1.Cookies and Similar Technologies

A cookie is a small text file that a website asks your browser to store on your device. When you return to the same website, or visit another website that recognises the same cookie, the browser sends the file back so that the site can remember something about you or your visit. Cookies can be set by the website you are visiting (first-party cookies) or by another organisation whose code runs on that website (third-party cookies).

This Policy also covers technologies that work in a similar way and are treated in the same way by applicable law, including the EU ePrivacy rules for Visitors in the EEA and the United Kingdom and U.S. state privacy laws. When we say "cookies" in this document, we mean all of the following unless we say otherwise:

• Cookies: text files stored by your browser for a set period (persistent cookies) or until you close the browser (session cookies).
• localStorage and sessionStorage: browser storage areas that a website's scripts can read and write; unlike cookies, this data is not sent automatically with each request but can be used for the same purposes, such as remembering a setting.
• Pixels and web beacons: tiny, usually invisible images or code snippets embedded in a page that load from a provider's server and let that provider know the page was viewed and, often, set or read a cookie.
• Tags and scripts: pieces of code (for example a Google tag or the Meta Pixel base code) that run in your browser, collect information about your visit and pass it to the provider. Tags are the mechanism through which analytics and marketing cookies are created.

2.How We Use Cookies

We use cookies for three purposes only. First, to make the Website work and to remember the cookie choices you have made, so that we do not ask you again on every page. Second, if you agree, to understand how Visitors use the Website in aggregate so that we can improve its content and structure. Third, if you agree, to measure whether our own advertising on Google and Meta leads people to the Website and to the "request access" form.

We do not use cookies to build profiles for sale to third parties, to show you advertising on the Website itself, or to identify you by name as you browse. We do not sell personal information collected through cookies. The Website itself has no user accounts or logins, so it sets no authentication or session cookies. The client dashboard at dashboard.krog.digital is a separate application with its own login; the cookies it sets are described in the notices shown there.

The information collected through cookies may include your IP address (truncated or anonymised where the provider offers it), browser and device type, pages viewed, referring website, approximate location derived from the IP address, and the time of your visit. Where such information is personal data or personal information under applicable law, our Privacy Policy applies.

3.Strictly Necessary Cookies

Strictly necessary cookies are essential for the Website to function and to honour your choices. They do not require your consent under the EU ePrivacy rules, and they are not subject to opt-out rights under U.S. state privacy laws, because they are used solely to provide a service you have explicitly requested, in this case recording that you have answered the cookie banner and what you decided. You cannot switch these off through the banner, but you can delete them through your browser at any time, in which case the banner will simply appear again on your next visit.

At the date of this Policy, this is the only cookie that the Website sets by default:

• krog.consent - set directly by Krög Digital on krog.digital (first party) - records the cookie categories you have accepted or rejected, so that your preferences are respected on subsequent pages and visits and so that non-essential tags are not loaded without your consent - stored for 12 months from the date you make or change your choice - Strictly necessary, no consent required

4.Analytics Cookies

Analytics cookies help us understand how Visitors reach and use the Website: which pages are viewed, how long people stay, which links are clicked and which countries Visitors come from. We use this information in aggregated form to improve the Website's content and navigation. It is not used to make decisions about individual Visitors.

We plan to use Google Analytics 4, provided by Google Ireland Limited, for this purpose. Google Analytics 4 is loaded only after you have consented to the Analytics category in the cookie banner. If you have not consented, the Google Analytics tag is not loaded at all and no analytics cookies are set. Where Google offers IP anonymisation or equivalent data-minimisation settings, we enable them. Google may transfer data to Google LLC in the United States; for Visitors in the EEA, the United Kingdom and Switzerland, such transfers are covered by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework and its UK and Swiss extensions.

The following cookies are set when Google Analytics 4 is active:

• _ga - Google Ireland Limited (Google Analytics 4) - distinguishes one browser from another by assigning a randomly generated identifier, so that page views from the same Visitor can be counted as one session and returning Visitors can be recognised in aggregate statistics - up to 2 years - Analytics, loaded only with your consent - set on our domain by Google's script; data is processed by Google (third-party provider)
• _ga_* (the suffix is the identifier of our Google Analytics property) - Google Ireland Limited (Google Analytics 4) - maintains the current session state, including whether the session is active and how many pages have been viewed in it - up to 2 years - Analytics, loaded only with your consent - set on our domain by Google's script; data is processed by Google (third-party provider)

5.Marketing Cookies

Marketing cookies allow us to measure the effectiveness of advertising campaigns that we run for our own Services on Google Ads and on Meta's platforms (Facebook and Instagram). They tell us, for example, that a Visitor who clicked one of our advertisements later submitted the "request access" form, and they let the providers report aggregate statistics about how our campaigns perform. We use them for conversion measurement and attribution only.

