Cookie Policy

[ORGANIZATION NAME]Last Updated: [DATE]

Introduction

This Cookie Policy explains how [Organization Name] ("we," "us," or "our") uses cookies and browser storage technologies on our event platform at [events.DOMAIN.com] (public website) and [live.DOMAIN.com] (attendee app).

We use essential browser storage (no consent required) and non-essential third-party tracking cookies (your consent is required before the corresponding cookies are set). A third group of third-party resources — described in "Third-Party Content Loaded Without a Consent Gate" below, and including the Meta and TikTok pixels, which are classified as strictly necessary scripts — is loaded without passing through the cookie banner at all. This policy explains what data is collected, why we collect it, and how you can control it.

What Are Cookies and Storage Technologies?

Cookies

Small text files stored by your browser when you visit a website. They can track your activity across sites and sessions. Cookies may be set by us (first-party cookies) or by third-party services we use (third-party cookies).

Browser Storage (sessionStorage and localStorage)

Modern web storage APIs that allow websites to store data locally in your browser:

sessionStorage: Data deleted when you close the browser tab
localStorage: Data persists until you clear browser data

Key difference: Storage APIs are site-specific (not shared across websites) and do NOT track you across the internet like third-party cookies.

These technologies are used without asking for your consent. Save for the landing-page measurement pixel, which is described at the end of this section and whose classification is under review, they are strictly necessary for the event service to function and are relied on as exempt from the consent requirement under the ePrivacy Directive Article 5(3).

`rx_attribution` sessionStorage

Store marketing attribution parameters (UTM codes, click IDs) as you navigate from landing page to registration form. Used on both [live.DOMAIN.com] and [events.DOMAIN.com].

Duration: Session only (deleted when browser tab closes)
Data stored: utm_source, utm_medium, utm_campaign, utm_content, utm_term, fbclid, gclid, ttclid, li_fat_id, landing_url, referrer_url, ref (share token — captured directly on the attendee app from referral share links, not forwarded from the public website)
Onward transfer: When you follow a tracked link on a landing page, the campaign parameters and advertising click identifiers held here (utm_source, utm_medium, utm_campaign, utm_content, utm_term, fbclid, gclid, ttclid, li_fat_id, ref, ref_source) are appended to the address of the destination page, and are therefore disclosed to the operator of that destination, which is frequently a third party. Where the core campaign parameters are absent from that address, a campaign label derived from the funnel is generated and appended in their place.

`rx_email_is_masked` localStorage

Record that the address held in rx_display_email is a masked value returned by our server (for example q***[email protected]) rather than the address you typed, so that it is not used to pre-fill a registration form. Used on [live.DOMAIN.com].

Duration: Until you clear browser data
Data stored: A single flag

`rx_registered_email` sessionStorage

Hold the email address you entered in a landing-page registration form so that the confirmation page can display it back to you for typo checking. It is held in your browser only and is not written into the page delivered by our server. Used on [events.DOMAIN.com] and on landing pages.

Duration: Session only (deleted when the browser tab closes)
Data stored: Your email address in plaintext, exactly as you typed it

`rx_v` localStorage

Storage schema version flag. Used to detect and migrate outdated localStorage entries from previous versions of the app.

Duration: Until you clear browser data
Data stored: Version number (integer)

`rx_org` sessionStorage

Cache platform configuration to avoid repeated lookups on each page.

Duration: Session only
Data stored: Platform name, timezone, locale, date format

`rx_reg_{orgId}_{sessionId}` localStorage

Remember your event registration so you can access the event room without re-registering.

Duration: Until you clear browser data or delete the item
Data stored: Unique registration ID (UUID format)

`rx_display_name` localStorage

Display your name in the event chat and attendee list without re-entering it.

Duration: Until you clear browser data
Data stored: Your full name (as entered during registration)

`rx_display_email` localStorage

Pre-fill your email on return visits.

Duration: Until you clear browser data
Data stored: Your email address (as entered during registration)

`rx_cookie_consent` cookie (domain-wide)

Remember your cookie consent choice so we don't show the banner on every visit. Shared across all subdomains (e.g. zerodurere.ro and live.zerodurere.ro).

Duration: 12 months
Data stored: { necessary: true, analytics: boolean, advertising: boolean, timestamp, version }

`firebaseLocalStorageDb` IndexedDB

Firebase SDK stores authentication tokens in browser IndexedDB to keep you logged into the event session.

Duration: 1 hour (auto-refreshed during session)
Data stored: Anonymous authentication token (no personal identifiers)

Landing-page measurement pixel (`pv.gif`)

Every landing page we render includes a one-pixel image request back to our own server. The request stores nothing in your browser, but it is the mechanism by which unique visits to a landing page are counted, and it is made on every landing-page view, before and irrespective of any choice you make in the cookie banner.

Duration: No browser storage is used. The record created on our server is retained until the corresponding funnel is deleted; there is no age-based deletion of these records.
Data stored: A non-reversible SHA-256 identifier derived from your IP address and your user agent, recorded together with the page, the date and, where applicable, the event session. The identifier is stable, so the same browser on the same network produces the same identifier on every visit and across days. The raw IP address and the raw user agent are not kept in this record.
Also transmitted by this request: the address of the page you are viewing, a per-request event identifier, and — where they are present in your browser or in the page address — the _fbp and _fbc cookie values and the fbclid advertising click identifier, which a first-party script reads and appends to the request. These are used for the server-side measurement described under "Server-Side Conversion Tracking" below.

