Cookie Policy

1. Introduction

This Cookie Policy explains how NanoClick ("we," "us," or "our") uses cookies and similar tracking technologies when you visit nanoclick.ch (the "Website"). It explains what cookies are, which cookies and tracking technologies we use, why we use them, and how you can control them.

For information about how we process your personal data more generally, please see our Privacy Policy.

2. What Are Cookies?

Cookies are small text files placed on your device (computer, smartphone, or tablet) when you visit a website. They are widely used to make websites function efficiently, provide a better user experience, and report information to website owners.

Cookies set by the website operator (us) are called first-party cookies. Cookies set by other parties are called third-party cookies. We also use comparable technologies such as anonymized network requests (for geolocation) and database storage (for consent records). For simplicity, this policy uses the term "cookies" to cover all such technologies.

3. Categories of Cookies We Use

We classify cookies into four categories:

Strictly Necessary

Required for the Website to function and for us to comply with our legal obligations (e.g., storing your cookie consent decision). These cannot be disabled because the Website would not work or be lawful without them.

Analytics

Help us understand how visitors interact with the Website so we can improve content and structure. Set only after you grant consent.

Marketing

Used to deliver and measure advertising, including tracking visitors across websites. We do not currently use marketing cookies. If we add them in the future, they will only be set after you grant consent.

Personalization

Used to remember preferences (such as language settings). We do not currently use personalization cookies. If we add them, they will only be set after you grant consent.

4. Cookies and Tracking Technologies We Use

4.1 Strictly Necessary

NameProviderPurposeDurationrd-cf-consentFirst-party (set via CookieFlow™ by Reform Digital®)Stores your cookie consent choices so we remember your preferences on return visits.6 months

Additional strictly necessary processing performed by our consent management tool (CookieFlow™ by Reform Digital®):

• Geolocation check — A single request is sent to a Cloudflare Worker operated by Reform Digital® (cookieflow-geo.reformdigital.workers.dev) to determine the country your visit originates from. This allows us to display the correct consent banner for your region (e.g., the GDPR-compliant banner for EU and Swiss visitors). Your IP address is anonymized at the source (the last octet is set to zero) before being returned. The Cloudflare Worker is operated on Cloudflare Inc.'s infrastructure.
• Consent record storage — When you interact with our cookie banner, a record of your choice is stored in our consent database hosted by Supabase Inc. The database is located in the European Union (Ireland). The record includes: a unique consent ID, your anonymized IP address (last octet zeroed), timestamp, the page where consent was given, your browser/device information (user agent), the consent method used (accept all, reject all, or accept selected), the button text you clicked, the banner text you saw, the consent categories you allowed, and your detected compliance region. This record exists for legal audit purposes as required by Article 7(1) of the GDPR (demonstrating that valid consent was obtained).
• Anonymous product telemetry — CookieFlow sends one anonymous request per page load to Reform Digital®'s analytics endpoint, containing only the product identifier ("COOKIE_FLOW") and the domain it is installed on. No cookies are set, no personal data is sent, and no fingerprinting occurs. This is used by the tool's developer to measure overall product adoption.

4.2 Analytics — Set Only With Your Consent

We use Google Analytics 4 to understand how visitors use our Website. Google Analytics is provided by Google LLC (and, for EU/UK/Swiss users, Google Ireland Limited). It is loaded via Google Tag Manager (also provided by Google) and operates under Google Consent Mode v2.

NameProviderPurposeDuration_gaGoogle LLCDistinguishes unique visitors so we can measure aggregate audience size and behaviour.2 years_ga_<container-id>Google LLCPersists session state for Google Analytics 4 (the container ID corresponds to our specific GA4 property).2 years

Additional information about Google Analytics:

• IP addresses are anonymized at collection time by Google
• We do not send personally identifiable information to Google
• If you do not consent to analytics, Google Analytics is fully blocked from running on your visit
• Google Tag Manager itself does not set cookies; it acts as a container that loads Google Analytics 4 only after you have granted analytics consent

4.3 Webflow Platform Cookies

The Website is hosted on the Webflow platform (provided by Webflow, Inc.). Webflow may set strictly necessary cookies as a technical requirement (for example, to process form submissions or detect basic site state). These cannot be disabled while you are using the Website.

