Cookie Policy

Version: 0.1-draft Effective date: not yet in force (draft)

DRAFT – pending review by a qualified Romanian lawyer before use. This document is not yet in force.

1. About this policy

1.1. This policy explains how ALTTAB PROFIT SRL (a limited liability company, CUI RO17030480, Trade Register no. J2004020548403, EUID {{EUID}}, registered seat Str. Doamna Oltea nr. 70, Sector 2, Bucharest, postal code 020231, Romania) uses cookies and similar technologies. In this policy, it is called the "Company", "we" or "us". The policy covers:

• the website https://1ads.net (the "Website");
• the application https://app.1ads.net and the Platform's other interfaces, including the client approval portal and white-label domains configured by agencies (the "Platform").

1.2. This policy complements our Privacy Policy (privacy-policy.md). Capitalized terms not defined here have the meanings given in privacy-policy.md and terms-of-service.md.

1.3. Our approach in short.

• At launch, the Website sets no cookies; the Platform and the sign-in pages use only strictly necessary cookies.
• At launch, we use no website analytics, preference or marketing tools, and the access-request form sets no cookies. [TBC: if such a tool is added later, this policy will be updated first.]
• If we ever add optional cookies, they will stay off until you opt in, rejecting will be as easy as accepting, and you will be able to change your mind at any time through "Cookie settings" in the Website footer (Section 6).
• We do not use third-party advertising trackers in the Platform.

2. What cookies and similar technologies are

2.1. Cookies are small text files that a website stores in your browser and reads on later visits. They can be:

• first-party cookies, set by the site you are visiting;
• third-party cookies, set by another domain;
• session cookies, deleted when you close the browser;
• persistent cookies, kept until they expire or you delete them.

2.2. Similar technologies are covered by this policy in the same way as cookies. They include:

• local storage and session storage;
• IndexedDB;
• pixels and tags;
• SDKs and scripts that read information from your device;
• device fingerprinting.

We call them all "cookies" in this policy. In line with EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, we treat any storing of information on your device, or any reading of information from it, as subject to the same consent rules, whether or not a cookie file is used.

3. Legal framework

3.1. Rules that apply. We apply:

• Art. 5(3) of Directive 2002/58/EC (ePrivacy), as transposed in Romania by art. 4(5) and (6) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector;
• the GDPR (Regulation (EU) 2016/679), whose standard of consent applies (Arts. 4(11) and 7);
• EDPB Guidelines 05/2020 on consent;
• the EDPB Cookie Banner Taskforce report (January 2023);
• EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive.

3.2. What this means.

• Strictly necessary cookies, which are needed to transmit a communication or to provide a service you have explicitly requested, do not need consent. We still tell you about them.
• All other cookies need your prior, free, specific, informed and unambiguous consent.
• Any personal data collected through cookies is then processed under the GDPR, as described in privacy-policy.md.

4. Cookie categories

4.1. Categories with nothing in use. At the effective date, no technology is in use in the preferences, analytics or marketing categories. Because only strictly necessary cookies are used, no consent is needed and no cookie banner is shown at launch. We will update this policy, and ask for your consent, before we start using any technology in those categories. If a cookie banner is introduced, a category that has no cookies in use is shown in the cookie settings with the note "none currently in use".

4.2. No tracking in the Platform. The Platform uses only strictly necessary cookies. We do not use third-party analytics or advertising trackers in the Platform, the client approval portal or white-label domains. Error tracking runs server-side only, on our self-hosted Sentry; no error-tracking, session-replay or analytics script runs in the browser. [TBC: engineering to confirm before publication.]

5. Cookies we use

The tables below list each cookie or similar technology. Entries marked [TBC] will be completed with the exact names and durations before publication.

5.1. Strictly necessary

5.1.1. The access-request form uses no cookies. The access-request form on the Website does not set or read any cookie and does not use local storage. It is protected against spam by a hidden honeypot field and a check of how long the form was open, without any third-party CAPTCHA. When you submit the form, our server records a pseudonymised hash of your IP address and the user agent that your browser sends with every request, to detect abuse; both are deleted after 30 days (see privacy-policy.md). Our web server does not use load-balancing or affinity cookies.

