Cookie policy

Technical cookies, always present

There are two, both set by the cobaltica.it domain. They require no prior consent under Art. 122 of the Italian Privacy Code and the Data Protection Authority guidelines of 10 June 2021: without them the site cannot do what it is asked to do.

• PHPSESSID — the PHP session cookie. It is set from the very first page visited, since the contact form sits at the foot of every one of them: it links the form to the token that protects submissions against forged requests, and keeps what was typed into the fields if a submission is rejected. It lasts as long as the browsing session and is deleted when the browser closes. It holds nothing but a random identifier, guarded by the HttpOnly and SameSite=Lax attributes and, over encrypted connections, Secure;
• cobaltica_consenso — remembers the choice made on the banner, so it need not be asked again on every page. It holds a single word, «si» or «no», and lasts six months.

Measurement cookies, only if you accept

The site uses Google Analytics 4 to know how many people visit it and which pages they read. It is the only third-party service present, and its cookies are written only after «Accept» has been pressed on the banner.

• _ga — tells one browser from another by assigning it a random number, so that two visits from the same device are not counted as two different people. It lasts two years;
• _ga_TZNV4B10XD — holds the state of the measurement session in progress. It lasts two years.

These are third-party cookies, read by Google. They are not used for advertising: the site's configuration explicitly denies advertising consent, so the data collected feeds neither personalised ads nor remarketing lists.

What happens before you accept

Google's tag is loaded straight away, but it starts in «consent denied» mode: it writes no cookies, assigns no identifiers and does not recognise returning visitors. It sends Google an anonymous count of the visit, from which Google derives aggregate statistics by estimation.

This deserves to be said plainly, because it is not immaterial: that count is still a connection to Google's servers, which in making it see the visitor's IP address. The address is used to derive the approximate geographic area and is not recorded, but the connection happens before any choice is made. Anyone preferring to avoid it can block the googletagmanager.com domain from their browser settings or an extension, and the site will keep working in every other respect.

Pressing «Refuse» keeps things exactly as they are, permanently: no measurement cookie is ever written.

Changing your mind

The choice can be withdrawn as easily as it was given: at the foot of every page, next to the links to the notices, there is a «Cookie choice» item. Opening it brings the banner back, and a different answer can be given.

The choice is not final in any case: after six months the banner asks again, so consent given once does not last forever.

What the site does not do

It embeds no remote fonts, maps, videos or social buttons: every other resource — typefaces included — is served from the cobaltica.it domain, and the server's content security policy lets Google Analytics through and nothing else.

It uses no cookie-equivalent technologies: no browser local storage (localStorage, sessionStorage), no advertising-platform tracking pixels, no device fingerprinting.

It does not cross-reference measurement data with what is sent through the contact form: they are two separate things, and whoever writes remains a person who wrote, not a number in a statistic.

How to disable cookies from the browser

Besides the banner, every browser allows cookies to be blocked or deleted from its settings, either wholesale or site by site. Instructions are in the documentation of the browser in use, under privacy or browsing data.

Blocking the session cookie will stop the contact form from working: without it the protection token does not hold and the submission is rejected. The rest of the site remains readable, and the telephone number and the registered address remain open for getting in touch.

Data recorded outside cookies

Regardless of cookies, the server records in its technical logs the IP address, date and time of the request, the page requested and the browser type: this data is necessary for the operation and security of the site, is not used to recognise visitors, and is described in the privacy policy, together with Google's role as a data processor and the transfers that follow from it.

If anything changes

Should other external services be introduced in future, this page will be updated before they go live and the date at the top will change accordingly. Until then, what is written here is the complete list.