5. Google Consent Mode v2

We have implemented Google Consent Mode v2. This means we communicate your consent state to Google's tracking services in a standardized way:

• Before you make a decision, Google's services default to a "denied" consent state (no cookies are set, no personal identifiers are sent)
• If you accept analytics, this signal is updated to "granted" and Google Analytics functions normally with the limitations described above
• If you reject analytics, the signal remains "denied" and Google Analytics is fully blocked

6. International Data Transfers

Some of our service providers process data outside of Switzerland or the European Economic Area:

• Google LLC (Google Analytics, Google Tag Manager) — Headquartered in the United States. Personal data transfers are protected under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework, both supplemented by Standard Contractual Clauses where applicable.
• Supabase Inc. (consent record storage) — The database we use is located in the European Union (Ireland). Supabase Inc. is headquartered in the United States, with data transfers protected by Standard Contractual Clauses.
• Cloudflare Inc. (infrastructure for the geolocation worker) — Operates a global network. Data is processed under Standard Contractual Clauses where applicable.
• Reform Digital® (operator of CookieFlow™ and its supporting infrastructure) — Based in Portugal (European Union).
• Webflow, Inc. (hosting) — Headquartered in the United States, with data transfers protected by Standard Contractual Clauses.

7. How to Manage Your Cookie Preferences

7.1 Through Our Cookie Banner

You can review and modify your consent choices at any time by:

• Clicking the cookie preferences icon in the bottom corner of any page on the Website, or
• Clicking the "Cookie Settings" link in our footer

7.2 Through Your Browser

Most web browsers allow you to control cookies through their settings. You can typically:

• Block all cookies
• Block only third-party cookies
• Delete cookies after each browsing session
• Receive a notification when a cookie is set

For browser-specific instructions, see:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Please note that blocking strictly necessary cookies will impair Website functionality.

7.3 Browser-Level Privacy Signals

We respect the following automatic privacy signals:

• Do Not Track (DNT) — If your browser sends a DNT signal, we will not load analytics or marketing cookies
• Global Privacy Control (GPC) — If your browser sends a GPC signal, we will treat it as an opt-out request

8. Consent Expiry

Your cookie preferences are stored for 6 months. After this period, our banner will reappear and ask you to renew your consent. This aligns with current guidance from European data protection authorities.

9. Your Rights

If you are located in Switzerland, the European Union, the European Economic Area, or the United Kingdom, you have the following rights regarding the personal data we process in connection with cookies:

• Right of access — to obtain confirmation of and access to your data
• Right to rectification — to correct inaccurate data
• Right to erasure ("right to be forgotten") — to have your data deleted
• Right to restriction of processing — to limit how we use your data
• Right to data portability — to receive your data in a portable format
• Right to object — to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting the lawfulness of processing performed before withdrawal
• Right to lodge a complaint with a supervisory authority — for Swiss residents, the Federal Data Protection and Information Commissioner (FDPIC); for EU/EEA residents, your local data protection authority

To exercise these rights, please contact us using the information in section 11.

You can also access your consent record at any time by providing your unique consent ID (shown in the consent banner after you make a choice).

10. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our practices, the tools we use, or applicable law. The "Last updated" date at the top of this policy indicates when it was most recently revised. Material changes will be communicated through the cookie banner, which will prompt you to review and re-confirm your preferences.

11. Contact

For questions about this Cookie Policy, to exercise your data protection rights, or to obtain a copy of your consent records, please contact us:

[NanoClick — full legal name] [Street address] [Postal code, City] Switzerland

Email: [[email protected]]

12. Legal Basis Summary

For visitors in the EU, EEA, UK, and Switzerland:

CategoryLegal BasisStrictly Necessary (consent storage, geolocation, audit log)Legitimate interests under Article 6(1)(f) GDPR / Article 31(1)(c) Swiss FADP, and compliance with legal obligation under Article 6(1)(c) GDPR (storing consent proof)AnalyticsConsent under Article 6(1)(a) GDPR / Article 6(6) Swiss FADPMarketingConsent under Article 6(1)(a) GDPR / Article 6(6) Swiss FADP (not currently used)PersonalizationConsent under Article 6(1)(a) GDPR / Article 6(6) Swiss FADP (not currently used)