Cookie Usage Policy

Acnova Oy uses cookies and similar technologies on its website acnova.eu.

We process data in accordance with:

• the EU General Data Protection Regulation (GDPR)

• the ePrivacy Directive

• Finnish legislation on data protection and electronic communications

A cookie is a small text file stored on your device when you visit a website.

Browser storage (localStorage and sessionStorage) works in a similar way: the website also writes data to it on your device, but unlike cookies, the browser does not send this data to the server by itself. Everything this policy says about cookies also applies to such entries unless stated otherwise (the entries are listed in section 3.5).

Cookies allow us to:

• ensure the website functions properly

• maintain security

• save user preferences

• process orders

• analyze user behaviour

• assess marketing effectiveness (with your consent — see sections 3.2 and 3.4)

• display embedded Google Maps (with your consent — see section 3.3)

• show Acnova ads in Meta services to visitors of our website (with your consent — see section 3.4)

3.1 Strictly necessary cookies (Essential)

Used for:

• remembering your chosen website language

• logging into your account and keeping you signed in

• shopping cart functionality

• checkout

• protection against CSRF attacks

• storing your cookie consent choice

• operating the chat on the website

These cookies are mandatory and do not require consent.

Legal basis: Article 6(1)(f) GDPR — legitimate interest.

No consent to storing and reading them is required under section 205 of the Finnish Act on Electronic Communications Services (917/2014) either, because the services of the website that you request cannot be provided without them.

We ourselves set the following strictly necessary cookies under the acnova.eu domain:

• NEXT_LOCALE — Acnova Oy; remembers your chosen website language; strictly necessary / preference; 1 year
• website_cookies_bar — Acnova Oy; stores your choice in the cookie banner: your decision for each category, the banner version and the time of your choice, and may also contain a random number for this decision that contains no information about you (the website uses it to take account of a withdrawal of consent, for example by not sending a purchase to analytics after withdrawal); strictly necessary / consent; 182 days
• acnova_portal_core_token — Acnova Oy; confirms that you are signed in to your customer account; strictly necessary / sign-in; 5 minutes, renewed automatically while you remain signed in
• acnova_portal_core_refresh — Acnova Oy; renews your sign-in session so that you do not have to enter your password again; strictly necessary / sign-in; 30 days from the last session renewal
• acnova_portal_core_2fa — Acnova Oy; holds an unfinished sign-in step with two-factor verification (without the code or password); strictly necessary / security; up to 5 minutes
• acnova_oauth_state — Acnova Oy; protects sign-in via Google, Facebook or Microsoft against request forgery (CSRF); strictly necessary / security; 10 minutes
• acnova_hanna — Acnova Oy; ensures that your chat conversation can be opened only in the browser from which you wrote; strictly necessary / chat; 24 hours

NEXT_LOCALE is set on your first visit, website_cookies_bar when you make a choice in the banner, the sign-in cookies when you sign in to your account, and acnova_hanna when you first write in the chat. All of these cookies are sent only over a secure connection (Secure); the sign-in and chat cookies cannot be accessed by scripts on the page (HttpOnly). When you sign out of your account, the sign-in cookies are deleted.

In the internal staff area of the website, Acnova employees who have signed in also receive service cookies and browser storage entries of that area (employee sign-in, work settings and drafts). They are not created for visitors or customers.

The following strictly necessary cookies are set by our security and content-delivery partner Cloudflare, Inc. (they do not require consent):

• __cf_bm — Cloudflare, Inc.; bot management: distinguishes automated requests (bots) from humans to protect the site; strictly necessary / security; ~30 min
• cf_clearance — Cloudflare, Inc.; stores confirmation that a security check (challenge/CAPTCHA) was passed, so it is not shown again; strictly necessary / security; up to ~1 year

3.2 Analytics cookies (Google Analytics 4)

We use Google Analytics 4 (GA4) to compile statistics on how the website is used and to improve the website on that basis. We use the results only in the form of aggregated statistics.

Google Analytics uses the following cookies, which are stored under the acnova.eu domain:

• _ga — Google Ireland Limited; distinguishes visitors' browsers from one another for usage statistics; analytics; 2 years
• _ga_4MLSMRKGJ7 — Google Ireland Limited; stores the state of the visit (session) for usage statistics; analytics; 2 years

These cookies are set, and the Google tag is loaded, only after you switch on “Analytics (Google Analytics)” in the cookie banner or accept all cookies. Until then, the Google tag is not loaded and no analytics data is sent to Google (Google Consent Mode v2, basic mode).

We do not use Google advertising cookies. The advertising signals of Google Consent Mode (ad_storage, ad_user_data, ad_personalization) always remain disabled, whatever you choose in the banner. Google signals and ad personalization are switched off.

