Cookie Policy
Last updated: 25 July 2026
This policy explains the cookies and similar technologies that remain active on Cozelia, their purposes, providers, duration and the controls available through browsers and third-party providers.
Cozelia is an e-commerce brand owned and operated by Union s.r.o. The Website uses technical, analytics, advertising, conversion-attribution and anti-fraud technologies to operate the store, protect Orders and measure advertising.
1. What cookies are
Cookies are small text files stored on a device when a website is visited. Similar technologies include local storage, pixels, tags, software development kits and identifiers that can store or read information from a browser or device.
- First-party cookies are set by the Cozelia website.
- Third-party cookies are set by another domain, such as a service provider or advertising platform.
- Session cookies expire when the browser session ends.
- Persistent cookies remain until their stated expiry date or until they are deleted.
2. Current website status
Current implementation. Google Analytics 4, Google Tag Manager, Google Signals, Google Ads, first-party CRM journey measurement and Traffic Manager are configured as a continuously active measurement, advertising-attribution and anti-fraud stack. Cozelia does not display a cookie-choice banner and does not provide a website control that disables these technologies. A previously stored cz-consent value is no longer read or applied. Meta Pixel and Meta Conversions API support exists in the software but is not currently configured in production and therefore does not presently transmit events; if activated later, it will form part of the same continuous stack and this policy must be updated accordingly.
3. Why e-commerce measurement matters
Cozelia uses campaign, conversion and device identifiers to understand how visitors reach the Website, protect order forms against abuse, prevent duplicate Orders, reconcile order status and measure the effectiveness of advertising. Contracted technology and order-processing providers may receive the limited identifiers required to perform those functions on behalf of Union s.r.o.
4. Controller
The controller for first-party processing on Cozelia is Union s.r.o., IČO 55374522, with registered office at Pri smaltovni 3603/4, Mestská časť Petržalka, 851 01 Bratislava, Slovakia. Contact: marek@unionsrosl.com. Third parties act under their own terms where they determine the purposes and means of their processing.
5. Categories of technology
5.1 Strictly necessary technologies
These technologies support core operation, security and privacy choices. They do not require consent where they are strictly necessary to provide a service requested by the user.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| cozelia-device-id-v1 (local storage) | Creates a random first-party device correlation token used for order deduplication, fraud prevention and technical reconciliation; it is not derived from canvas, audio, fonts or contact details | Until deleted from the browser | Cozelia |
| Security and load-balancing identifiers | Protect the website, route traffic and prevent abuse where required by the hosting provider | Session or short-lived | Hosting and security provider |
5.2 Functional technologies
Functional technologies remember optional settings that improve convenience. They are activated only when used and where the applicable legal basis permits.
| Example | Purpose | Typical duration | Provider |
|---|---|---|---|
| Interface preferences | Remember optional display, region or language settings | Up to 12 months | Cozelia |
| Embedded-service preferences | Enable optional media or interactive components | According to the service | Relevant third party |
5.3 Analytics technologies
Analytics tools remain active from the start of each visit to measure use, page performance, navigation and audiences.
| Example | Purpose | Typical duration | Provider |
|---|---|---|---|
| _ga | Distinguishes browsers for Google Analytics reporting | Up to 2 years | Google Ireland Limited |
| _ga_* | Maintains session and measurement state | Up to 2 years | Google Ireland Limited |
5.4 Advertising and remarketing technologies
Configured advertising technologies remain active from the start of each visit to measure campaigns, limit repeated advertising, create remarketing audiences or exclude people who have already completed a relevant action. Google Signals may associate measured website activity with information from signed-in Google users who have enabled Ads Personalization and consented to that association through their Google Account controls. The Meta technologies listed below describe implemented capabilities but remain inactive until a valid Pixel ID and, for server transmission, an access token are configured.
