Cookie Policy

This Cookie Policy explains which cookies and similar technologies this website uses, why we use them, how long they last and how you can control them. For how we handle personal data in general, see our Privacy Policy.

Last updated: 11 October 2026

1. What cookies are

Cookies are small text files that a website saves on your device. Similar technologies, such as tracking pixels and scripts that read or write information on your device, work in a comparable way. Some are needed for a site to work securely. Others measure how a site is used or how advertising performs, and these need your permission first.

2. How we handle your choice

• Optional tools stay off until you agree. Analytics and advertising tools are not loaded, and their cookies are not set, until you choose "Accept all" in the cookie notice.
• Accept and reject are equally easy. If you reject, or do not answer, the optional tools stay off.
• Browser privacy signals are respected. If your browser sends a Global Privacy Control or Do Not Track signal and you have not made a choice, we treat it as a refusal of optional cookies.
• Google consent signals. Where Google tools are used, they start in a "denied" state for analytics and advertising storage and change to "granted" only if you accept.
• You can change your mind at any time with the "Cookie settings" link in the footer. If you withdraw consent, the tools are told to stop and their cookies are removed from this website.
• No notice means no optional tools. The cookie notice appears only when the company has set up analytics or advertising tools. If none are set up, no optional cookie is used.

3. Cookies and technologies we use

3.1 Strictly necessary

These keep the website secure or remember your choice. They do not need consent and cannot be switched off in the cookie notice.

• consent (first-party): stores your cookie choice (granted or denied) so we do not ask again on every page. It holds nothing else. It lasts about 180 days.
• Staff sign-in session (first-party, named __Host-gs): set only when a member of our team signs in to the administration area. It keeps them signed in securely, is not readable by scripts, and lasts up to 7 days or until they sign out.
• Staff two-step verification (first-party, named __Host-gs-mfa): set only during staff two-step sign-in. It is short-lived, lasting a few minutes, and is deleted once sign-in is completed.

Visitors who only browse the public website do not receive the staff cookies.

3.2 Security and bot protection

• Cloudflare Turnstile is used on the contact page to check that a message is sent by a person and not by a bot. It loads only on that page. It is provided by Cloudflare and works under Cloudflare's own privacy terms. Cloudflare also protects the website against attacks and may process technical request data for that purpose.

3.3 Analytics (only with your consent)

• Google Tag Manager and Google Analytics 4, if the company has set them up, load only after you accept. Google Analytics typically sets cookies such as _ga and _ga_<ID> (up to about 2 years) and may set _gid and _gat (about 1 day and 1 minute). They help us understand which pages are visited and how people move through the site. We use the results in aggregate to improve the website.

3.4 Advertising and measurement (only with your consent)

• Google advertising tags loaded through Google Tag Manager may set cookies beginning with _gcl_ (up to about 90 days) to measure the result of ads.
• Meta Pixel, if the company has set it up, loads only after you accept. It may set _fbp and _fbc (up to about 90 days) to measure how our advertising performs and to show our ads to people who have visited the site. Meta may combine this with data it already holds, under its own policies.

Exact names and durations are set by the providers and can change. The durations above are the usual ones.

3.5 What we do not do

Analytics and advertising tools are never loaded for staff who are signed in to the administration area, and the public website uses no other cookies than those listed here.

4. Third-party cookies

Google, Meta and Cloudflare set and control their own cookies and handle data under their own policies. You can read them at policies.google.com, facebook.com/privacy/policy and cloudflare.com/privacypolicy.

5. How to manage cookies

• On this website: use the "Cookie settings" link in the footer to accept, reject or change your choice at any time.
• In your browser: most browsers let you block or delete cookies. Blocking strictly necessary cookies does not affect browsing the public website, but staff sign-in will stop working.
• Opt-out tools: you can use the Google Analytics opt-out browser add-on and your advertising settings in your Google and Meta accounts.
• Deleting existing cookies: changing your choice stops new optional cookies. To remove ones already stored, delete them in your browser settings.

6. Changes to this policy

We may update this policy when the cookies or tools we use change. The "Last updated" date shows the latest revision. If a change adds a new kind of optional cookie, we will ask for your choice again.

7. Contact

Questions about cookies or data privacy can be sent to our Grievance Officer at grievance.officer@grocito.com. For general support, write to support@grocito.com.