GAP-TRACK-01 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy described the technologies used without consent solely as browser storage strictly necessary to deliver the service, and did not disclose this measurement pixel at all. The pixel is requested on every landing-page view without a consent decision and derives a stable pseudonymous identifier from the visitor's IP address and user agent for the purpose of counting unique visitors, which is a measurement purpose rather than a strictly necessary one, and the exemption relied on under Article 5(3) of the ePrivacy Directive has not been established. This divergence is recorded on the compliance remediation register; the classification is under review.

Google Tag Manager (GTM)

Where the organisation has configured a Google Tag Manager container, that container is loaded as a necessary technology, because the container alone does not collect personal data or set cookies. GTM is optional and is configured per organisation: an organisation that has not configured a container has no GTM on its pages.

The container is loaded together with Google Consent Mode v2 defaults, which apply to the Google services delivered through it (Analytics, Ads). On page load, all four consent signals are set to deny by default (analytics_storage: denied, ad_storage: denied, ad_user_data: denied, ad_personalization: denied). When you grant consent via our cookie banner, the signals are updated to "granted" for the relevant categories. If you do not consent, Google services operate in a limited, cookieless mode or do not fire at all.

Google Consent Mode signals reach Google services only, and GTM is not the delivery mechanism for our other tracking scripts. The Meta Pixel, the TikTok Pixel and Microsoft Clarity are each categorised and loaded directly by our own cookie-consent script, independently of GTM and outside Google Consent Mode; that script drives their consent states through the interface each provider offers (fbq('consent', …) for Meta, ttq.grantConsent() and ttq.revokeConsent() for TikTok, and clarity("consent", …) for Microsoft Clarity).

Why these are essential:

Attribution tracking: Measures marketing effectiveness, tracks ad campaign performance
Configuration cache: Enables our platform to work correctly on your domain
Registration ID: Allows you to access the event room (service cannot deliver without it)
Cookie consent: Remembers your privacy choice (required to comply with ePrivacy Directive)
Firebase auth: Powers real-time features (chat, polls, presence tracking)

Without these, the event service would not function.

Server-side at registration: When you submit the registration form, your browser automatically sends an IP address and a User-Agent string to our server as part of the HTTP request (this is standard browser behavior, not specific to us). We use your IP to derive your country and city via a local geo-lookup database (MaxMind GeoLite2 — no data sent externally), and your User-Agent to classify your device type (mobile/tablet/desktop), operating system (iOS/Android/Windows/macOS/Linux), and browser (Chrome/Firefox/Safari/Edge/Opera/Samsung). Your browser also sends your timezone (e.g. "Europe/Bucharest") as part of the registration payload. For geo/device classification, only the derived values are stored (not the raw IP or User-Agent). However, if you arrived via an advertising click, your raw IP and User-Agent are also stored in attribution metadata for ad platform conversion matching — see our Privacy Policy Section 1.3 for details. This processing is governed by our Privacy Policy, not by ePrivacy/cookie rules (it happens on the server, not in your browser).

These cookies are set by third-party advertising and analytics services to track conversions, measure campaign performance, and optimize ad delivery. No advertising or analytics cookie is placed on your device unless you consent to the corresponding category via our cookie banner. The scripts themselves are not all withheld until you consent: as set out immediately below, the Meta Pixel and the TikTok Pixel are loaded on every page view in a cookie-less state.

We categorize these cookies into two types:

📊 Analytics & Performance: Understand how you use our site (Google Analytics, Microsoft Clarity)
📢 Advertising & Marketing: Track conversions and enable retargeting (Meta Pixel, TikTok Pixel)

You can accept or reject each category independently by clicking "Setează preferințe" (Manage Preferences) in our cookie banner, or reject all non-essential cookies by clicking "Doar necesare" (Only Necessary).

How tracking scripts are managed: Each tracking script is categorised and loaded by our own cookie-consent script, which is served from our platform and runs on the public website, on landing pages and in the attendee app. Where the organisation has configured a Google Tag Manager container, that container is an additional layer governed by Google Consent Mode v2; it is not the delivery mechanism for the Meta Pixel, the TikTok Pixel or Microsoft Clarity, which our own script loads directly and which Google Consent Mode does not govern.

How the Meta Pixel and the TikTok Pixel actually load. Both pixels are delivered as part of the strictly necessary script group. This means that the Meta Pixel is fetched from connect.facebook.net and the TikTok Pixel from analytics.tiktok.com, and that each sends one page-view event to Meta and to TikTok respectively, before you make any choice in the cookie banner — and that they continue to do so if you choose "Doar necesare" (Only necessary). They are loaded in a consent-withheld state: the Meta snippet calls fbq('consent','revoke') before the pixel is initialised, and the TikTok snippet calls ttq.holdConsent() before the pixel is loaded. In that state the pixels are configured not to write the identifying advertising cookies to your device — _fbp and _fbc for Meta, _ttp and _ttclid for TikTok — and the platforms treat the events as aggregate measurement rather than as a basis for retargeting. Only when you accept the "Publicitate & Marketing" (Advertising & Marketing) category does our cookie script call fbq('consent','grant') and ttq.grantConsent(), at which point the advertising cookies are set on your device and the events are used for ad targeting and optimisation.

