1. About This Policy
This Cookie Policy explains how Croatian Roots (“we,” “us,” or “our”) uses cookies and similar technologies on this website and in the client portal. It supplements our Privacy Policy, which describes everything else we do with personal data.
We are established in Croatia and most of our clients are in North America, so two different regimes apply depending on where you are. In the EU/EEA, the United Kingdom, Switzerland and Canada we ask for your consent before setting anything non-essential. In the United States we give you notice and an ongoing right to opt out. Sections 5 to 7 set out each in detail — and whichever applies to you, the controls in Section 4 are the same.
2. What Cookies Are
A cookie is a small text file stored on your device by your browser. We also use technologies that behave like cookies for legal purposes — localStorage, sessionStorageand tracking pixels. Everywhere below, “cookies” means all of them.
First-party cookies are set by croatianroots.net. Third-party cookies are set by the providers named in Section 3, each of whom acts under its own privacy policy as well as our contract with them.
3. Cookies We Use
This is the complete list, generated from the same configuration that drives the consent banner — so what you see here is exactly what the switches control.
Strictly necessary
Cannot be switched off.
These keep you signed in, protect forms from abuse, remember your theme, and record your cookie choice. Without them the client portal and our contact forms cannot function, so they cannot be switched off.
Legal basis: Exempt from consent under Article 5(3) of the ePrivacy Directive; processed under GDPR Article 6(1)(f) — our legitimate interest in operating a secure service.
| Provider | Cookies | Purpose | Duration |
|---|---|---|---|
| Croatian Roots | cr_consent, cr_geo | Stores your cookie choice and the privacy regime that applies to you. | 180 days (choice) / 24 hours (region) |
| Supabase Auth | sb-*-auth-token | Keeps you signed in to the client portal and admin dashboard. | Session to 30 days |
| Cloudflare Turnstile | cf_clearance and related | Blocks automated abuse of the contact, newsletter and eligibility forms. | Up to 30 minutes |
| Stripe | __stripe_mid, __stripe_sid | Fraud prevention during checkout. Set only when you start a payment. | 30 minutes to 1 year |
Analytics
Off until you allow it in the EU/EEA, UK, Switzerland and Canada.
Aggregate measurement: which pages get read, where visitors drop out of the eligibility check, which guides answer the question. We do not use it to build advertising profiles, and IP addresses are truncated before storage.
Legal basis: Consent — GDPR Article 6(1)(a) and ePrivacy Article 5(3).
| Provider | Cookies | Purpose | Duration |
|---|---|---|---|
| Google Analytics 4 | _ga, _ga_* | Page and event measurement with IP anonymisation. | Up to 2 years |
| PostHog (EU hosting) | ph_* | Product analytics for the eligibility wizard and client portal. | Up to 1 year |
Advertising
Off until you allow it in the EU/EEA, UK, Switzerland and Canada.
Measures which adverts led to an enquiry and allows advertising networks to show our adverts to similar audiences. This is the category US law calls "sale or sharing of personal information for cross-context behavioural advertising".
Legal basis: Consent — GDPR Article 6(1)(a); opt-out right under CCPA/CPRA §1798.120 and §1798.135.
| Provider | Cookies | Purpose | Duration |
|---|---|---|---|
| Meta Pixel | _fbp, fr | Conversion measurement and audience building for Facebook and Instagram adverts. | Up to 90 days (first-party) / 1 year |
| Google Ads (via Analytics) | _gcl_* | Attributes enquiries to the advert that produced them. | Up to 90 days |
4. Managing Your Choices
On this site
Use the Cookie settings link in the footer of every page (labelled Your Privacy Choices if you are in the United States), or the button at the top of this page. You can change or withdraw your choice as often as you like, and withdrawing takes no more clicks than giving it did.
Your choice is stored in a first-party cookie for 180 days, after which we ask again. When you withdraw a category we also delete the cookies that category had already set.
Global Privacy Control
We honour the Global Privacy Control (GPC) signal. If your browser or extension sends it, we treat it as a valid opt-out of the sale and sharing of your personal information for advertising, and turn that category off automatically. You will see this confirmed in the preferences panel.
In your browser
Every major browser lets you block or delete cookies in its settings, and Google offers a Google Analytics opt-out add-on. Blocking all cookies will sign you out of the client portal and may break the contact and eligibility forms, because the cookies in the “strictly necessary” table above are what make them work.
5. EU/EEA, United Kingdom & Switzerland
Article 5(3) of the ePrivacy Directive (in Croatia, the Electronic Communications Act) and, in the UK, Regulation 6 of PECR require your consent before we store anything on your device that is not strictly necessary. We therefore set no analytics or advertising cookies, and load no third-party tag, until you allow it.
Consent must be freely given, specific, informed and unambiguous (GDPR Art. 4(11)). In practice that means: nothing is pre-ticked; rejecting is one click, in the same place and the same size as accepting; declining costs you no functionality; and you may withdraw at any time under Art. 7(3) without it affecting the lawfulness of what came before.
Where cookies process personal data you also have the rights in GDPR Arts. 15–22 — access, rectification, erasure, restriction, portability and objection. Section 12 of our Privacy Policy explains how to exercise them.
If you believe we have got this wrong, you may complain to your local supervisory authority. In Croatia that is the Croatian Personal Data Protection Agency (AZOP); in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.
6. Canada
We treat Canadian visitors the same way as EU visitors. Under PIPEDA, consent is only valid if it is meaningful, and express consent is expected where the purpose would not be obvious to a reasonable person — which is the case for analytics and advertising cookies.
Quebec’s Law 25 goes further: section 8.1 of the Act respecting the protection of personal information in the private sector requires technology that identifies, locates or profiles a user to be deactivated by default. Ours is. You may also contact us to access or correct your information, or to complain to the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec.
7. United States
If you are in the United States, we give you notice at collection — the banner on your first visit — and analytics and advertising cookies operate until you opt out. This reflects the opt-out model in the California Consumer Privacy Act as amended by the CPRA, and in the Virginia, Colorado, Connecticut and Utah equivalents.
Sale and sharing
We do not sell personal information for money. However, when advertising cookies are active, the data they send to advertising networks is a “sale” or “sharing” for cross-context behavioural advertising as those terms are defined in the CCPA. You have the right to direct us to stop, and you can exercise it in one click through Your Privacy Choices in the footer of any page, or by sending a GPC signal. We do not knowingly sell or share the personal information of anyone under 16.
Your other rights
Depending on your state, you may also request access to, correction of, deletion of, or a portable copy of your personal information, and limit the use of sensitive personal information. Contact us using Section 9; we will verify your identity and respond within 45 days, extendable once where the law allows. An authorised agent may act for you with written permission.
We will never deny you service, charge a different price, or give you a lower quality of service because you exercised a privacy right.
8. Changes to This Policy
We update this policy whenever the cookies we use change. When a change is material — a new category, or a new provider in an existing one — we reset stored consents and ask again, rather than relying on a choice you made about something else. This version is effective 16 August 2026.
9. Contact Us
For anything about cookies, this policy, or a privacy request:
- Email: info@croatianroots.net
- Address: Vlaška ulica 84, 10000 Zagreb, Croatia
- OIB: 87270323473
- Web: Contact form