how fast it loads. These tools:
- do not use cookies or similar persistent identifiers;
- do not track visitors across different websites;
- give us only aggregate data such as page views, country, device and browser type, and page load performance.
We do not use this data for advertising or profiling. See the Privacy Policy for details.
2.3. Cookie consent banner
Because our website does not use cookies, it does not show a cookie consent banner.
2.4. Organization login
The organization code you enter on the "Login" page is sent to the organization discovery service (discovery.enainnovation.com) to send you to your organization's EnaTTO address. No cookie is placed by our website for this.
3. The EnaTTO app (organizations' environments)
Each organization's environment runs at its own address (organizationcode.enatto.com). These environments use only first-party cookies and browser storage: strictly necessary cookies so that the administration interface works, and a few settings that remember your interface preferences. They are not used for advertising or tracking, and no third-party analytics or marketing tools are used.
The organization's public pages (technology catalogue, demand, application and event registration forms, feedback survey and certificate verification) do not need an account and do not set the sign-in cookies below.
Cookies
| Name | Purpose | Duration | httpOnly |
|---|---|---|---|
logto_* | Session of users with our identity provider, Logto (encrypted; may be split into several parts) | For the duration of the session; renewed when the session is refreshed | Yes |
ena_post_login_redirect, ena_pending_invitation_id | Return you to the right page during sign-in and invitation acceptance | Up to 10 minutes | Yes |
ena_identity_flash | Shows a one-time message after sign-in or sign-out (for example that access was denied) | 180 seconds | No |
ena_admin_locale | Remembers the language of the administration interface | 1 year | No |
Browser storage (preferences)
| Name | Purpose | Duration |
|---|---|---|
tto-admin-theme | Theme of the administration interface (dark, light or system) | Until you clear it (local storage) |
tto-admin-sidebar | Whether the side menu is collapsed | Until you clear it (local storage) |
ena:session-expiry-redirect | Prevents repeated redirects to the sign-in page when a session expires | Until the browser tab is closed (session storage) |
Cookies that carry session or identity credentials are set as httpOnly, which means scripts on the page cannot read them. The cookies marked "No" and the browser storage entries carry no credentials. Users are sent to the hosted sign-in pages of our identity provider, Logto, or to the organization's own single sign-on provider; those pages may use their own cookies needed for signing in.
Cloudflare, the network protection service in front of the environments, may set strictly necessary security cookies of its own (for example to tell legitimate traffic from automated attacks).
3.1. Responsibility
The organization using an EnaTTO environment is the data controller for personal data processed in it. ENA Innovation acts as data processor for these environments.
4. Legal basis
Strictly necessary cookies are needed to provide the service you request. Personal data processed through these cookies is processed under Article 5(2)(c) (entering into or performing a contract) and Article 5(2)(f) (legitimate interest) of Turkish Law No. 6698 on the Protection of Personal Data; explicit consent is not required for these cookies. The preference settings listed above only remember choices you make in the interface; they are not used to identify or track you. Rules on storing information on a device that apply in the EEA, the United Kingdom and Switzerland (for example national laws implementing the ePrivacy Directive) generally allow storage that is strictly necessary for a service the user has requested without consent. For organizations subject to the GDPR, the UK GDPR or the Swiss FADP, the organization, as data controller, determines the legal basis for strictly necessary cookies.
5. How to control cookies
You can view, delete or block cookies in your browser settings. Common browsers:
- Google Chrome: Settings → Privacy and security → Third-party cookies / Site data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions
If you block the strictly necessary cookies in the EnaTTO app, you may not be able to sign in to the administration interface.
6. Changes and contact
We may update this policy; the current version is published on this page. For questions, write to support@enainnovation.com.