Cookie and Storage Notice

Current cookie and browser-storage inventory

locale

First-party cookie; stores the language selected by the visitor; one year; functional; no advertising purpose; no consent required where strictly necessary for the requested preference.

vianordis_consent

First-party localStorage key; stores the visitor's necessary-only or preference-storage choice, the separate measurement opt-in, the notice version, and its one-year expiry; no advertising purpose. Version 2 replaced version 1 when measurement was introduced; earlier choices were discarded rather than carried forward, so every visitor is asked again.

perf

First-party localStorage key; set only when a visitor or developer explicitly uses the performance-debug option; persists until removed or until the visitor selects necessary-only storage; diagnostic preference; no advertising purpose.

Matomo measurement

No cookie and no browser-storage key. The tracker is configured with disableCookies and writes nothing to the device; the tracker script served by this site uses no localStorage, sessionStorage, or IndexedDB. What it reads from the device is listed under Measurement.

Server-side security state

Rate-limit and security records are server-side records, not browser cookies. Their processing is described in the Privacy Notice.

Measurement

Website measurement is optional and off by default. Nothing is requested from the measurement server — not even the tracker script — until the visitor selects “Preferences and measurement” in the consent panel. Withdrawal is as easy as consent: the cookie-settings control reopens the panel at any time, withdrawal stops measurement immediately and for all later visits, and it does not affect the lawfulness of measurement carried out beforehand.

Provider: Matomo Analytics, self-hosted by GoSec Cloud OÜ at matomo.vianordis.eu on Scaleway infrastructure in the DC5 data centre in Paris, France, with Scaleway as infrastructure subprocessor. Measurement data is not sent to Matomo's own cloud service, is not shared with third parties, and is not used for advertising, profiling, or automated decision-making.

Read from the device. These are read to build the configuration identifier described below, which is why measurement requires consent even though no cookie is set:

• Screen resolution.
• Browser language.
• Support flags for cookies, PDF, Java, Flash, Silverlight, QuickTime, RealPlayer, and Windows Media.

Stored per visit on the measurement server:

• Full IP address, stored without masking or anonymisation.
• Country, region, city, latitude, and longitude derived from that IP address.
• A visitor identifier and configuration identifier derived from the IP address, user agent, and browser settings, using a salt that rotates daily.
• Browser name, version, and engine; operating system and version.
• Device type, brand, model, and client type; screen resolution; browser language; and the support flags listed above.
• Referrer URL, referrer type, referrer name, and search keyword.
• Page URLs and page titles visited; entry and exit page; action count, interactions, site searches, and events.
• Visit start and end time, the visitor's local time, and time on site.
• Returning-visitor counters: returning status, visit count, and seconds since the first and the last visit.
• Where the request is identified as an AI crawler, the detected agent name.

Not stored:

• No cookie or other storage on the device.
• No user or account identifier — the field is empty and there is no login integration.
• No custom dimensions.
• No e-commerce or order data.

Legal basis: consent, under Article 6(1)(a) GDPR together with the national provisions implementing Article 5(3) of the ePrivacy Directive. The audience-measurement exemption offered by some supervisory authorities is deliberately not relied on, because this instance retains the full IP address rather than a masked one.

Raw measurement records — the per-visit entries described above — are deleted 90 days after the visit. Aggregated reports derived from them are retained for longer and contain no IP address and no visitor or configuration identifier. Access, correction, and erasure requests covering measurement data are handled as described in the Privacy Notice.

Your control

The cookie-settings control reopens the choice panel, and can withdraw the measurement opt-in or reduce storage to necessary-only at any time. Selecting necessary-only storage removes the perf localStorage value. Browser controls can also remove or block the locale cookie and localStorage values. Blocking the locale cookie means language choice may not persist. The inventory is reviewed whenever website tooling changes.