Cookies and Similar Technologies Policy

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, remember your preferences, and provide information to site owners.

Local storage and similar technologies (such as localStorage and sessionStorage) serve a similar purpose — they allow the website to store data locally on your device. Unlike cookies, they are not sent with every HTTP request and can hold more data.

On this website, we use these technologies to ensure the site functions correctly, to remember your consent choices, and — with your permission — to measure site usage and deliver relevant advertising.

1. Strictly Necessary

Required for the website to function and to save basic user settings (language preference, consent choice). These technologies are always active and cannot be disabled through the consent toggle. They do not track you across websites and do not send any data to third parties. Specifically, we store: your language preference (lang in localStorage), your consent choice (penger_consent in localStorage), and your order configuration (penger_order in sessionStorage — temporary data used to carry your selected product options between checkout pages, automatically cleared when you close the browser tab or after a successful purchase).

2. Analytics

Used to measure visits, events, user behavior, and traffic quality. These technologies are only activated after you give explicit consent. Analytics data helps us understand which pages are visited, how users navigate the site, and where they experience friction. We use this data solely to improve the website experience — we do not build personal profiles or sell this data. All analytics data is aggregated and we do not attempt to identify individual users.

3. Marketing

Used for advertising measurement, remarketing, and matching ad campaigns. These technologies are only activated after you give explicit consent. The "strictly necessary" exception does not apply to advertising purposes. Marketing technologies allow ad platforms to measure whether an ad click led to a website visit or purchase, and to show you relevant ads on other platforms. When enabled, these technologies may set cookies that can track your activity across different websites.

Below is a comprehensive and transparent breakdown of every type of data that may be collected when you visit our website. We want you to know exactly what is captured, by whom, and for what purpose.

Always collected (strictly necessary, no consent required):

• Language preference — your selected language (en/uk), stored in localStorage on your device. Never sent to any server.
• Consent state — your cookie consent choices (which categories you accepted/rejected), stored in localStorage under the key penger_consent. Includes timestamp, policy version, and per-category status. Never sent to any external server.
• Google Consent Mode signals — when GTM loads, it reads your consent state and sets Google Consent Mode parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) to 'granted' or 'denied'. These signals are sent to Google to control tag behavior.

Collected only with analytics consent:

• Page views — the URL and title of every page you visit on our site, sent to Google Analytics and Microsoft Clarity.
• Referrer — the URL of the page that linked you to our site (e.g., a Google search results page or a social media post).
• Campaign parameters (UTM) — if you arrived via an ad or campaign link, the UTM tags in the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content) are captured by Google Analytics.
• Session information — a randomly generated session ID, session start time, number of sessions, and whether this is your first visit. Used to group your page views into a single browsing session.
• Client identifiers — randomly generated IDs stored in cookies (_ga, _ga_*, _gid, _clck). These are not your real identity — they are random strings used to distinguish one browser from another. Example: GA1.1.1234567890.1710000000.
• Device and browser information — device category (desktop, mobile, tablet), operating system name and version, browser name and version, screen resolution, viewport size, device language setting.
• Approximate geolocation — your country and city, derived from your IP address by Google and Microsoft. Your IP address is not stored in Google Analytics 4 reports. Microsoft Clarity uses IP for session-level geo but does not expose it in dashboards.
• User interactions — clicks (which elements you click on), scroll depth (how far down you scroll expressed as a percentage), engagement time (how long the page was actively in the browser foreground), outbound link clicks (links that take you away from our site), file downloads.
• Mouse and touch movement — Microsoft Clarity records cursor movement coordinates and touch gestures to generate heatmaps and session recordings. This shows where users tend to look and interact on the page.
• Session recordings — Microsoft Clarity captures a replay of your browsing session as a series of DOM changes. All text typed into input fields is automatically masked and not recorded. The recording shows page layout, scrolling, clicks, and navigation — not personal input.
• UX quality signals — Clarity detects rage clicks (repeated fast clicks on the same area), dead clicks (clicks on non-interactive elements), excessive scrolling, and JavaScript errors. These help us identify broken or confusing UI elements.
• Page performance — page load timing, time to first byte, DOM content loaded time. Helps us optimize site speed.

Collected only with marketing consent:

• Meta Pixel events — when marketing consent is granted, the Meta Pixel fires a PageView event on every page load. This sends the page URL, referrer, and a browser identifier (_fbp cookie) to Meta's servers.
• Ad click identifiers — if you arrived from a Facebook/Instagram ad, the fbclid parameter from the URL is captured and stored in the _fbc cookie. This links your website visit to the specific ad you clicked.
• Cross-site identifiers — Meta may set third-party cookies (e.g., fr on facebook.com) that can link your visit to our site with your activity on Facebook, Instagram, and other sites that use Meta Pixel. This is how Meta builds advertising audiences.
• IP address (by Meta) — Meta receives your IP address as part of the Pixel request. Meta uses it for geo-targeting and fraud detection, and may hash and store it.
• Browser fingerprint signals (by Meta) — user agent string, Accept-Language header, screen resolution, and timezone are sent with the Pixel request. Meta may use these to improve ad targeting accuracy.

What we do NOT collect: We do not collect your name, email address, phone number, physical address, or any other directly identifiable personal information through cookies or tracking technologies. We do not use tracking technologies on any forms. We do not engage in browser fingerprinting on our own. We do not sell your data to anyone. The randomly generated identifiers in cookies are not linked to your real identity in our systems.