Even in the consent-withheld state the request is still made from your browser, so Meta and TikTok receive your IP address, your user agent and the address of the page you are viewing at the moment the page loads. The absence of a cookie is the reason these scripts are currently classified as strictly necessary; it is not, in itself, a determination that loading them before a consent decision is permitted under Article 5(3) of the ePrivacy Directive or under the GDPR. That classification is under review.

GAP-CONSENT-01 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy stated that the Meta Pixel and the TikTok Pixel load only after you accept advertising cookies, and that they do not load at all if you reject them. That is not how the current implementation behaves: both pixels are classified as strictly necessary, load on every page view and send a page-view event to Meta and TikTok before and irrespective of your consent decision, in a state configured not to set advertising cookies. This divergence is recorded on the compliance remediation register; the classification is under review.

Meta Pixel (Facebook / Instagram Ads Tracking)

Category: 📢 Advertising & Marketing

Purpose: Track conversions from Facebook and Instagram ads. Helps us measure how many people register for events after seeing our ads on Meta platforms.

Cookies set:

Cookie Name	Duration	Purpose	Domain	Category
`_fbp`	90 days	Browser fingerprint ID. Identifies you across sessions to track conversions and optimize ad delivery.	`.{your-domain}` (first-party)	Advertising & Marketing
`_fbc`	90 days	Stores Facebook click ID (`fbclid`) from ad clicks. Matches the click to the registration event.	`.{your-domain}` (first-party)	Advertising & Marketing

Data sent to Meta (via server-side Conversions API):

Hashed (SHA-256) email, first name and last name (you cannot be identified from the hash). No telephone number is transmitted on this path: the field is left empty when the event is assembled, whatever number is on file
Your registration identifier, transmitted unhashed as the external_id matching key
_fbp and _fbc cookie values, where they are present (for conversion matching)
Event type: PageView for a landing-page visit, CompleteRegistration for a registration. These are the only two events transmitted server-side
Event ID, timestamp, page address, and — for a registration — the internal event, session and funnel identifiers together with a zero value and currency
Your IP address and your user agent string, transmitted in full by our server and not anonymised before transmission

Your control:

The _fbp and _fbc cookies are set only if you click "Acceptă toate" (Accept All) or enable "Publicitate & Marketing" (Advertising & Marketing) in cookie preferences.
If you reject cookies or disable "Publicitate & Marketing", no _fbp or _fbc cookie is set and the events are not used for ad targeting or retargeting. The Meta Pixel script itself still loads on every page view in its consent-withheld state, and Meta still receives your IP address, your user agent and the address of the page — see "How the Meta Pixel and the TikTok Pixel actually load" above.
You can change or withdraw your choice at any time by clicking the cookie settings icon (floating button on the left side of the page). The icon is not shown on the live watch screen — see "Cookie Consent Banner" below.
Withdrawing consent stops further use of the advertising cookies but does not delete cookies already stored on your device — see "How to Manage Your Choices" below.

Third-party privacy policy: https://www.facebook.com/privacy/policy/Cookie policy: https://www.facebook.com/policies/cookies/

Google Analytics / Google Ads

Category: 📊 Analytics & Performance

Purpose: Understand how visitors use our website (page views, time on site, navigation patterns) and track conversions from Google Ads campaigns.

Cookies set:

Cookie Name	Duration	Purpose	Domain	Category
`_ga`	2 years	Distinguishes unique users. Assigns a random ID to each visitor.	`.{your-domain}` (first-party)	Analytics & Performance
`_ga_*`	2 years	Stores session state for Google Analytics 4 (page views, events within a session).	`.{your-domain}` (first-party)	Analytics & Performance
`_gid`	24 hours	Distinguishes users (short-lived session tracking).	`.{your-domain}` (first-party)	Analytics & Performance
`_gac_*`	90 days	Stores campaign attribution from Google Ads clicks (gclid parameter).	`.{your-domain}` (first-party)	Analytics & Performance

Data sent to Google:

Anonymized IP address (last octet masked, e.g., 192.168.1.xxx → 192.168.1.0)
Page views, events (registration, event join, attendance)
Click ID from Google Ads (gclid from URL)
User agent (browser, OS, device type), screen resolution, language

Your control:

Google Analytics is loaded only if you click "Acceptă toate" (Accept All) or enable "Analiză & Performanță" (Analytics & Performance) in cookie preferences.
If you reject cookies or disable "Analiză & Performanță", no Google Analytics cookie is set and no analytics data is collected through it. Where the organisation has configured a Google Tag Manager container, that container still loads and the Google services inside it run in Google's cookieless Consent Mode, with all four consent signals set to "denied".

Third-party privacy policy: https://policies.google.com/privacyOpt-out tool: Google Analytics Opt-out Browser Add-on

Microsoft Clarity

Category: 📊 Analytics & Performance

Purpose: Understand how visitors use our event pages via aggregated session recordings, heatmaps, and behavioral signals (rage clicks, dead clicks, scroll depth). Helps us improve page design and identify usability issues.

How it works: Clarity captures a compressed replay of your interactions (mouse movements, clicks, scrolls, navigation between pages) — not a video recording of your screen. All form input values (name, email, phone) are always masked by Clarity before any data leaves your browser, even in Clarity's most permissive mode. Static page text may also be masked depending on our masking configuration.