Once you have given consent, Google Analytics may collect:

• browser and device data

• information about your behaviour on the website

• traffic sources

• approximate geographic location

In particular, we measure:

• page views

• purchases (amount, currency and products by their public item number)

• clicks on phone and email links (without the number or address itself)

• submissions of request forms

The internal staff area of the website is not tracked. The events sent to Google do not contain your name, email address or phone number.

If you have consented to analytics, Acnova’s server may itself send Google Analytics the fact that an order has been paid (order or invoice number, amount, products), linked to the Google Analytics browser identifiers (the _ga and _ga_4MLSMRKGJ7 cookies); without consent to analytics, this is not sent. After consent is withdrawn, no such transfer takes place.

According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is used to determine approximate location.

For transfers of data outside the EU, see section 4.

Legal basis: Article 6(1)(a) GDPR — consent.

Storing and reading cookies on your device also requires your consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014).

3.3 Map cookies (Google Maps)

Some pages of the website — for example the home page, the contact page and the “Pickup locations” and “Find a Specialist” pages — contain embedded Google Maps.

Until you enable maps in the cookie banner or click the “Show map” button, the map is not loaded: a placeholder with this button is shown instead. Until then, your browser does not contact Google for the map, and Google cannot set or read its cookies through the map on our website.

The map is loaded:

• automatically on all pages with a map, if you have switched on “Maps (Google Maps)” in the cookie banner or accepted all cookies
• once, if you click “Show map” on a particular page: by clicking, you consent to loading only that map; this consent applies until you leave the page and is not saved in your cookie settings

When the map is loaded, your browser connects directly to Google’s servers. Google receives your IP address, information about your browser and device and the address of the page in which the map is embedded, and may set or read its own cookies under its domains (for example google.com). These are third-party cookies: they are set and controlled by Google, not by Acnova Oy, and we cannot read or delete them. According to Google, they may include in particular:

• NID — Google Ireland Limited; remembers your preferences in Google services, such as language (according to Google, it may also be used to show ads in Google services to users who are not signed in); maps / third-party; 6 months from last use
• __Secure-ENID — Google Ireland Limited; remembers your preferences in Google services (used instead of NID depending on your cookie choices at Google); maps / third-party; 13 months
• AEC — Google Ireland Limited; detecting spam, fraud and abuse; maps / third-party; 6 months
• SOCS — Google Ireland Limited; stores your choices regarding Google cookies; maps / third-party; 13 months

If you are signed in to your Google account, Google may also read the cookies of that account (for example SID and HSID, retention 2 years). Which cookies are actually set is determined by Google, which may change their set and retention; it also depends on your browser’s settings for third-party cookies. More information: policies.google.com/technologies/cookies. Google further processes this data under its own privacy policy: policies.google.com/privacy.

For transfers of data outside the EU, see section 4.

Legal basis: Article 6(1)(a) GDPR — consent.

Loading the map and storing Google cookies on your device also requires your consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014).

3.4 Marketing cookies (Meta Pixel)

If you have switched on “Marketing” in the cookie banner or accepted all cookies, the Meta Pixel, a tool of Meta Platforms Ireland Limited, runs on the website. We use it to measure the effectiveness of our advertising in Meta services (for example Facebook and Instagram) and to show Acnova ads to people who have visited our website (retargeting).

Until you give your consent, no Meta code is loaded, no data is sent to Meta and no pixel cookies are set. If you have not given consent but pixel cookies or pixel entries in browser storage remain on your device from earlier visits, the website deletes them.

The pixel stores the following cookies under the acnova.eu domain:

• _fbp — Meta Platforms Ireland Limited; a unique identifier of your browser by which Meta recognises it on repeat visits; marketing; 90 days from the last update
• _fbc — Meta Platforms Ireland Limited; the identifier of a click on a Meta ad link (set only if you came to the website via such a link — with the fbclid parameter in the address); marketing; 90 days from the last update

The Meta script may also save its own technical entries in browser storage (localStorage) under the acnova.eu domain — multiFbc, lastExternalReferrer and lastExternalReferrerTime: for example, which site you came from (Facebook, Instagram, another site or none) and when, and information about a click on a Meta ad link. Meta may receive this information together with the pixel events. Like the pixel cookies, these entries are created only with your consent to “Marketing”; if you refuse or withdraw consent, the website deletes them together with the _fbp and _fbc cookies.

The pixel sends the following events to Meta:

• page view
• product page view: public item number, product name, price excluding VAT and currency (the price only if it is shown to you)
• adding a product to the cart: public item number, product name, quantity, amount excluding VAT and currency
• successful submission of a form on the website (for example the contact form or a PRO account request): only the type of form, without the data you entered
• placing an order (once payment is confirmed or an order to be paid by invoice is created): public item numbers and quantities of the products, total number of items, amount excluding VAT and currency, and the order or invoice number — only as a technical event identifier, so that one purchase is not counted twice

With each event, Meta receives, in particular, the pixel ID, the address of the page and of the page you came from, the time of the event, the screen size, the values of the _fbp and _fbc cookies and — as with any request from your browser to a server — your IP address and browser information. Meta may match this data with your Meta account, if you have one.