Before you make a consent choice, only strictly necessary components are loaded (site functionality and the consent management script).

Analytics and marketing technologies are not activated until you explicitly grant consent. No tracking scripts run, no third-party cookies are set, and no data is sent to analytics or advertising providers before your choice.

After you make your choice, the consent state is saved to localStorage and applied to all tags via Google Consent Mode v2. Here is exactly what happens for each consent scenario:

• You reject all (or close the banner): Only the GTM container script runs. Google Consent Mode signals are set to 'denied'. GA4 may send cookieless pings (without identifiers) for basic measurement, but no cookies are set and no personal data is collected. Clarity and Meta Pixel are not loaded at all.
• You accept analytics only: GA4 starts collecting data and sets _ga, _ga_*, _gid cookies. Microsoft Clarity loads and begins session recording with _clck and _clsk cookies. Meta Pixel is not loaded. No marketing data is sent.
• You accept marketing only: Meta Pixel loads and sends PageView events, setting _fbp cookie. GA4 and Clarity remain in consent-denied mode (no analytics cookies set).
• You accept all: All technologies load — GA4 with full analytics, Clarity with session recordings, and Meta Pixel with conversion tracking. All corresponding cookies are set.

You can change your cookie and technology preferences at any time by clicking Cookie Settings in the site footer. This reopens the settings panel where you can enable, disable, or fully withdraw consent for analytics and marketing technologies.

You can withdraw your consent just as easily as you gave it. When you withdraw consent, analytics and marketing cookies are deleted immediately and the corresponding scripts stop running.

Your choice is respected across the entire website for the duration of the consent storage period.

Browser Settings

You can also manage cookies through your browser settings. Most browsers let you block or delete cookies. Check your browser's help documentation for instructions. Note that blocking all cookies may affect site functionality.

Your consent state is stored in your browser's localStorage under the key penger_consent. It includes your choices for each category (necessary, analytics, marketing), a timestamp, and the current policy version.

The consent state is valid for 12 months from the date of your last choice. After this period, the consent banner will reappear so you can review and update your preferences.

If the policy version changes (for example, when we add or remove services), the consent banner will be shown again regardless of the expiration period, so you can make an informed choice based on the updated policy.

When you consent to analytics or marketing technologies, data is processed by the following third-party providers. Each provider processes data under their own privacy policy. We do not sell or share your data with any other parties beyond those listed below.

• Google LLC (Google Tag Manager, Google Analytics 4) — headquartered in Mountain View, CA, USA. Processes analytics data on Google Cloud infrastructure. Data may be stored in the US and other countries where Google operates data centers. Google acts as a data processor on our behalf for GA4 data. — Privacy Policy | GA4 Data Practices
• Microsoft Corporation (Microsoft Clarity) — headquartered in Redmond, WA, USA. Session recording and heatmap data is processed on Microsoft Azure infrastructure. Microsoft may process data in the US, Europe, and other regions. — Privacy Statement | Clarity Cookie Consent
• Meta Platforms, Inc. (Meta Pixel) — headquartered in Menlo Park, CA, USA. Advertising and conversion data is sent to Meta's servers. Meta may use this data to improve its advertising products, including showing you targeted ads on Facebook and Instagram. Meta acts as an independent data controller for some of this data, meaning Meta determines its own purposes for processing. — Privacy Policy

Important: Once data is sent to a third-party provider, it is subject to that provider's privacy policy and data handling practices, which are outside our direct control. We encourage you to read their policies. We have selected these providers carefully and configured them to minimize data collection where possible.

Our website is hosted and operated from Europe. However, when you consent to analytics or marketing technologies, your data may be transferred to and processed in the United States and other countries where our third-party providers operate data centers.

Specifically: Google (GA4, GTM) and Meta (Pixel) are US-based companies. Data sent to these services may cross international borders. These providers rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), and other legal mechanisms for lawful data transfers.

Microsoft (Clarity) processes data on Azure infrastructure which has data centers worldwide, including in the EU. Microsoft relies on SCCs and the EU-US Data Privacy Framework for transfers outside the EEA.

By granting consent to analytics or marketing technologies, you acknowledge that your data may be transferred to and processed in countries outside your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.

Depending on your location, you may have the following rights regarding data collected through cookies and similar technologies:

• Right to withdraw consent — you can withdraw your consent at any time by clicking "Cookie Settings" in the footer. This is as easy as giving consent. When withdrawn, tracking stops immediately and cookies are deleted.
• Right to information — you have the right to know what data is collected about you. This policy provides that information in full detail.
• Right to deletion — you can delete all cookies at any time through your browser settings or by withdrawing consent (which automatically deletes analytics and marketing cookies).
• Right to object — by not granting consent, you effectively exercise your right to object to analytics and marketing data processing. No data is collected without your explicit consent.

To exercise any of these rights or for any questions, contact us at [email protected].

We may update this policy when we add or remove services, change data processing practices, or when regulations change.

Any updates will be posted on this page with a new policy version number and last updated date.

When the policy version changes, the consent banner will reappear so you can review the changes and update your preferences.

PENGER

If you have questions about our use of cookies and similar technologies, or about this policy, contact us:

[email protected]