Cookie policy
This is an English translation provided for information only. The Polish version of this document is legally binding — read the Polish version. Contracts are concluded under Polish law.
[DRAFT SUBJECT TO LEGAL REVIEW — D72] Prepared on the basis of the laws and guidelines listed at the end of this document. The Polish version is binding.
Who is responsible for cookies
The controller and the party that stores cookies on this website is Rafal Raczkowski IT Services (Rafał Raczkowski, Polish tax ID (NIP) 567 185 37 49), ul. Ostródzka 195E/11, 03-289 Warszawa, email kontakt@svalcon.pl (details in the website footer). The privacy policy explains how we process personal data.
What cookies and similar technologies are
Cookies are small text files stored by your browser. Browser local storage (localStorage) and tab storage (sessionStorage) work in a similar way. Storing information on your device or reading it requires your consent unless it is strictly necessary to provide a service you have requested (Article 399 of the Polish Electronic Communications Law).
Categories and your consent
- Strictly necessary — always on, no consent needed: remembering your cookie choice, signing in to your account (Svalcon ID), security. Basket, chosen language and configuration draft also work without consent, but only until you close the browser.
- Functional — with consent: basket kept for 30 days, language for 12 months, configuration draft after you close the browser.
- Analytics — with consent: Google Analytics 4 statistics and the visit source (utm_*) attached to enquiries and orders.
- Marketing — with consent: Google Ads performance measurement, enhanced conversions (an encrypted hash of your email address when you order), the ad click ID (gclid). Ad personalisation (remarketing) has a separate switch.
On your first visit we ask for consent in a banner. “Accept all” and “Reject all” are equally prominent, and every optional category in “Settings” is switched off by default. No decision means no consent — the site still works fully, just without optional cookies. If your browser sends a Global Privacy Control signal, “Accept all” does not switch marketing on.
Changing and withdrawing consent
You can change or withdraw consent at any time — via the “Cookie settings” link in the footer of every page or on the /cookies page. Withdrawal takes effect immediately: we delete cookies from the switched-off categories (e.g. _ga, _ga_*, _gcl_*), set Google Consent Mode signals to “denied” and stop sending events. Cookies stored by Google on its own domains (e.g. doubleclick.net) can be deleted in your browser settings. Withdrawal does not affect the lawfulness of processing before it.
How long we remember your decision
Consent is valid for 12 months and refusal for 6 months; after that we ask again. We also ask earlier if we change the list of categories or providers (a new configuration version). Every decision gets a random consent ID — you can see it on the “Cookie settings” page.
Google Consent Mode v2
The shop uses Google consent mode. In basic mode (the default) Google tags are not loaded until you consent — without consent no request is sent to Google. Categories map to signals: analytics → analytics_storage; marketing → ad_storage, ad_user_data, ad_personalization (the latter only with ad personalisation); functional → functionality_storage, personalization_storage; security_storage — always.
Consent records
We record every decision so that we can demonstrate consent (Article 7(1) GDPR): consent ID, version, chosen categories, type of decision, date, language, GPC signal, keyed hashes (HMAC) of the truncated IP address and of the browser — never the full IP address — and the link to your account if you are signed in. Records are kept for 3 years and then deleted automatically.
List of cookies
The table below is generated from the cookie registry in the shop code, so it always matches what the site actually stores.
Strictly necessary
The site does not work without them: remembering your cookie choice, signing in to your account, security. Basket, language and configuration draft work without consent until you close the browser.
| Name | Provider | Purpose | Duration | Type | Outside the EEA |
|---|---|---|---|---|---|
rz_consent | Svalcon (controller) | Stores your cookie choice (categories, version, date, consent ID). | 12 months (refusal: 6 months) | cookie, first-party | no |
svalcon_account | Svalcon (controller) | Customer account session after you sign in (My orders). | 30 days | cookie, first-party | no |
svalcon_account_idt | Svalcon (controller) | Svalcon ID sign-in token needed to sign you out. | 30 days | cookie, first-party | no |
svalcon_oidc | Svalcon (controller) | Sign-in protection (state and PKCE verifier) while you are redirected to Svalcon ID. | 10 min | cookie, first-party | no |
rz_admin | Svalcon (controller) | Shop admin panel session (staff only). | 12 h | cookie, first-party | no |
AUTH_SESSION_ID | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Current sign-in process in Svalcon ID. | browser session | cookie, first-party | no |
KC_AUTH_SESSION_HASH | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Detects sign-in in several browser tabs at once. | 1 min | cookie, first-party | no |
KC_RESTART | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Restarts sign-in after the form has expired. | browser session | cookie, first-party | no |
KEYCLOAK_IDENTITY | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Svalcon ID sign-in session (up to 30 days with “Remember me”). | browser session | cookie, first-party | no |
KEYCLOAK_SESSION | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Svalcon ID session identifier (sign-out from all apps). | browser session | cookie, first-party | no |
KEYCLOAK_LOCALE | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Language of the sign-in pages chosen during sign-in. | browser session | cookie, first-party | no |
KEYCLOAK_REMEMBER_ME | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Only if you tick “Remember me”: suggests your email address next time you sign in. | 1 year | cookie, first-party | no |
KC_STATE_CHECKER | Svalcon ID (Keycloak, our own server) (domain auth.svalcon.pl) | Protects Svalcon ID forms against CSRF attacks. | browser session | cookie, first-party | no |
Functional
Remembering your basket (30 days), chosen language and consumer unit configuration draft after you close the browser.