Your name, email address, phone number and postal address are not sent to Meta: advanced matching is not used, and the pixel’s automatic collection of data from pages is switched off.

The pixel sends no events in the customer account area (including the sign-in and registration pages), in the internal staff area of the website or on the invoice payment page opened via a link. Nor does it send them while the address of the page, or of the page you came from, contains parameters other than advertising campaign tags (for example utm_source, gclid or fbclid) — so that technical data from the address does not reach Meta.

We and Meta Platforms Ireland Limited are jointly responsible (joint controllers under Article 26 GDPR) for collecting data through the pixel on our website and transmitting it to Meta. Under our agreement with Meta, we inform you about this processing and obtain your consent, while Meta ensures your rights regarding the data that Meta stores after the transmission. You can exercise your rights with us or with Meta. The essence of the agreement: facebook.com/legal/controller_addendum.

Meta further processes this data as an independent controller under its own privacy policy: facebook.com/privacy/policy. About Meta cookies: facebook.com/privacy/policies/cookies.

For transfers of data outside the EU, see section 4.

Legal basis: Article 6(1)(a) GDPR — consent.

Storing and reading the pixel cookies on your device also requires your consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014).

3.5 Browser storage

In addition to cookies, the website saves the following entries in your browser storage (localStorage and sessionStorage):

• acnova-cart-v1 — localStorage; the contents of your shopping cart; until deleted (the cart is emptied once the order is placed)
• acnova-cart-id-v1 — localStorage; a random cart number (created when you first add a product to the cart) that prevents the same cart from turning into a second order when you check out again; until the order is placed
• acnova-checkout-address-v1 — localStorage; recipient details entered at checkout (name, address, email, phone), so that you do not have to enter them again; until the order is placed, but no longer than 30 days from the last save (an older draft is deleted without being shown the next time you open any page of the website)
• acnova-shipping-selection-v2 — localStorage; your chosen delivery method and pickup point, and the postcode for which the delivery price was calculated; until the order is placed
• acnova-shipping-country-v1 — localStorage; your chosen country of delivery; until deleted
• acnova.promo.v1 — localStorage; the promo code you applied; until the order is placed or the promo code is removed
• acnova-checkout-attempt-v2 — sessionStorage; the number of the current checkout attempt, so that clicking the button again does not create a second order; until the order is placed or the tab is closed
• acnova:checkout-params — sessionStorage; the order confirmation page parameters (payment session number, order or invoice number), which the website removes from the page address, so that the status of your order can be shown after the page is reloaded; until the tab is closed (the entry is no longer used after 30 minutes)
• acnova-wishlist-v1, acnova-compare-v1 — localStorage; your list of favourite products and your comparison list; until deleted
• acnova-shop-prefs-v1, acnova:catalog:lastSection, ac-filters-open:… — localStorage; shop display settings: prices with or without VAT, product list view and density, the last catalogue section opened, expanded filter groups; until deleted
• ac-infinite-scroll:… — sessionStorage; your position in the product list, so that it opens at the same place when you go back; until the tab is closed
• acnova:chunk-reload-at — sessionStorage; the time of an automatic page reload after a website update, so that the reload is not repeated in a loop; until the tab is closed
• ac_maint_lang — localStorage; the language of the page that we show while the website is being updated; until deleted
• acnova_hub_sid, acnova_hub_rated — localStorage; the number of your conversation in the chat with Hanna (created only when you first use the chat) and a note that you have already rated the conversation; until deleted
• acnova_hub_nudge, acnova_hub_nudge_closes, acnova_hub_nudge_ignored — localStorage; when you closed or ignored a chat hint, so that it is not shown again for 7 or 30 days; until deleted
• acnova_hub_nudge_s, acnova_hub_nudge_g, acnova_hub_pbub, acnova_hub_pcta — sessionStorage; which chat hints have already been shown or closed during this visit; until the tab is closed
• acnova:purchase-snapshot:… — sessionStorage; the items and amount of the order you placed (without your name or contact details), so that the purchase can be counted in analytics and passed to the Meta Pixel once payment is confirmed (written only if you have consented to analytics or marketing); until the order is confirmed, but no longer than until the tab is closed
• ac_ga4_purchase_sent_… — sessionStorage; a note that the purchase has already been counted in analytics, so that it is not counted twice (written only if you have consented to analytics); until the tab is closed

The entries acnova:purchase-snapshot:… (for counting the purchase in analytics and passing it to the Meta Pixel) and ac_ga4_purchase_sent_… (for analytics) serve optional purposes; the other entries are needed for the cart, checkout, the catalogue, the chat and the page we show while the website is being updated, and are strictly necessary (see section 3.1).