| Example | Purpose | Typical duration | Provider |
|---|---|---|---|
| _gcl_* | Stores Google advertising click information for attribution and conversion measurement | Typically up to 90 days | Google Ireland Limited |
| Google Signals | Supports cross-device measurement, aggregated audience insights and advertising personalisation for eligible signed-in Google users | According to Google Analytics retention settings and the user's Google Account controls | Google Ireland Limited |
| Google Analytics audiences | Groups product views, offer interactions, form starts, accepted leads and accepted orders for remarketing, suppression and retention use; form contents are not included | Audience membership is configured between 7 and 180 days | Google Ireland Limited |
| _fbp | Distinguishes browsers for Meta advertising delivery, attribution, frequency control and measurement | Typically up to 90 days | Meta Platforms Ireland Limited |
| _fbc | Stores Meta advertising click information when a visitor arrives through a Meta ad | Typically up to 90 days | Meta Platforms Ireland Limited |
| Meta Conversions API | Sends selected website and accepted form events from the server. Contact identifiers used for matching are normalised and one-way hashed before transmission; free-text messages and payment-card data are not sent | No browser storage; event retention follows Meta's current settings and policies | Meta Platforms Ireland Limited |
5.5 Order security and conversion-attribution technologies
For Orders submitted through Cozelia, the server may transmit the order fields required for processing together with IP address, User-Agent, campaign parameters and pseudonymous order or device identifiers for routing, deduplication, fraud prevention, advertising measurement and status reconciliation. The Traffic Manager script is active throughout Cozelia as an essential fraud-prevention and conversion-attribution control. It derives browser and device signals and may create a rendered image of the current page before producing the tmfp value.
| Technology | Purpose | Duration | Provider |
|---|---|---|---|
| Traffic Manager tmfp | Fraud prevention, traffic-source verification, conversion attribution and order deduplication throughout Cozelia | The form value lasts for the page session; provider-side retention follows the service provider's current policy | Third-party Traffic Manager infrastructure |
The exact names and duration used by a third party may change. The third party's current documentation controls for technologies on its domain.
6. Continuous operation and condition of use
By accessing, browsing or using Cozelia or any of its e-commerce functions, the user acknowledges and accepts that the technical, analytics, advertising, conversion-attribution and anti-fraud technologies described in this policy remain continuously active and may process device, browser, network, navigation and campaign data. Use of the Website and its e-commerce functions is conditional upon those technologies remaining enabled.
This contractual acknowledgement does not exclude, restrict or waive any right or protection that cannot lawfully be excluded, restricted or waived. In any jurisdiction where prior consent remains legally mandatory for a specific technology or purpose, a statement of acceptance through continued use may not by itself replace the consent required by applicable law.
7. Browser and third-party controls
7.1 Browser settings
Most browsers allow users to inspect, block and delete cookies or site data. Relevant controls are generally available under privacy, security or site-data settings. Blocking all storage may affect essential website features.
- Google Chrome: Settings → Privacy and security → Third-party cookies or Site data.
- Mozilla Firefox: Settings → Privacy & Security.
- Apple Safari: Settings → Privacy.
- Microsoft Edge: Settings → Cookies and site permissions.
7.2 Third-party controls
8. International transfers
Some providers may process data outside the European Economic Area. Where applicable, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful safeguard under the GDPR. Further information is available in each provider's privacy documentation.
9. Retention
Each technology is retained only for the period stated above or in the current provider documentation, unless it is deleted earlier. Technical and compliance records may be kept for the period needed to operate, secure and document the Website.
10. Children
The website is not designed to profile children. Parents and guardians should configure browser and device controls appropriate to the child's age and contact us if they believe data has been collected inappropriately.
11. Updates
We may update this policy when technologies, providers or legal requirements change. The date above identifies the current version.
12. Privacy Policy and contact
This Cookie Policy forms part of the Privacy Policy, which explains the legal bases, recipients, retention periods and data-subject rights in more detail. Questions may be sent to marek@unionsrosl.com.