| Name | Provider | Purpose | Duration | Type | Outside the EEA |
|---|---|---|---|---|---|
svalcon_cart | Svalcon (controller) | Basket. Without consent — until you close the browser; with consent kept for 30 days. | 30 days | cookie, first-party | no |
rozdzielnice.konfigurator.draft.v1 | Svalcon (controller) | Draft of your consumer unit configuration. Without consent — in tab storage (sessionStorage); with consent kept after closing the browser. | until deleted (browser storage) | localStorage, first-party | no |
NEXT_LOCALE | Svalcon (controller) | Language chosen with the switcher. Without consent — until you close the browser; with consent for a year. | 1 year | cookie, first-party | no |
svalcon_lang_hint | Svalcon (controller) | Dismissed language suggestion. Without consent — until you close the browser. | 1 year | cookie, first-party | no |
Analytics
Statistics on visits and configurator use (Google Analytics 4) that help us improve the shop. Data is shared with Google.
| Name | Provider | Purpose | Duration | Type | Outside the EEA |
|---|---|---|---|---|---|
_ga | Google Ireland Ltd. / Google LLC | Google Analytics 4: distinguishes users (random identifier). | 2 years | cookie, first-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
_ga_<ID> | Google Ireland Ltd. / Google LLC | Google Analytics 4: session state (visit number and start). | 2 years | cookie, first-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
rz_utm | Svalcon (controller) | Visit source (utm_*) attached to enquiries and orders. Ad click IDs (gclid, fbclid) only with marketing consent. | 30 days | cookie, first-party | no |
rz_once:* | Svalcon (controller) | Prevents double counting of events (e.g. a lead after a page reload). | until deleted (browser storage) | localStorage, first-party | no |
rz_ga_debug | Svalcon (controller) | Measurement debug mode (?ga_debug=1 parameter, for staff). | browser session | sessionStorage, first-party | no |
svalcon_internal | Svalcon (controller) | Staff devices only: marks internal traffic so it does not distort statistics. | 1 year | cookie, first-party | no |
Marketing
Measuring Google Ads performance, including enhanced conversions (an encrypted hash of your email when you order). Data is shared with Google.
| Name | Provider | Purpose | Duration | Type | Outside the EEA |
|---|---|---|---|---|---|
_gcl_au | Google Ireland Ltd. / Google LLC | Google Ads: conversion measurement (links the visit to an ad click). | 90 days | cookie, first-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
_gcl_aw / _gcl_gs / _gcl_* | Google Ireland Ltd. / Google LLC | Google Ads: ad click identifier (gclid) for conversion attribution. | 90 days | cookie, first-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
IDE | Google Ireland Ltd. / Google LLC (domain .doubleclick.net) | Google: remarketing and ad personalisation (only with ad personalisation consent). | 13 months | cookie, third-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
test_cookie | Google Ireland Ltd. / Google LLC (domain .doubleclick.net) | Google: checks whether the browser accepts advertising cookies. | 15 min | cookie, third-party | Possible transfer to the USA (Google LLC) — EU-US Data Privacy Framework and standard contractual clauses (to be verified by a lawyer). |
Table generated from the cookie registry in the shop code — consent configuration version 1.1-fam.
Legal basis and guidelines
- Regulation (EU) 2016/679 (GDPR) — Article 4(11) (definition of consent), Article 7 (conditions for consent, including paragraph 3: withdrawing consent must be as easy as giving it), recital 32.
- Polish Act of 12 July 2024 — Electronic Communications Law (Journal of Laws 2024 item 1221), Article 399 (replacing Article 173 of the Telecommunications Law from 10 November 2024) and Article 400.
- CJEU judgment of 1 October 2019, C-673/17 Planet49 — consent cannot be given by a pre-ticked checkbox.
- EDPB Guidelines 05/2020 on consent under Regulation 2016/679; EDPB report of the work undertaken by the Cookie Banner Taskforce (17 January 2023); EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive.
- Google EU User Consent Policy.