Cookies set:

Cookie Name	Duration	Purpose	Domain	Category
`_clck`	1 year	Persists Clarity's pseudonymous User ID for this site.	`.{your-domain}` (first-party)	Analytics & Performance
`_clsk`	1 day	Connects multiple page views into a single Clarity session recording.	`.{your-domain}` (first-party)	Analytics & Performance
`CLID`	1 year	Identifies the first time Clarity saw this browser on any site using Clarity.	`.clarity.ms` (third-party)	Analytics & Performance
`MUID`	~13 months	Identifies unique browsers visiting Microsoft sites. Used by Microsoft for analytics, advertising, and operational purposes.	`.clarity.ms` (third-party)	Analytics & Performance
`ANONCHK`	10 minutes	Indicates whether `MUID` is synced with Microsoft's `ANID` advertising cookie (Clarity does not use `ANID`; value is always 0).	`.clarity.ms` (third-party)	Analytics & Performance
`MR`	7 days	Indicates whether to refresh `MUID`.	`.clarity.ms` (third-party)	Analytics & Performance
`SM`	Session	Synchronizes `MUID` across Microsoft domains.	`.clarity.ms` (third-party)	Analytics & Performance

Data sent to Microsoft:

Session recording: mouse movements, clicks, scrolls, taps, keystrokes (keys only, never the values typed), page navigation, viewport size, URL path, referrer
Masked content: all <input> field values; static text where masking rules apply
Pseudonymous user ID (random identifier, not your email or name)
IP address (used by Microsoft to derive approximate location and detect bots)
User agent (browser, OS, device type)

Data NOT sent to Microsoft:

Your plaintext email, name, or phone number (form inputs are always masked by Clarity)
Data from our backend (registrations, behavioral events, server logs)

Microsoft's role: Microsoft acts as an independent data controller for Clarity data (not a processor acting on our behalf). EU users' data is collected under a contract with Microsoft Ireland Operations Limited (MIOL); onward transfer to Microsoft Corporation (USA) is covered by Standard Contractual Clauses between Microsoft affiliates. Microsoft is certified under the EU-US Data Privacy Framework.

Where Clarity runs: Microsoft Clarity is served only on the public website and on landing pages. It is never served in the attendee app at [live.DOMAIN.com], so no Clarity script is loaded and no session recording is captured there, whatever your analytics choice.

Your control:

Clarity is loaded only if you click "Acceptă toate" (Accept All) or enable "Analiză & Performanță" (Analytics & Performance) in cookie preferences.
If you reject cookies or disable "Analiză & Performanță", no Clarity script loads, no Clarity cookies are set, and no session recording is captured.
You can withdraw consent at any time via the cookie settings icon. On withdrawal we instruct Clarity to drop its state and reload the page, but Clarity cookies already stored on your device are not deleted by us — see "How to Manage Your Choices" below.

Third-party privacy policy: https://www.microsoft.com/privacy/privacystatementClarity Terms of Use: https://clarity.microsoft.com/terms

TikTok Pixel

Category: 📢 Advertising & Marketing

Purpose: Track conversions from TikTok ads. Measures how many people register for events after seeing our ads on TikTok.

Cookies set:

Cookie Name	Duration	Purpose	Domain	Category
`_ttp`	13 months	Browser fingerprint for user matching. Tracks conversions across sessions.	`.{your-domain}` (first-party)	Advertising & Marketing
`_ttclid`	Session	Stores TikTok click ID from ad clicks (extracted from URL parameter `ttclid`).	`.{your-domain}` (first-party)	Advertising & Marketing

Data sent to TikTok (via the server-side Events API, active since 8 May 2026):

Hashed (SHA-256) email, first name, last name and registration identifier. No telephone number is transmitted on this path: the field is left empty when the event is assembled, whatever number is on file
The ttclid click identifier from the page address and the _ttp cookie value, both unhashed
Event type (CompleteRegistration), event identifier and timestamp
Landing page address and referring address
Your IP address and your user agent string, transmitted in full by our server and not anonymised before transmission

Your control:

The _ttp and _ttclid cookies are set only if you click "Acceptă toate" (Accept All) or enable "Publicitate & Marketing" (Advertising & Marketing) in cookie preferences.
If you reject cookies or disable "Publicitate & Marketing", no TikTok advertising cookie is set and the events are not used for ad targeting or retargeting. The TikTok Pixel script itself still loads on every page view in its consent-withheld state, and TikTok still receives your IP address, your user agent and the address of the page — see "How the Meta Pixel and the TikTok Pixel actually load" above.
The server-side TikTok Events API described above is not governed by your cookie choice. It is operated on the basis of legitimate interest and is described under "Server-Side Conversion Tracking" below, together with the means of objecting to it.

Third-party privacy policy: https://www.tiktok.com/legal/privacy-policyCookie policy: https://www.tiktok.com/legal/cookie-policy

LinkedIn Insight Tag not active

Category: 📢 Advertising & Marketing

Status: Not active. A LinkedIn configuration exists in our data model, but no LinkedIn Insight Tag is served on any of our pages, there is no LinkedIn Conversions API integration, and we set no LinkedIn cookie. This entry is retained so that the position is recorded, not because the technology is in use.

Cookies set:

Cookie Name	Duration	Purpose	Domain	Category
`li_fat_id`	Not applicable	Not set by us. LinkedIn's first-party advertising identifier. We serve no LinkedIn script, so this cookie is not placed by our platform. Where `li_fat_id` appears as a parameter in a page address, it is held as attribution data and forwarded to the destination of a tracked link, as described under `rx_attribution` above.	Not set by us	Advertising & Marketing

Data sent to LinkedIn: None. No conversion event is transmitted to LinkedIn Corporation by our platform.