These technologies are loaded only after you have consented to the Marketing category in the cookie banner. Without that consent, neither the Google Ads conversion tag nor the Meta Pixel is loaded and none of the cookies listed below is set. For California residents, the transmission of data to Google and Meta through these tags may be considered "sharing" for cross-context behavioural advertising under the CCPA; it takes place only with your consent to the Marketing category, and you can opt out at any time as described below. Both providers may process data in the United States and other countries; for Visitors in the EEA, the United Kingdom and Switzerland, such transfers are covered by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework and its UK and Swiss extensions.

The following cookies are set when the Google Ads conversion tag and the Meta Pixel are active:

• _gcl_au - Google Ireland Limited (Google Ads conversion tracking) - stores a click identifier used to attribute a later conversion (such as a form submission) to an advertisement that was clicked on Google's network - 90 days - Marketing, loaded only with your consent - set on our domain by Google's script; data is processed by Google (third-party provider)
• _gcl_aw - Google Ireland Limited (Google Ads conversion tracking) - stores the Google click identifier (gclid) passed in the URL when you arrive from a Google Ads advertisement, so that conversions can be matched to that campaign - 90 days - Marketing, loaded only with your consent - set on our domain by Google's script; data is processed by Google (third-party provider)
• _fbp - Meta Platforms Ireland Limited (Meta Pixel) - identifies a browser so that Meta can attribute conversions on the Website to Meta advertisements and report aggregate campaign statistics to us - 90 days - Marketing, loaded only with your consent - set on our domain by Meta's script; data is processed by Meta (third-party provider)

6.Consent and Managing Your Choices

When you first visit the Website, a cookie banner explains that we would like to use analytics and marketing cookies and lets you accept or reject the non-essential categories. No non-essential cookie is set and no analytics or marketing tag is loaded until you have made a choice. Your decision is recorded in the krog.consent cookie described above and is kept for 12 months.

You can change or withdraw your consent at any time, with effect for the future, using the "Cookie settings" link in the footer of every page of the Website. Reopening the settings lets you switch categories on or off; switching a category off stops the related tags from loading on subsequent page views and, where technically possible, deletes the cookies we have set. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal. Cookies set by third-party providers may need to be deleted from your browser separately, as explained below.

We honour the Global Privacy Control (GPC) signal. If your browser or a browser extension sends a GPC signal, we treat it as an opt-out from the "sale" or "sharing" of personal information for California residents and as a request to opt out of targeted advertising under other U.S. state privacy laws. In practice this means the Marketing category is treated as rejected for that browser, and the Google Ads conversion tag and the Meta Pixel are not loaded, regardless of any earlier banner choice. The Website also switches off marketing cookies for that browser until you actively change the setting again.

We use Google Consent Mode, a mechanism through which the consent state you set in our banner is passed to Google's tags. Google's tags are not loaded at all until you have consented to the relevant category; once you consent, Consent Mode communicates your choice to those tags so that they behave in line with the categories you have accepted. Google's tags therefore respect your choice in the same way as our own code.

You can also control cookies through your browser. Most browsers allow you to see which cookies are stored, delete some or all of them, block third-party cookies, or block all cookies for a specific site. The relevant options are usually found under settings headings such as "Privacy", "Security" or "Site data". Your browser's help pages explain the exact steps. Please note that blocking all cookies at browser level will also remove the krog.consent cookie, so the banner will reappear on your next visit.

7.Consequences of Refusing Cookies

Refusing analytics and marketing cookies has no effect on your ability to use the Website. Every page, the pricing information, the newsletter signup and the "request access" form work in exactly the same way whether or not you consent. We do not restrict content or functionality to Visitors who reject non-essential cookies, and we do not discriminate against Visitors who exercise their privacy rights.

