Cookie Notice — kavtek.eu

9 October 2026

This Notice supplements the Privacy Notice. Controller: KD18 holdings s.r.o., Růžová 972/1, 110 00 Praha 1, IČO 17745837 — contact info@kavtek.eu.

1. How we classify

Strictly necessary — required for sign-in, security, to record your cookie choice, or to remember a display setting (language, colour theme). No consent needed (§ 89(3) of Act No. 127/2005 Coll.), but we still describe them here.
Analytics — measure use of the public site. Loaded only after your consent.
Advertising — measure which advertising brought you to us, so we can stop paying for advertising that brings no one. Loaded only after your consent.

2. Strictly necessary

Name	Provider	Purpose	Duration
session cookie	Kavtek	Keeps you signed in; tied to a revocable server-side session	Session
`euconsent-v2`	InMobi CMP	Your IAB TCF consent decision	~13 months
`IABGPP_HDR_GppString`	InMobi CMP	Global Privacy Platform string recording your choice	13 months
`usprivacy`	InMobi CMP	US Privacy signal	Set on load
`NEXT_LOCALE`	Kavtek	The language of the pages you open, so kavtek.eu opens in it next time; set when a page's language differs from your browser's or from the one remembered before	1 year
`kavtek-theme`	Kavtek	The colour theme you chose with the switcher in the header, or the one named by the link you arrived through (we use such links in our advertising to compare the two themes); it holds only the theme's name, set only for a theme other than the default	1 year

Storing your refusal requires storing something — that is why the consent-record cookies are strictly necessary once you have answered.

The consent platform also uses browser local storage (gbc_consent, _acceptanceState, _gbcAcceptanceState, _cmpShown, CMPList, _config) to hold your choices and its own configuration.

3. Analytics — only after your consent

The public storefront uses Google Analytics 4 deployed through Google Tag Manager, governed by the InMobi consent-management platform. Along with how the site is used, it records which of our two colour themes a page was shown in.

Name	Provider	Purpose	Duration
`_ga`	Google	Distinguishes browsers for aggregate usage statistics	2 years
`_ga_F9NM515VJJ`	Google	Maintains GA4 session state	2 years

How consent is enforced:

Google Consent Mode defaults are set to denied before anything else runs — this is the first instruction on the page, ahead of the tag manager itself.
Until you consent, no analytics cookie is set and no measurement data is sent. Verified on the live site: with consent refused, no request reaches Google Analytics and no _ga cookie exists.
"Reject all" is offered alongside "Accept all", and refusing changes nothing about browsing, requesting a quote or ordering.
Withdrawal is as easy as consent: the "Cookie settings" control at the foot of every public page reopens the preference interface, and revoking stops measurement immediately.

A point of honesty about what happens before you choose. The consent platform is delivered through the tag manager, so loading it means one request to Google's servers (googletagmanager.com) before you have answered. That request is what brings you the consent banner itself. No analytics identifier is created, stored or transmitted at that point — only the mechanism that asks for your decision. We describe it here rather than claim no contact occurs at all.

Where the data goes. Measurement data is sent to region1.google-analytics.com, Google's European endpoint. For visitors in the EEA the data controller for these analytics services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may transfer data to Google LLC in the United States; such transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.

Analytics is limited to the public site. It does not run in your customer account, or in any signed-in area.

4. Advertising — only after your consent

We advertise on Google. To know which advertisement produced an order — and to stop paying for advertising that produces none — Google's conversion linker records the identifier of the advertising click you arrived from.

Name	Provider	Purpose	Duration
`_gcl_aw`	Google	Records that you arrived from a Google search advertisement, so a resulting order can be attributed to it	90 days
`_gcl_gb`	Google	The same, for app-campaign clicks	90 days
`_gcl_dc`	Google	The same, for display-network clicks	90 days

We set no advertising cookie of our own. All three are written by Google, and only after you have consented to advertising storage. If you refuse, none of them is created and we cannot connect an order to an advertisement. That is a cost we accept rather than work around.

If you did arrive from an advertisement and consented, the click identifier is stored with your order, so that a completed purchase can later be reported back to Google as the result of that click. It identifies a click and a browser, not a person by name, and it is deleted when an account is erased. Section 2 of the Privacy Notice lists it among the data we hold.

5. PPL pickup-point map — only if you choose it

When you enter a delivery address you can choose delivery to a PPL pickup point. Only then do we load PPL's pickup-point map (the PPL access point widget) from PPL's servers; if you choose delivery to an address, nothing of it loads. The map is PPL's, and PPL CZ s.r.o. is the controller for what it processes on its own servers, under PPL's privacy terms.

Where your browser connects: www.ppl.cz (the map's code) and api.dhl.com (PPL's interface in the DHL group, which returns the pickup points and the map). They receive your IP address and browser details, what you type into the map's search, the area of the map you look at and, if you allow your browser to share it, your location.
Cookies from www.ppl.cz: technical cookies of PPL's servers, set when the map's code is fetched — for load balancing (BIGipServer… and a cookie with a random name) and for security (TS01…). Session. Your browser may refuse them as third-party cookies; the map still works.
Storage on our site, written by the map: ppl-accesspoint-widget-cookie-consent (your answer to the map's own cookie banner) and ppl-accesspoint-widget-…-last-selected (the points you picked, shown as "Recently selected"). Kept until you clear your browser's storage.
The map's own cookie banner offers PPL's optional categories (performance, functional, analytics, Microsoft Bing, YouTube). That choice is made with PPL, not with us, and refusing all of them changes nothing about choosing a point. With everything refused, we saw the map contact only www.ppl.cz and api.dhl.com (checked 30 September 2026).

The point you pick is stored with your order as part of the delivery details (Privacy Notice, section 2).

6. Managing your preferences

Use the Cookie settings control on any public page, or your browser's own storage controls. Withdrawal does not affect the lawfulness of processing carried out before it.

Note that ad- and tracker-blocking browser extensions will also prevent analytics from loading. That is entirely your choice and affects nothing else on the site.

7. Changes

This Notice is updated whenever a tag, provider, cookie, purpose or duration changes. No new optional tag is deployed without updating this inventory and the consent configuration at the same time.