Your control:

No action is required in respect of LinkedIn: no LinkedIn script is loaded and no LinkedIn cookie is set by us, whatever your cookie choice.

GAP-DOC-01 · DOCS — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy stated that the LinkedIn Insight Tag places a li_fat_id cookie on your device for thirty days, and that hashed conversion data is transmitted to LinkedIn through a server-side Conversions API. Neither is implemented: no LinkedIn script is served, no LinkedIn cookie is set by our platform, and no conversion event is transmitted to LinkedIn. This divergence is recorded on the compliance remediation register and is under review.

Third-party privacy policy: https://www.linkedin.com/legal/privacy-policyCookie policy: https://www.linkedin.com/legal/cookie-policy

The resources below are loaded by pages we serve without being routed through the cookie banner. They are recorded here so that the position is transparent. They do not belong to the "Analiză & Performanță" or "Publicitate & Marketing" categories and cannot be switched off from the cookie preferences modal.

YouTube video embedding (live watch page)

Where the organisation supplies a YouTube address as the stream for a webinar, the live watch page embeds the video in an inline frame served from www.youtube.com — the standard domain, not the youtube-nocookie.com variant. The frame is rendered as soon as the page loads. There is no consent gate and no click-to-load placeholder.

What this means: for as long as the page is open, your IP address, your user agent, the address of the page carrying the frame and your interactions with the player are transmitted to Google LLC, and Google's own cookies for the youtube.com domain may be set on your device under Google's terms rather than ours. Those cookies are not listed in the tables above, which cover only cookies within our control.
Choice of host: the playback address is supplied by the organisation running the event. Where an address for a video host other than YouTube is supplied, that host's player is embedded in the same way and receives the same information.
Third-party privacy policy: https://policies.google.com/privacy

GAP-TRACK-04 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy did not mention video streaming at all, and presented the cookie banner as the control governing every non-essential third party. The live watch page embeds the stream in a www.youtube.com frame with no consent gate and no click-to-load placeholder, so a YouTube-hosted webinar transmits the attendee's IP address, user agent and viewing behaviour to Google and allows Google cookies to be set for the duration of the session. This divergence is recorded on the compliance remediation register; the classification is under review.

Cloudflare Turnstile (bot protection on forms)

Where the organisation has configured a Turnstile site key, landing pages that carry a registration form load Cloudflare Turnstile from challenges.cloudflare.com. The script is placed in the page head alongside — not inside — our cookie-consent script, so it loads before and irrespective of any consent decision. An organisation that has not configured Turnstile serves no such script. When the form is submitted, our server transmits the challenge response together with your IP address to Cloudflare, Inc. for verification.

Purpose: distinguishing human visitors from automated submissions, so that registration forms are not abused.
Disclosed to Cloudflare, Inc.: your IP address and user agent, the address of the page carrying the form, and the signals Turnstile collects in order to score the request.
⚠️ Whether Turnstile stores anything in your browser on our domains, and for how long, is not established in our own records and must be confirmed against Cloudflare's documentation and the executed agreement before this policy is published.
Third-party privacy policy: https://www.cloudflare.com/privacypolicy/

Cloudflare as a reverse proxy

Independently of Turnstile, traffic to the attendee application at [live.DOMAIN.com] is routed through Cloudflare, Inc. in production. Cloudflare terminates the encrypted connection and therefore sees every request, including registration submissions carrying your name, email address and telephone number in plaintext. For traffic that passes through Cloudflare, the client IP address our platform records is the one Cloudflare supplies in a request header; for traffic that does not, it is taken from the ordinary proxy headers or from the connecting address. This is infrastructure rather than a cookie, and it cannot be switched off from the cookie banner.

Google Fonts on generated landing pages

Landing pages produced with our page generator often use web fonts from Google Fonts. These fonts are served from the landing page's own domain: when you visit such a page, our servers fetch the fonts from Google on the page's behalf, so your browser does not contact Google and your IP address and user agent are not disclosed to Google LLC. No cookies are involved. Our own website and dashboard host their fonts themselves.

Other Third-Party Services (No Cookies on Our Site)

We use these services, but they do not set cookies on our website:

Firebase (Google Cloud Platform)

Purpose: Real-time database, authentication, file hosting Storage: Firebase Authentication stores tokens in IndexedDB (see Essential Storage above). No tracking cookies. Privacy Policy: https://firebase.google.com/support/privacy

NewsmanApp SRL (Email Service Provider)

Purpose: Deliver transactional email (registration confirmation, event reminders, replay notifications) and marketing email, and hold the contact list against which marketing email is sent. Contact records — email address, first name and last name — and segment membership are synchronised to Newsman by a scheduled job. Cookies: Newsman does NOT set cookies on our website. Newsman records whether you open a message and whether you click a link in it, and returns those events to our platform, where they are stored; it also records bounces, complaints and unsubscribes. Privacy Policy: https://www.newsman.com/privacy-policy/

Server-Side Conversion Tracking

In addition to the client-side pixels described above, we send events directly from our server to advertising platform APIs. This takes two forms — a page view sent for every landing-page visit, and a registration event sent when you submit the registration form. Neither is governed by the cookie banner.

Server-side page view on every landing-page visit

Independently of the browser pixels, a server-side Meta Conversions API PageView is sent for every human visitor to a funnel landing page where the organisation has enabled the Meta integration. It carries the visitor's raw IP address, raw user agent, the page URL, the fbclid click identifier and the _fbp / _fbc cookie values where these are present; where the cookie is absent — which is the case for a visitor who has not accepted advertising cookies — the click identifier alone is used to reconstruct an fbc value. There is no consent check on this path; the only condition is that the organisation has enabled the Meta integration.