The only practical consequences are on our side. Without analytics cookies, your visit is not included in our aggregate statistics, which makes it harder for us to see which content is useful. Without marketing cookies, we cannot tell whether a particular advertisement led to your visit or your request.

If you delete the krog.consent cookie or block cookies at browser level, the Website will not remember your choices and will display the banner again. Until you answer it, the Website behaves as if you had rejected all non-essential cookies.

8.Third-Party Cookies and Provider Policies

The analytics and marketing cookies described in this Policy are created by code belonging to Google and Meta. Although the cookies are stored under our domain, the data they collect is transmitted to and processed by those providers. The role each provider plays differs by product, and we set it out here so that you know who is responsible for what.

For Google Analytics 4, Google processes data on our behalf and on our instructions as a processor (or service provider, in the terminology of U.S. state privacy laws) under the Google Ads Data Processing Terms; we remain the controller of the analytics data. For Google Ads conversion tracking, Google acts as an independent controller for the processing it carries out for its own advertising services, under the Google Ads Controller-Controller Data Protection Terms. For the Meta Pixel, Meta Platforms Ireland Limited and we are joint controllers for the collection of event data on the Website and its transmission to Meta, under the Meta Controller Addendum; Meta is then the independent controller for its subsequent processing, including any use of Pixel data to improve its advertising systems. The essence of the joint-controller arrangement with Meta, including the allocation of responsibilities for information and data-subject rights, is set out in the Meta Controller Addendum published by Meta, and you may exercise your rights against either us or Meta in respect of the joint processing.

We encourage you to read the providers' own cookie information, which explains their use of cookies in detail and describes further controls they offer, such as Google's Ads Settings and Meta's advertising preferences:

• Google (Google Analytics 4 and Google Ads): Google's cookie information is published at policies.google.com/technologies/cookies. Google also offers a browser add-on that prevents Google Analytics from collecting data on any website you visit, and account-level advertising controls for people with a Google account.
• Meta (Meta Pixel): Meta's Cookies Policy is published at www.facebook.com/policies/cookies. People with a Facebook or Instagram account can manage how data from partner websites is used through the advertising and "off-Meta activity" settings in their account.

9.Consent Records and Retention

Under applicable law, including the GDPR and UK GDPR for Visitors in the EEA and the United Kingdom, we must be able to demonstrate that consent was given and that opt-out requests were honoured. The krog.consent cookie stored in your browser records the categories you accepted or rejected and is kept for 12 months, after which the banner is shown again and you are asked to decide afresh. Changing your choice through "Cookie settings" replaces the earlier record.

Data collected through Google Analytics 4 and Google Ads conversion tracking is retained by Google in accordance with Google's policies and the settings of our Google accounts. Conversion data collected through the Meta Pixel is retained by Meta in accordance with Meta's policies and the settings of our Meta advertising account. Retention periods for other personal data we process are set out in our Privacy Policy.

10.Changes to This Policy

We will update this Policy whenever we introduce, remove or materially change a cookie or similar technology, when a provider changes the way its tools work, or when applicable law or guidance from a competent regulator, such as the European Data Protection Board, the UK Information Commissioner's Office, the California Privacy Protection Agency or the U.S. Federal Trade Commission, requires it. The date at the top of this document shows when it was last revised.

If a change involves a new purpose or a new non-essential category, we will not rely on consent you gave earlier. Instead, the banner will be shown again and your renewed consent will be requested before any new tag is loaded. Minor changes, such as clarifications or updated provider names, do not trigger a new consent request. We recommend that you review this page from time to time.

11.Contact

If you have any questions about this Cookie Policy, want to exercise your rights in relation to data collected through cookies, or believe that a cookie has been set without your consent, please contact us at hello@krog.digital. You can also reach us through the Telegram channel listed on the Website. Please note that messages sent through Telegram are processed by Telegram as a communications provider and may be stored in countries other than the one you live in, including outside the EEA and the United Kingdom, as described in our Privacy Policy.

If you are located in the EEA, the United Kingdom or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with the data protection authority of the country in which you live, work or believe an infringement has occurred. If you are a resident of California or another U.S. state with a comprehensive privacy law, you may exercise your rights to know, delete, correct and opt out through the contact details above, as described in the section "Your U.S. State Privacy Rights" of our Privacy Policy, and you may also contact your state's attorney general or privacy regulator.