Here, “the order is placed” means the moment when the order confirmation page shows that the payment has been confirmed or is being processed, or that an order to be paid by invoice has been created. localStorage entries for which no period is given are kept until the website or you delete them (in your browser settings, by deleting the site data). sessionStorage entries are deleted when you close the tab. The browser does not send these entries to the server by itself: the website uses them on your device and sends their content to the server only when this is needed for a feature you are using, for example the cart, checkout or the chat. Purchase information is sent to analytics and to Meta only with your consent (see sections 3.2 and 3.4).

3.6 Visiting the websites of other companies

Scripts of payment providers are not loaded on the pages of acnova.eu, and their cookies are not set under the acnova.eu domain. Of social network scripts, only the Meta Pixel is loaded, and only with your consent (see section 3.4). When you proceed to payment, the Stripe payment page (checkout.stripe.com) opens; when you sign in via Google, Facebook or Microsoft, the sign-in page of the chosen service opens. On their own pages, these companies set their own cookies under their own rules. Links to our pages on social networks are ordinary links: the link itself gives the social network data about you only if you follow it.

Google and Meta may process data on servers outside the European Union, including in the United States.

Transfers are made on the basis of:

• Standard Contractual Clauses (SCC)

• EU–US Data Privacy Framework (where applicable)

We have entered into the necessary contractual arrangements to ensure data protection.

• Session cookies are deleted when you close your browser

• Analytics cookies (_ga, _ga_4MLSMRKGJ7) are stored on your device for 2 years, unless you delete them earlier; if you withdraw your consent, the website deletes them itself

• In Google Analytics, event data is retained for 2 months (aggregated reports without visitor identifiers may be kept longer) and user data for 14 months; the 14-month period is renewed each time the visitor is active on the website again

• The consent cookie (website_cookies_bar) is stored for 182 days, after which the cookie banner will ask you again. We keep the log of your decisions in the banner, which confirms the choice you made, for 365 days; your IP address and browser data are stored in it only in hashed form

• Meta Pixel cookies (_fbp, _fbc) are stored on your device for 90 days from the last update, unless you delete them earlier; if you withdraw your consent, the website deletes them itself. Meta retains the data received through the pixel under its own rules

• The retention periods of our other cookies are given in section 3.1, and those of browser storage entries in section 3.5

• Google Maps cookies are set by Google under its own domains, and their retention is determined by Google (see section 3.3)

When you first visit the website, you are offered to:

• Accept all cookies

• Reject non-essential cookies

• Configure cookie categories

In the cookie settings, essential cookies (“Essential”) are always on, while you can switch the “Analytics (Google Analytics)”, “Maps (Google Maps)” and “Marketing” categories on or off separately and confirm with “Save selection”.

A choice made before analytics was introduced does not extend to it: analytics is enabled only after your separate consent.

Consent to marketing given before this policy was updated is no longer valid: if you gave it, the cookie banner will ask you again, and the Meta Pixel will be loaded only after your new consent. If you did not allow marketing, you will not be asked again. Your choices regarding analytics and maps remain in effect until you change them.

You can change your settings at any time via the “Cookie settings” link in the website footer.

To withdraw your consent to analytics, click the “Cookie settings” link in the website footer, switch off “Analytics (Google Analytics)” and save your choice. The Google tag then immediately stops sending data and is no longer loaded, and the website deletes the analytics cookies (_ga, _ga_4MLSMRKGJ7) from your device. You can also delete cookies at any time in your browser settings.

To withdraw your consent to maps, likewise click the “Cookie settings” link in the website footer, switch off “Maps (Google Maps)” and save your choice. Maps are then no longer loaded automatically: the next time you open the page, the “Show map” button is shown again instead of the map. The website cannot delete cookies that Google has already set under its own domains — you can delete them in your browser settings.

To withdraw your consent to marketing, likewise click the “Cookie settings” link in the website footer, switch off “Marketing” and save your choice. The Meta Pixel then immediately stops sending data and is no longer loaded, and the website deletes the pixel cookies (_fbp, _fbc) and the pixel’s entries in browser storage from your device.

The “Reject all” button in the cookie settings withdraws your consent in all three categories at once: the Google tag and the Meta Pixel stop sending data, the website deletes their cookies (_ga, _ga_4MLSMRKGJ7, _fbp, _fbc) and the pixel’s entries in browser storage, and maps are no longer loaded automatically.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Under the GDPR you have the right to:

• access your data

• request rectification

• request erasure

• restrict processing

• withdraw consent

• lodge a complaint with a data protection authority

Supervisory authority in Finland: Data Protection Ombudsman (Tietosuojavaltuutettu).

Acnova Oy Email: [email protected] Phone: +358 9 424 513 15