Cookie Policy

This Cookie Policy describes the cookies and similar browser-storage entries used on autovig.eu (the "Site"), their purpose, the legal basis on which they are deployed, and how you can grant, refuse or withdraw consent. It complements our Privacy Policy and forms an integral part of it.

1. What a cookie or similar technology is

A cookie is a small piece of data that a website asks your browser to store. Some cookies live for a single browser session (session cookies); others persist across visits (persistent cookies). The same legal rules apply to other browser-storage mechanisms such as localStorage, sessionStorage, IndexedDB, web beacons, pixel tags or fingerprinting techniques. In this Policy, the term "tracker" covers all of them — this is the reading confirmed by the Court of Justice of the European Union in Planet49 (C-673/17).

2. Legal basis

The deployment of trackers on terminal equipment located in the European Union is governed by:

• article 5(3) of Directive 2002/58/EC (as amended by Directive 2009/136/EC), the "ePrivacy Directive";
• in Belgium, where the controller is established, article 10/2 of the Loi du 30 juillet 2018 relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel / Wet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens, which since 10 January 2022 has replaced article 129 of the Loi du 13 juin 2005 relative aux communications électroniques; equivalent national transpositions apply in your Member State of residence;
• where personal data is involved, articles 4(11), 6 and 7 of Regulation (EU) 2016/679 (GDPR).

These provisions require prior, specific, informed, freely given and unambiguous consent for any non-strictly-necessary tracker. Consent is interpreted in line with the rulings of the Court of Justice of the European Union in Planet49 (C-673/17) and Proximus (C-129/21), the EDPB Guidelines 05/2020 on consent and 03/2022 on deceptive design patterns, and the cookie guidance published by the Belgian Autorité de protection des données / Gegevensbeschermingsautoriteit (APD / GBA).

Two categories are exempted from prior consent under article 5(3) ePrivacy and the second subparagraph of article 10/2 of the Loi du 30 juillet 2018:

• trackers whose sole purpose is to carry out the transmission of a communication over an electronic-communications network;
• trackers strictly necessary to provide an information-society service explicitly requested by the user.

We classify each tracker under one of those exemptions or as consent-required, never both.

3. Categories used on autovig.eu

The Site groups trackers into the same three categories shown on the consent banner:

Strictly necessary

Required for the Site to load and for the consent banner itself to operate. Deployed without consent on the basis of the second exemption above. You cannot disable them without breaking core functionality.

Analytics

Loaded only after you click "Accept all" or save preferences with Analytics enabled.

• Google Analytics 4 counts pseudonymous page views and tells us which guides are useful.

Session analytics

Loaded only after you click "Accept all" or save preferences with Session analytics enabled.

• Microsoft Clarity records how pages are used — clicks, scrolling, heatmaps and session replays. Content typed into form fields is always masked. Microsoft states that it processes Clarity data as a data controller (section 7).

We do not use either tool for advertising, and we signal to Clarity that advertising storage is denied. If you decline a category, that script is not loaded. If you withdraw consent for a tool on a page where it is already running, we stop that tool and delete its first-party cookies on the Site.

No marketing or advertising trackers are used, so the banner offers no marketing category.

4. Inventory

The following inventory reflects the autovig.eu deployment at the date shown in the updatedAt field above. It is reviewed at every clean audit pass.

We do not deploy any tracker on the Site outside this inventory. If a new tracker is added, this Policy is updated before deployment and the consent banner re-asks consent where the new tracker is consent-required.

5. Consent capture

• A consent banner is shown on your first visit, before any non-strictly-necessary tracker is loaded. Strictly-necessary trackers may be deployed before consent.
• "Accept all" and "Reject all" are presented with equal prominence; refusing is one click, just like accepting. No pre-ticked boxes, no consent walls, no scroll-to-consent, no design pattern listed as deceptive in EDPB Guidelines 03/2022.
• Granular preferences are available behind the "Manage cookies" button on the banner: Analytics and Session analytics can each be accepted or refused on their own, and neither box is ever pre-ticked.
• Refusal does not degrade access to editorial content. The Site remains fully readable with all non-essential categories rejected.
• Your choice, and the version of this Policy under which you made it, are stored in the autovig.cookie-consent and autovig.cookie-preferences entries described in section 4, on your device only; we do not receive a copy. When the list of consent-required tools changes, the version changes and the banner asks you again.