The equivalent page view is not mirrored to TikTok.

GAP-CONSENT-05 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy stated that server-side conversion tracking happens after you submit the registration form, and that it neither places nor reads cookies on your device. A server-side page view is in fact sent to Meta for every landing-page visit, before and irrespective of any consent decision, and a first-party script on the page reads the _fbp and _fbc cookies from your browser and forwards their values with it. This divergence is recorded on the compliance remediation register; the classification is under review.

Server-side registration event — how it works:

You click an ad with a tracking parameter (e.g., ?fbclid=abc123&gclid=xyz789)
Our website stores these parameters in sessionStorage (see Essential Storage above)
When you register, the parameters are sent to our backend server
Our server sends a conversion event to the Meta Conversions API and, where the organisation has enabled TikTok, to the TikTok Events API

Data sent:

Hashed (SHA-256) email, first name and last name (irreversible — platforms cannot recover your email). No telephone number is transmitted on either path: the field is left empty when the event is assembled, whatever number is on file
Your registration identifier. TikTok receives it hashed; Meta receives it unhashed, as the external_id matching key
Click ID from the URL (fbclid, ttclid). The click identifier is sent whether or not you accepted cookies, and where no _fbc cookie exists an equivalent value is reconstructed from it
Cookie values (_fbp, _fbc, _ttp) where they are present in your browser
Your IP address and your user agent string, transmitted in full and not anonymised before transmission
Event details (registration timestamp, event ID, landing page address and referring address), together with our internal event, session and funnel identifiers and a zero value with a currency code

TikTok Events API: active since 8 May 2026. It sends a CompleteRegistration event for every registration, carrying the fields listed above. It is not gated on advertising consent; the only suppression is a restriction of processing under GDPR Art 18.

Google Ads: no server-side conversion event is sent to Google. Google Ads conversions are measured through the client-side tags only.

Your control:

Server-side tracking is based on legitimate interest (GDPR Art 6(1)(f)), not cookie consent. The server-side event itself places no cookie on your device, but a first-party script on the page reads the _fbp and _fbc cookies where they exist and forwards their values with the event.
You can object to server-side conversion tracking at any time under GDPR Art 21 by contacting us at [[email protected]] with subject "Object to Ad Conversion Tracking". If you exercise your right to restriction of processing (Art 18), server-side conversion events are suppressed for your account.
If you reject advertising cookies via the cookie banner, no advertising cookie is set — but the browser pixels still load in their consent-withheld state, and server-side events are still sent under legitimate interest.

Why both client-side and server-side?

Client-side (Pixel/Analytics): Tracks your journey across pages, allows retargeting, measures attribution. The advertising and analytics cookies require your consent.
Server-side (Conversions API): More reliable conversion tracking (bypasses ad blockers, works even if cookies are blocked by browser settings). Based on legitimate interest — see our Privacy Policy Section 2.4B for details.

You can control each layer independently:

Client-side cookies: Reject the advertising category in the cookie banner, or change your cookie preferences at any time via the cookie settings icon
Server-side tracking: Object under GDPR Art 21 by contacting [[email protected]]

When you first visit our public website ([events.DOMAIN.com]), a landing page, or our attendee app ([live.DOMAIN.com]), you'll see a cookie consent banner at the bottom of the page with three options.

On the live watch page the cookie banner and the floating cookie-settings button are suppressed, on the basis that attendees have already been presented with the consent choices at registration. A visitor who opens a watch page directly is therefore not shown a cookie prompt on that page and cannot change or withdraw cookie preferences from it; the scripts classified as strictly necessary, including the Meta and TikTok pixels, still load.

GAP-CONSENT-03 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy stated that the cookie banner is shown when you first visit the attendee app, and that the cookie settings icon is available on it. On the live watch screen, where an attendee spends the whole of a session, both the banner and the settings icon are removed from the page, so consent can be neither given nor withdrawn from there. This divergence is recorded on the compliance remediation register and is under review.

Note: The banner, the preferences modal and the settings icon are currently served in Romanian only. There is no language switch, and the wording does not follow the platform's language setting. The Romanian labels are quoted below with an English gloss in parentheses. The banner headline reads "Ținem la confidențialitatea ta" (We care about your privacy).

Accept All ("Acceptă toate")

Enables both optional cookie categories: "Analiză & Performanță" (Analytics & Performance) and "Publicitate & Marketing" (Advertising & Marketing)
Loads Google Analytics and, on the public website and landing pages, Microsoft Clarity; grants advertising consent to the Meta Pixel and the TikTok Pixel, which are already loaded (see "How the Meta Pixel and the TikTok Pixel actually load" above). Where the organisation has configured a Google Tag Manager container, the Google Consent Mode v2 signals are updated to "granted"
Sets _fbp, _fbc, _ga, _ga_*, _gid, _gac_*, _clck, _clsk, CLID, MUID, ANONCHK, MR, SM, _ttp and _ttclid cookies
Your choice is saved for 12 months
You can withdraw consent at any time (see "How to Manage Your Choices" below)

Only Necessary ("Doar necesare")

