Cookie Policy
CIQRA OÜ · Version 2.1 · Last updated: 3 November 2026 Effective date for existing customers: the changes in this version take effect, for a customer who accepted an earlier version, on the date stated in CIQRA's notice of this version, at least 30 days after the notice (Terms of Service, Section 14.2); until then the earlier version applies to that customer. A customer that objects may terminate without charge before that date (Terms of Service, Section 14.3).
This Cookie Policy explains how cookies and similar technologies are used on CIQRA's own websites and dashboards and on Storefronts that run on the CIQRA platform. It should be read together with the Privacy Policy. CIQRA publishes one cookie policy for every country; a Turkish translation is available at Çerez Politikası, and the English text is binding.
Controller for CIQRA's own websites and dashboards (including ciqra.com): CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia · info@ciqra.com
1. Scope and roles
1.1 On CIQRA's own websites and dashboards, CIQRA is the controller for cookies and similar technologies.
1.2 On a Merchant's Storefront, the Merchant decides which analytics, advertising and other integrations to use and is the controller for them. The Merchant is responsible for its own cookie notice and for the legal basis of the technologies it enables. CIQRA provides the consent-management tools and the default settings described in this Policy.
2. What cookies and similar technologies are
Cookies are small files stored on your device. Similar technologies include local and session storage, pixels and tags, software development kits, device identifiers and scripts that read information from your device. Server-side tracking is a technique by which a website's server forwards information about your visit to a third party. Under EU and EEA law, storing or reading information on your device requires your consent unless it is strictly necessary to provide the service you have requested, and server-side forwarding of your personal data for analytics or advertising is subject to the same consent.
3. How consent works
3.1 Strictly necessary technologies run without consent because the service you requested cannot be provided without them. They include session management, security tokens, load balancing, storing your consent choices, the shopping cart and checkout, and fraud prevention.
3.2 All other technologies run only after you opt in through the consent banner. On CIQRA's own websites and dashboards the banner is always shown. On a Storefront the Merchant is the controller and configures the banner; where the Merchant has switched the banner off, the Merchant is responsible for the consent or opt-out its law requires, and CIQRA's own websites are not affected. The banner lets you accept all, reject all or choose by category, and you can change or withdraw your choice at any time through the "Cookie settings" link. Rejecting non-essential technologies does not affect your access to the essential functions of the website.
3.3 The platform uses three consent categories: necessary, analytics and marketing. Where Google services are used, consent is passed to Google through Consent Mode, with all consent signals set to "denied" until you make a choice.
3.4 Server-side tracking does not bypass consent. Each server-side destination (such as Google Analytics 4, Google Ads, Meta, Pinterest and Snapchat) is dispatched only where the corresponding consent category has been granted. If consent is refused or withdrawn, the event is not forwarded.
3.5 Visitors outside the EEA. The consent model described above follows EU and EEA law and is also applied to visitors in the United Kingdom (PECR), Switzerland, Türkiye and Canada, including Québec, whose laws require consent before non-essential technologies run. Where the law that applies to a visitor gives a right to opt out instead (for example the US state privacy laws), the cookie settings and the Global Privacy Control signal described in Section 7 give effect to it. CIQRA publishes one cookie policy for every country; nothing in it is a statement that a particular country's law applies to CIQRA.
4. Categories of technologies
| Category | Purpose | Consent required? | Examples |
|---|---|---|---|
| Strictly necessary | Security, sessions, cart and checkout, load balancing, storing consent choices, fraud prevention, bot protection on forms | No | CIQRA session and security cookies; Cloudflare security functions; Stripe checkout and fraud prevention; the reCAPTCHA _grecaptcha cookie, set only when you interact with a protected form (Section 4.1) |
| Preferences | Remembering language, region and similar choices | Yes, except where the preference is strictly necessary for a service you requested | CIQRA preference cookies |
| Analytics | Understanding how the website is used in order to improve it, including session-replay and heat-map tools where a Merchant enables them | Yes | Google Analytics 4 and Google Tag Manager (including server-side Google Analytics); Microsoft Clarity (session replay and heat maps), only where the Merchant enables it for its Storefront |
| Marketing | Measuring advertising campaigns, remarketing and conversion tracking, including server-side conversion APIs | Yes | Meta Pixel and Conversions API, Google Ads, TikTok, Pinterest, Snapchat |
Platform-set storage durations. The consent-choice cookie and the language-preference cookie are stored for 365 days; the identifier used for a guest's live-chat conversation is stored for 180 days. Where a consent banner is enabled, its settings panel lists the cookies used on that website, with their provider, purpose and duration.
4.1 Bot protection (CAPTCHA)
Forms on CIQRA websites and Storefronts (for example, login, registration, contact and checkout forms) may be protected against automated abuse by a CAPTCHA service chosen by the website operator: Google reCAPTCHA, Cloudflare Turnstile or hCaptcha. These services process information about your device and your interaction with the page to distinguish people from automated programs. For reCAPTCHA, Google Cloud EMEA Limited acts as processor under the Google Cloud Data Processing Addendum. reCAPTCHA is loaded only when you interact with a protected form, and it then sets the _grecaptcha security cookie, which is used solely for bot protection. When a form is verified with the CAPTCHA provider, CIQRA's server sends only the verification token, not your IP address. On a Storefront, the Merchant decides where bot protection is used and is responsible for its legal basis.
5. Third-party technologies
- Google Analytics 4 and Google Tag Manager — analytics; loaded with storage only where analytics consent has been given, in line with the Consent Mode state.
- Meta Pixel and Conversions API — advertising measurement. Both the browser pixel and server-side forwarding run only with marketing consent. Events sent from the browser and from the server are de-duplicated using a shared event identifier. Server-side forwarding may share hashed identifiers (such as a hashed email address or telephone number), the IP address and event data with Meta.
- TikTok, Pinterest, Snapchat and other advertising platforms — advertising measurement; subject to marketing consent, both in the browser and for any server-side events.
Some of these providers are located outside the EEA. Transfers are made under the safeguards described in Section 7 of the Privacy Policy.
On a Storefront, the Merchant is the controller for the analytics and advertising technologies it enables and is responsible for its consent banner, its agreements with the providers and its legal basis. For certain advertising technologies, the website operator and the advertising platform may be joint controllers for the collection and transmission of data.
6. Managing cookies
You can change your consent choices at any time through the "Cookie settings" link. Most browsers also allow you to block or delete cookies; blocking strictly necessary cookies may prevent the website from working properly.
7. Global Privacy Control and Do Not Track
If your browser sends the Global Privacy Control signal (Sec-GPC: 1), the store records a "do not sell or share" choice for you and remembers it for later visits. This applies on every Storefront on the platform, whether or not the Merchant shows a consent banner, and on CIQRA's own websites and dashboards (including ciqra.com). While the choice is in place, the categories the store declares to involve a sale or sharing of personal data (advertising and cross-context tracking) are withheld and advertising destinations are not contacted for you. The signal does not switch off the store's own first-party measurement of site usage, which does not identify you; you can decline analytics separately in the cookie settings. Each store publishes a machine-readable statement of this at /.well-known/gpc.json.
The platform does not respond to "Do Not Track" browser signals.
8. Changes
We may update this Policy from time to time. The date at the top shows when it was last updated. Material changes are brought to your attention through the consent banner or on this page.
Contact: info@ciqra.com