6. Withdrawing consent — as easy as giving it

You can change or withdraw your choice at any time, in compliance with GDPR article 7(3) and EDPB Guidelines 05/2020 § 74 (withdrawal as easy as the initial consent):

• via the Cookie Preferences page (link permanently available in the footer);
• by clearing your browser’s site data, which will cause the banner to reappear on your next visit;
• by globally blocking cookies in your browser settings. Doing so does not break editorial content but the banner will reappear.

If you withdraw consent on a page where the analytics tools are already running, they are stopped straight away and their first-party cookies are deleted. Microsoft’s third-party cookies can only be removed through your browser settings.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Third-country transfers triggered by cookies

When the Google Analytics 4 script is loaded — only after you grant Analytics consent — Google Ireland Limited (Dublin, Ireland) acts as our processor under GDPR article 28. Personal data may be onward-transferred from Google Ireland Limited to Google LLC (Mountain View, United States) within the same group.

That transfer relies on the safeguards described in section 9 of our Privacy Policy: the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which Google LLC self-certifies, and the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Google’s data processing terms.

When Microsoft Clarity is loaded — only after you grant Session analytics consent — the data goes to Microsoft Ireland Operations Limited (Dublin, Ireland). Microsoft states that it processes Clarity data as a data controller, stores it in the Microsoft Azure cloud, and that Microsoft Ireland Operations Limited transfers data to Microsoft Corporation (United States) under Standard Contractual Clauses. Microsoft’s own processing is described in the Microsoft Privacy Statement.

No other third-party tracker runs on the Site.

8. Retention

Consent-required cookies placed through our configuration last at most 13 months: _ga and _ga_<container-id> 13 months, _clck 1 year, _clsk 1 day. Microsoft sets the lifetime of its third-party cookies. According to Microsoft, Clarity keeps session recordings for 30 days, and favourite or randomly sampled recordings for up to 9 months. The per-tracker expiry is stated in the inventory table at section 4. The consent decision itself is stored on your device only and is removed when you clear browser storage or change your choice.

9. Children

The Site is not directed at children and we do not knowingly process personal data of children below the digital-consent threshold. In Belgium, where the controller is established, article 7(1) of the Loi du 30 juillet 2018 sets that threshold at 13 years; thresholds in other Member States may be higher (up to 16 years), and the higher national threshold applies to children resident in those Member States. If you believe that a child below the applicable threshold has provided personal data to us through cookies, please write to privacy@autovig.eu.

10. Changes to this Policy

We may update this Policy when the Site evolves. The updatedAt date in the page header reflects the latest revision. Material changes — new tracker, new processor, new transfer mechanism, change in retention — are highlighted at the top of the page for at least 30 days before they take effect. Where a change adds a consent-required tracker, the consent banner re-asks consent. Previous versions of this Policy are available on request at privacy@autovig.eu.

11. Sources

• Directive 2002/58/EC as amended (ePrivacy)
• Directive 2009/136/EC
• Belgian Loi du 30 juillet 2018 relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel, art. 10/2
• Regulation (EU) 2016/679 (GDPR)
• EDPB Guidelines 05/2020 on consent
• EDPB Guidelines 03/2022 on deceptive design patterns
• CJEU judgment of 1 October 2019, Planet49, C-673/17
• CJEU judgment of 27 October 2022, Proximus, C-129/21
• Autorité de protection des données / Gegevensbeschermingsautoriteit — cookie guidance — https://www.autoriteprotectiondonnees.be / https://www.gegevensbeschermingsautoriteit.be
• Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses)
• Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework)
• Microsoft Clarity — cookies
• Microsoft Clarity — frequently asked questions (storage, transfers, retention)
• Microsoft Privacy Statement