Withholds analytics and advertising consent, so no analytics or advertising cookie is set and the Google, Meta and TikTok consent signals remain denied
Google Analytics and Microsoft Clarity are not loaded
The scripts classified as strictly necessary do still load. These include the Meta Pixel and the TikTok Pixel in their consent-withheld, cookie-less state, and, where the organisation has configured one, the Google Tag Manager container running in Google's cookieless Consent Mode. Each of the two pixels sends one page-view signal; what the container itself fires depends on the tags the organisation has placed in it
Only essential browser storage is used (see Essential Storage above)
Server-side tracking is unaffected — see "Server-Side Conversion Tracking" above
Your choice is saved for 12 months

Manage Preferences ("Setează preferințe")

Opens a modal where you can choose granularly:

🔒 Strict necesare (Strictly Necessary): Always enabled (cannot be disabled). Includes the essential storage listed above and the scripts classified as strictly necessary.
📊 Analiză & Performanță (Analytics & Performance): Toggle on/off. Governs Google Analytics and, on the public website and landing pages only, Microsoft Clarity (session recordings and heatmaps). Microsoft Clarity is never served in the attendee app, so on [live.DOMAIN.com] this toggle governs only Google services.
📢 Publicitate & Marketing (Advertising & Marketing): Toggle on/off. Governs whether the Meta Pixel and the TikTok Pixel may set advertising cookies and use your data for ad targeting and retargeting. It does not govern whether those pixels load, and it does not govern server-side conversion tracking.

You can enable analytics without advertising, or vice versa.

Where your choice is stored. The cookie banner's outcome is stored only in a first-party cookie on the visitor's device (rx_cookie_consent, a JSON value recording the necessary, analytics and advertising choices, a timestamp and a version, retained for twelve months). It is never written to the consent ledger, so the platform holds no server-side record of who accepted or rejected cookies, and cannot evidence a cookie-consent decision after the fact. If you clear your browser's site data, the record of your choice is erased and the banner is shown again. The only related value retained on our side is a single flag written to your registration record stating whether advertising cookies had been accepted at the moment you submitted the form; that flag is stored but is not used to gate any processing.

GAP-CONSENT-02 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this Cookie Policy presented the saved banner choice as the record of your cookie consent without stating where that record is held. The choice is stored only in a cookie in your own browser and is never transmitted to or stored on our servers, so we are not in a position to demonstrate a cookie-consent decision after the fact as Article 7(1) GDPR requires. This divergence is recorded on the compliance remediation register and is under review.

How to Manage Your Choices

You can change your cookie preferences at any time:

1. Via Our Website

Click the cookie settings icon (floating button on the left side of the page) on [events.DOMAIN.com], on a landing page, or on the registration, lobby and preferences screens of [live.DOMAIN.com] to open the preferences modal. The icon is not shown on the live watch screen. You can toggle each cookie category independently:

Analiză & Performanță (Analytics & Performance) — Google Analytics, and Microsoft Clarity on the public website and landing pages only - Toggle on/off
Publicitate & Marketing (Advertising & Marketing) — whether the Meta Pixel and the TikTok Pixel may set advertising cookies and use your data for ad targeting - Toggle on/off

Saving your preferences applies them immediately: where you have withdrawn a consent you previously gave, the page is reloaded, and the consent signals sent to Google, Meta and Microsoft Clarity are updated.

Withdrawal does not delete cookies already set. Withdrawing consent stops further use of the advertising and analytics services but does not delete cookies that were already placed on your device. When you withdraw consent we opt Microsoft Clarity out, return the Meta and TikTok pixels to their consent-withheld state and reload the page; cookies such as _fbp, _fbc, _ttp, _ga and _clck remain in your browser until they expire naturally or you delete them through your browser settings. Section 2 below explains how to delete them.

2. Via Browser Settings

You can block or delete cookies directly in your browser:

Chrome:

Settings → Privacy and Security → Cookies and other site data
Choose "Block third-party cookies" or "Block all cookies"
To delete existing cookies: Clear browsing data → Cookies and other site data

Firefox:

Settings → Privacy & Security → Cookies and Site Data
Choose "Block cookies" or set custom rules
To delete: Click "Clear Data"

Safari:

Preferences → Privacy → Block all cookies (or "Prevent cross-site tracking")
To delete: Manage Website Data → Remove

Edge:

Settings → Cookies and site permissions → Manage and delete cookies
Choose "Block third-party cookies" or "Block all cookies"

Mobile browsers (iOS/Android):

Most mobile browsers have cookie settings in Privacy or Site Settings. Check your browser's help documentation.

3. Browser Extensions

Ghostery: Blocks trackers and shows which services are trying to track you
Privacy Badger: Learns to block invisible trackers
uBlock Origin: Ad blocker that also blocks tracking scripts

4. Opt-Out Tools (Platform-Specific)

Meta: Facebook Ad Preferences → Turn off "Ads based on data from partners"
Google: Google Ads Settings → Turn off "Ad Personalization"
TikTok: TikTok app → Settings → Privacy → Ads → Turn off "Personalized Ads"

Impact of Blocking Cookies

If you block third-party cookies:

✅ Events still work — you can register, attend live sessions, watch replays, use chat, vote on polls
✅ Essential features unaffected — registration IDs, authentication, attribution tracking (stored in sessionStorage/localStorage, not cookies)
❌ We lose part of our measurement — we cannot match a registration to the advertising cookies in your browser, and cannot retarget you with future event promotions
❌ Your experience may be less personalized — we cannot remember your preferences across visits (if we add that feature in the future)
⚠️ What blocking cookies does not stop: the scripts classified as strictly necessary are still requested by your browser, and the landing-page measurement pixel and the server-side events described above are still sent. To prevent the network requests themselves you would need to block the domains concerned in your browser or with an extension (see sections 2 and 3 above).

