🛡️ Privacy and Cookie Policy (GDPR)

This document details what data we collect using analytics systems (Google Analytics and Microsoft Clarity), for what purpose, and how we ensure full compliance with the European GDPR regulation.

1. How Our Cookie Consent System Works

Our website implements a consent banner powered by Google Consent Mode v2. This means the system operates on a "Privacy by Default" principle:

• Before Consent (Opt-in): When you first visit the site, all analytical and marketing scripts are blocked. Only anonymous "pings" are collected without using cookies (if advanced mode is enabled) or nothing is collected at all (strict mode).
• After Consent: If you click "Accept All", the system updates your consent status (gtag('consent', 'update', ...)), and only then do Google Analytics and Microsoft Clarity start writing cookies to your browser.
• Decline: If you click "Reject", analytics remain blocked.

This approach is fully GDPR compliant, as we do not collect identifiable data until we receive explicit, informed consent.

---

2. What We Collect (Google Analytics 4)

We use Google Analytics to understand overall website traffic statistics.

Data collected (after consent):

• Device/Browser Identifiers: A unique Client-ID (stored in _ga cookies) that distinguishes returning users from new ones.
• Interaction Data: Pages you visit, time spent on the site, buttons clicked, and traffic sources (where you came from).
• Geo-data (Anonymized): Approximate location (city/country) based on IP address. Note: GA4 automatically anonymizes IP addresses before storing them on its servers, so we do not have access to your exact IP address.

Data Retention: User and event-level data in Google Analytics is retained for 2 or 14 months (depending on your GA4 settings; 2 months is recommended for maximum privacy).

---

3. What We Collect (Microsoft Clarity)

We use Microsoft Clarity to understand how users interact with our site interface (click maps, scroll maps, session recordings) to improve usability.

Data collected (after consent):

• Session Recordings: Anonymized recordings of how you move your mouse, scroll, and click on the site.
• Data Masking: All text fields you fill out (especially in forms or quizzes) are automatically masked (replaced with asterisks ***) at the browser level. Microsoft Clarity never receives the content of your messages, phone numbers, or email addresses.
• Technical Data: Screen resolution, browser type, operating system, country.

Data Retention: Microsoft retains session data for 30 days up to 12 months.

---

4. Your Rights Under GDPR

Every user has the right to:

1. Withdraw Consent: You can change your cookie preferences at any time (via the "Cookie Settings" button in the website footer).
2. Right to Access and Erasure (Right to be Forgotten): Because we collect data anonymously, we cannot identify a specific user in Google Analytics or Clarity without special identifiers. However, you can manually clear the cookies in your browser, which will delete all identifiers.
3. Right to Information: This policy serves as a tool to exercise your right to know what data is collected.