5.2. Preferences

5.3. Analytics

5.3.1. Why analytics would still need consent. No website analytics is used at launch. If we add an analytics tool, note that some regulators consider that "cookieless" techniques can still involve reading information from your device. For that reason, any analytics script would run only after you consent to the Analytics category, unless a competent authority or our legal review confirms that an exemption applies.

5.4. Marketing

5.4.1. Conditions for any future marketing tags. If we add marketing tags:

• they will load only after you consent to Marketing;
• Google tags would use Google Consent Mode in "basic" mode, so that no Google tag loads before consent;
• the provider, the purpose, the duration and any transfer outside the EU will be listed here.

6. How consent works

6.0. At launch: no banner. At launch, the Website sets no cookies and the Platform and the sign-in pages use only strictly necessary cookies, so no consent is requested and no cookie banner is shown. Sections 6.1 to 6.8 apply from the moment we introduce any optional category.

6.1. First visit. Once an optional category is introduced, on your first visit to the Website, a banner explains our use of cookies. Its first layer offers "Accept all", "Reject all" and "Customize". These buttons are equally visible and equally easy to use: the same level, size and prominence. We do not use pre-ticked boxes or misleading colors or wording.

6.2. Granular choice. Under "Customize", you can switch each optional category on or off separately. Strictly necessary cookies are shown as always on.

6.3. No consent by default. Optional cookies stay off until you actively accept them. All of the following count as a refusal of optional categories:

• continuing to browse;
• scrolling;
• closing the banner with the "×" button.

6.4. No cookie wall. You can use the Website and submit an access request whether or not you accept optional cookies.

6.5. Browser privacy signals. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of all optional categories.

6.6. Records of consent. We keep a record of your choice as evidence (Art. 7(1) GDPR): the categories accepted or rejected, the policy version, the date and time, a pseudonymous identifier, the method you used, whether a GPC signal was present, and the language. See privacy-policy.md for how long we keep it.

6.7. Duration and renewal. We store your choice for 6 months. After that, or if we add new categories, purposes or third-party providers, we ask again. If you reject optional cookies, we will not ask again before 6 months have passed, unless our use of cookies changes.

6.8. Withdrawing or changing consent. You can withdraw consent as easily as you gave it, at any time, through the "Cookie settings" link in the footer of every Website page. When you withdraw consent:

• we stop using the cookies concerned;
• we delete the first-party cookies concerned;
• withdrawal does not affect processing that took place before.

Third-party cookies may also need to be deleted in your browser settings.

6.9. The Platform. The Platform uses only strictly necessary cookies, so it does not show a consent banner. This policy remains available from the Platform's footer and settings.

7. Third-party sites and connection flows

7.1. Connecting a Third-Party Platform. When you connect a Third-Party Platform, for example Google, Meta, TikTok, LinkedIn, Microsoft or Shopify, you are sent to that provider's own sign-in and consent pages. Those pages set their own cookies under the provider's cookie and privacy policies. We do not control those cookies. The same applies when you sign in through single sign-on: you are sent to your organization's identity provider (for example Okta, Microsoft Entra ID, Google Workspace or OneLogin), which sets its own cookies.

7.2. Links to other sites. Links from the Website to other sites, such as social networks, are governed by those sites' policies.

8. Managing cookies in your browser

8.1. You can also block or delete cookies in your browser settings. Each browser has help pages on this: Chrome, Firefox, Safari and Edge.

8.2. Blocking strictly necessary cookies may prevent sign-in or other features from working.

8.3. Browser settings do not replace the choices you make in our cookie settings. They work in addition to them.

9. White-label domains and agencies

9.1. Platform cookies on agency domains. When an agency uses the Platform under its own domain (white-label), the Platform sets the same strictly necessary cookies described in Section 5.1 on that domain.

9.2. The agency's own website. The agency's own website, and any tracking it uses, are the agency's responsibility and are not covered by this policy.

10. Changes and contact

10.1. Changes. We will update this policy when we change the cookies we use. We will change the version and effective date, and ask for consent again where required.

10.2. Contact. For questions, write to privacy@1ads.net. Data protection officer: {{DPO_CONTACT}}.

10.3. Complaints. You may lodge a complaint with the Romanian data protection authority, ANSPDCP (https://www.dataprotection.ro), as described in privacy-policy.md.

The machine-readable configuration of the cookie banner is kept in cookie-categories.json.