Changes to This Policy

We may update this Cookie Policy when:

We add or remove third-party tracking services
Cookie regulations change (e.g., new ePrivacy Regulation replaces the Directive)
We receive guidance from data protection authorities

How you'll be notified:

Updates posted on this page with a new "Last Updated" date. ⚠️ The cookie policy page served to visitors on the organisation's public website does not display a version identifier, an effective date or a last-updated date, so the version in force at any moment cannot at present be matched by a reader to a dated text
Material changes (e.g., adding a new cookie category) will trigger a new consent banner on your next visit (version number in your saved consent will be outdated)
For significant changes, we may also send an email to registered users

GAP-CONSENT-10 · PROCESS — KNOWN GAP, REMEDIATION PENDING

This Cookie Policy states that a material change triggers a new consent banner on your next visit, because the version number recorded in your stored consent becomes outdated. Material changes to what loads before a consent decision took effect on 21 April 2026 and on 8 May 2026 — the Meta Pixel and then the TikTok Pixel were reclassified as strictly necessary scripts, a consent-free server-side page view to Meta was introduced, and the server-side TikTok Events API was activated — without any increment to the consent version, so stored consents were not invalidated and the banner was not shown again. This divergence is recorded on the compliance remediation register and is under review.

Your responsibility: Review this policy periodically. Continued use of our event platform after changes means you accept the updated policy.

Contact Us

Questions about cookies or your data privacy?

Email: [[email protected]] Website: [events.DOMAIN.com] Data Protection Officer (if applicable): [DPO Name and Email]

For broader privacy questions (not just cookies), see our Privacy Policy.

Document Version: 1.0 (DRAFT) Prepared by: [Legal Team] Review Status: ⚠️ REQUIRES LEGAL REVIEW — This is a draft for lawyer consultation

Cookie Policy ​

Introduction ​

What Are Cookies and Storage Technologies? ​

Cookies ​

Browser Storage (sessionStorage and localStorage) ​

Essential Storage (No Consent Required) ​

rx_attribution sessionStorage ​

rx_email_is_masked localStorage ​

rx_registered_email sessionStorage ​

rx_v localStorage ​

rx_org sessionStorage ​

rx_reg_{orgId}_{sessionId} localStorage ​

rx_display_name localStorage ​

rx_display_email localStorage ​

rx_cookie_consent cookie (domain-wide) ​

firebaseLocalStorageDb IndexedDB ​

Landing-page measurement pixel (pv.gif) ​

Non-Essential Cookies (Requires Consent) ​

Meta Pixel (Facebook / Instagram Ads Tracking) ​

Google Analytics / Google Ads ​

Microsoft Clarity ​

TikTok Pixel ​

LinkedIn Insight Tag not active ​

Third-Party Content Loaded Without a Consent Gate ​

YouTube video embedding (live watch page) ​

Cloudflare Turnstile (bot protection on forms) ​

Cloudflare as a reverse proxy ​

Google Fonts on generated landing pages ​

Other Third-Party Services (No Cookies on Our Site) ​

Firebase (Google Cloud Platform) ​

NewsmanApp SRL (Email Service Provider) ​

Server-Side Conversion Tracking ​

Cookie Consent Banner ​

Accept All ("Acceptă toate") ​

Only Necessary ("Doar necesare") ​

Manage Preferences ("Setează preferințe") ​

How to Manage Your Choices ​

1. Via Our Website ​

2. Via Browser Settings ​

3. Browser Extensions ​

4. Opt-Out Tools (Platform-Specific) ​

Impact of Blocking Cookies ​

Changes to This Policy ​

Contact Us ​

Introduction

What Are Cookies and Storage Technologies?

Cookies

Browser Storage (sessionStorage and localStorage)

Essential Storage (No Consent Required)

`rx_attribution` sessionStorage

`rx_email_is_masked` localStorage

`rx_registered_email` sessionStorage

`rx_v` localStorage

`rx_org` sessionStorage

`rx_reg_{orgId}_{sessionId}` localStorage

`rx_display_name` localStorage

`rx_display_email` localStorage

`rx_cookie_consent` cookie (domain-wide)

`firebaseLocalStorageDb` IndexedDB

Landing-page measurement pixel (`pv.gif`)

Non-Essential Cookies (Requires Consent)

Meta Pixel (Facebook / Instagram Ads Tracking)

Google Analytics / Google Ads

Microsoft Clarity

TikTok Pixel

LinkedIn Insight Tag not active

Third-Party Content Loaded Without a Consent Gate

YouTube video embedding (live watch page)

Cloudflare Turnstile (bot protection on forms)

Cloudflare as a reverse proxy

Google Fonts on generated landing pages

Other Third-Party Services (No Cookies on Our Site)

Firebase (Google Cloud Platform)

NewsmanApp SRL (Email Service Provider)

Server-Side Conversion Tracking

Cookie Consent Banner

Accept All ("Acceptă toate")

Only Necessary ("Doar necesare")

Manage Preferences ("Setează preferințe")

How to Manage Your Choices

1. Via Our Website

2. Via Browser Settings

3. Browser Extensions

4. Opt-Out Tools (Platform-Specific)

Impact of Blocking Cookies

Changes to This Policy

Contact Us