Cookie Policy — concours-eu

Prywatna beta - informacje tymczasowe

W trakcie prywatnej bety obowiązują wyłącznie poniższe informacje. Pozostała część tej strony opisuje usługę w wersji finalnej.

Wydawca: Erudiam SRL, spółka prawa belgijskiego w trakcie tworzenia.
Dostęp wyłącznie na zaproszenie. Brak swobodnej rejestracji oraz brak sprzedaży i płatności w trakcie bety.
Przetwarzane dane, ograniczone do zgłoszenia: adres e-mail, imię, nazwisko, firma i kraj (opcjonalnie), zgoda oraz język.
Podstawa prawna: wyrażona zgoda (artykuł 6 ust. 1 lit. a RODO).
Cel: zarządzanie prywatną betą, to znaczy wybór kandydatów i wysłanie kodu dostępu.
Przechowywanie: do zakończenia prywatnej bety, następnie usunięcie lub anonimizacja.
Przysługujące prawa (dostęp, sprostowanie, usunięcie, sprzeciw, ograniczenie, przenoszenie) oraz wszelkie pytania: privacy@erudiam.com. Możliwe jest również wniesienie skargi do belgijskiego organu ochrony danych.
Brak zbędnych plików cookie i brak zewnętrznych narzędzi analitycznych. Wobec braku sprzedaży nie jest należny podatek VAT.

Tekst tymczasowy, właściwy dla fazy testów, który może ulec zmianie i który przed publicznym uruchomieniem ma zostać sprawdzony przez prawnika.

Meta note (2026-04-26): Factual document reflecting the actual state of the Service. No advertising cookies, no third-party analytics (PostHog / Plausible / Matomo / GA / Mixpanel are not installed). To be updated whenever an analytics or marketing tag is added — the granular consent banner (CookieBanner.tsx) is then activated.

Last updated: 26 April 2026.

1. What is a cookie?

A cookie is a small text file stored on your device (computer, tablet, smartphone) when you browse the Service. It can record information about your navigation. This policy also covers similar trackers (localStorage, sessionStorage, IndexedDB) that store data client-side.

2. Legal framework

Cookie use is governed by:

Article 82 of the French Loi Informatique et Libertés (transposing the ePrivacy Directive 2002/58/EC);
the CNIL cookie guidelines and recommendation (2020, updated 2022);
the GDPR for consent (Art. 4(11) and 7).

Principle: cookies that are not strictly necessary (analytics, marketing, non-essential personalisation) require prior, free, specific, informed, and unambiguous consent. Strictly necessary cookies are exempt.

3. Cookies currently in use

3.1. Strictly necessary cookies (exempt from consent)

Name	Origin	Purpose	Duration
`sb-<project>-auth-token`	Supabase Auth	Maintain user session	Session + refresh (~1 week, rolling)
`sb-<project>-auth-token-code-verifier`	Supabase Auth	PKCE flow (login)	A few minutes
`NEXT_LOCALE` or equivalent	concours-eu (1st-party)	Remember chosen language (FR/EN)	1 year
`cookie-consent`	concours-eu (1st-party)	Remember consent choices	6 months

These cookies are essential to the Service (authentication, language preference, recording the consent choice). They do not require prior consent under Article 82 LIL.

3.2. Technical local storage

Key	Type	Purpose
`sb-auth-*`	localStorage	Supabase session (cookie alternative depending on config)
PWA cache / service worker	Cache API	Offline functionality (workbox)
Notification preferences	localStorage	Master toggle, enabled kinds (if not yet synced to DB)

3.3. Analytics cookies — NONE

The Service does not currently use any third-party analytics:

no Google Analytics
no Plausible
no Matomo
no PostHog
no Mixpanel
no Amplitude
no Segment

3.4. Marketing / advertising cookies — NONE

The Service sets no advertising or retargeting cookies. No Meta Pixel, no Google Ads, no TikTok Pixel, no LinkedIn Insight Tag, no Pinterest Tag.

3.5. Cloudflare third-party cookies

Cloudflare (CDN + anti-DDoS) may set the technical __cf_bm cookie (Bot Management, ~30 minutes). The CNIL considers it strictly necessary for security and exempt from consent.

4. Future analytics readiness

Although no analytics tooling is currently installed, the application is ready to integrate a privacy-first analytics provider (Plausible, or Matomo in cookie-less mode). When such integration occurs, the consent banner CookieBanner.tsx will be activated for optional categories:

Audience measurement (analytics) — opt-in required (unless using a tool that benefits from the CNIL exemption: Matomo in cookie-less mode + IP anonymisation + no cross-site, etc.).
Marketing / advertising — opt-in required if ever added.

5. Consent management

5.1. Cookie banner

A granular consent banner is integrated in the application (CookieBanner.tsx). While only strictly necessary cookies are set, it can be displayed as a simple informational notice. Once a non-exempt tool is added, the banner switches to granular opt-in with:

"Accept all" button
"Reject all" button (as accessible and visible as "Accept all" — CNIL 2020 requirement)
"Customise" opening a per-category panel (Necessary / Audience measurement / Marketing).

Consent is:

freely given (refusal as easy as acceptance);
specific (per category);
informed (each purpose described);
unambiguous (positive action — no pre-ticked boxes);
traceable (timestamp + version stored in localStorage).

5.2. Change or withdraw consent

At any time:

via the "Cookies" link in the footer (reopens the preferences panel);
via Settings → Privacy;
by clearing cookies / localStorage in your browser;
by using private / incognito browsing.

Consent is valid for up to 6 months (CNIL recommendation). On expiry, the banner is shown again.

6. Browser settings

You can configure your browser to block or remove cookies:

⚠️ Blocking strictly necessary cookies (Supabase Auth) prevents use of the Service.

7. Contact

For any cookie-related question:

privacy@erudiam.com
Supervisory authority: [TO CONFIRM Belgian Data Protection Authority (APD/GBA) — competent authority for a company established in Belgium].

8. Changes

This policy is updated whenever a cookie or tracker is added, changed, or removed. Update date in header. History in the project CHANGELOG.md.