Cookie Policy

This Cookie Policy ("Policy") is issued by BRANTELO OÜ (registry code 17282632), a private limited company incorporated under Estonian law with its registered office at Tornimäe tn 5, 10145 Tallinn, Estonia ("Brantelo", "we", "us", "our").

This Policy explains, in accordance with Article 13 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Article 5(3) of the EU ePrivacy Directive (2002/58/EC as amended by 2009/136/EC), and applicable national implementing legislation, what cookies and similar tracking technologies are deployed on brantelo.com (the "Platform"), why we use them, and what rights you have in relation to them.

This Policy forms part of and should be read together with our Privacy Policy (brantelo.com/privacy) and Terms of Service (brantelo.com/terms). Terms defined in the Privacy Policy or Terms of Service have the same meaning when used in this Policy.

Cookies are small text files placed on your device (computer, smartphone, or tablet) by a web server when you visit a website. Cookies are widely used to make websites function correctly, to improve user experience, and to provide information to the operators of websites.

Cookies may be classified by their lifespan: Session cookies are temporary and are automatically deleted when you close your browser. Persistent cookies remain on your device for a defined period of time or until you manually delete them.

Cookies may also be classified by their origin: First-party cookies are set by the domain you are visiting (in this case, brantelo.com) and are controlled by Brantelo. Third-party cookies are set by a domain other than the one you are visiting — for example, Google Analytics cookies set by google-analytics.com — and are controlled by those third parties.

In addition to cookies, websites may use related technologies such as web beacons (pixel tags), local storage (localStorage/sessionStorage), and fingerprinting techniques. Brantelo does not use web beacons, fingerprinting, or any tracking technology beyond the cookies expressly described in this Policy.

Under the EU ePrivacy Directive (Article 5(3)) and GDPR, we may only place cookies on your device where we have a valid legal basis to do so. Brantelo operates on the following legal bases:

Strictly Necessary Cookies — Legal Basis: Legitimate Interest (GDPR Art. 6(1)(f)) / Technical Necessity. Strictly necessary cookies are essential for the Platform to function. Without them, core services such as account authentication and session management cannot operate. These cookies do not require your consent under Recital 25 of the ePrivacy Directive, as they are strictly necessary to deliver the information society service you have explicitly requested. You cannot opt out of strictly necessary cookies without ceasing use of the relevant feature of the Platform.

Analytics Cookies — Legal Basis: Consent (GDPR Art. 6(1)(a)). Analytics cookies are placed only with your freely given, specific, informed, and unambiguous consent, obtained through the Cookie Consent Banner displayed on your first visit to the Platform. Consent is recorded in a consent cookie (cookie_consent) and linked to your browsing session. You may withdraw your consent at any time with effect for the future; withdrawal does not affect the lawfulness of processing based on consent prior to withdrawal.

No other categories of cookies — including advertising, retargeting, social media, or profiling cookies — are deployed on the Platform.

The following table provides a complete inventory of all cookies currently deployed on the Platform. This inventory is reviewed and updated whenever the Platform's cookie usage changes materially.

5.1 Session Authentication Cookies (customer_session, seller_session, b2b_session). These three first-party cookies serve the sole purpose of maintaining authenticated sessions for the three categories of registered Platform users: B2C Buyers, Sellers, and B2B Buyers respectively. Each cookie contains an encrypted, server-side-validated session token. No personal data (name, email, financial data) is stored within the cookie payload itself. The tokens are validated against server-side session records on every request.

All three session cookies are set with the HttpOnly flag, preventing access by client-side JavaScript and mitigating cross-site scripting (XSS) attacks. They are additionally set with the SameSite=Lax attribute, providing protection against cross-site request forgery (CSRF) attacks. Session cookies expire 30 days after creation on a rolling basis (refreshed with each authenticated request) and are immediately invalidated upon sign-out.

5.2 Consent Record Cookie (cookie_consent). This first-party persistent cookie stores a boolean value representing your consent decision (accepted or declined) in relation to optional analytics cookies. It is set upon interaction with the Cookie Consent Banner. Its purpose is purely administrative — to prevent the Banner from being re-displayed on every page visit and to enable Brantelo to demonstrate consent status in the event of a regulatory inquiry. The cookie contains no personal data beyond the consent decision itself and a timestamp.

6.1 Google Analytics 4 (_ga, _ga_[ID], _gid). Brantelo uses Google Analytics 4 ("GA4"), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. GA4 is deployed exclusively with your prior consent. If you decline optional cookies via the Cookie Consent Banner, GA4 scripts are not loaded and no analytics cookies are set.

GA4 assigns a randomly generated client identifier (_ga) to your browser to distinguish unique visitors. This identifier does not directly identify you as a natural person; it is pseudonymous. GA4 reports are received by Brantelo in aggregated, statistical form showing page views, session durations, geographic regions (country/city level), device types, and referral sources. Brantelo uses this data solely to improve the Platform's functionality and user experience.

IP Anonymisation: Brantelo has enabled IP anonymisation within the GA4 configuration. The last octet of IPv4 addresses and the last 80 bits of IPv6 addresses are masked before any geographic lookup is performed. Full IP addresses are never stored by Google in connection with Brantelo's GA4 property.

6.2 International Transfer — Google Analytics. Google LLC is headquartered in the United States. The transmission of analytics data to Google involves an international transfer of data outside the European Economic Area (EEA). This transfer is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into Google's data processing terms. Brantelo has assessed this transfer and concluded that, in combination with IP anonymisation and the pseudonymous nature of the data, an adequate level of protection is maintained.

6.3 Google Analytics Opt-Out. In addition to withdrawing consent via the Cookie Consent Banner, you may prevent GA4 data collection entirely by installing the Google Analytics Opt-Out Browser Add-On available at tools.google.com/dlpage/gaoptout. This add-on instructs the GA4 JavaScript (gtag.js) not to share information with Google Analytics about visit activity.

For transparency and to address common concerns, Brantelo expressly confirms that the following categories of cookies and tracking technologies are NOT used on the Platform:

8.1 Right to Withdraw Consent. Where cookies are deployed on the basis of your consent (currently: analytics cookies), you have the right to withdraw that consent at any time, without detriment. Withdrawal of consent does not affect the lawfulness of any processing that occurred based on your consent prior to withdrawal. To withdraw consent, use any of the methods described in Section 8.2.

8.2 How to Manage Your Cookie Preferences. You may manage your cookie preferences through the following mechanisms:

The following official resources provide step-by-step instructions for managing cookies in the most commonly used web browsers. Brantelo is not responsible for the content of these external resources, which may change without notice.

The specific lifespan of each cookie is set out in the Cookie Inventory table in Section 4. In general terms:

Brantelo reviews this Policy at least annually and following any material change to the Platform's technology stack or cookie usage. When we make material changes — such as introducing a new category of cookies or a new third-party service — we will:

For any questions, concerns, or requests relating to this Cookie Policy or Brantelo's use of cookies:

Email: sales@brantelo.com (subject: "Cookie Policy Enquiry")

Post: BRANTELO OÜ · Tornimäe tn 5, 10145 Tallinn, Estonia

Registry Code: 17282632

We aim to respond to all cookie-related correspondence within 5 business days.