Cookies and Browser Storage Notice for the THaiva Public Website

1. Data controller

The data controller is n8.software Piotr Gnyp, Jędrzychowska 20D, 65-385 Zielona Góra, Poland, Polish tax identification number (NIP): 9292070264, REGON business register number: 521530737. THaiva is a product of the Controller and is not a separate legal entity.

Privacy enquiries may be sent to privacy@thaiva.com.

2. Cookies and localStorage

A cookie is a small item of data stored by a browser. Subject to the cookie’s scope and settings, it may be included in later requests to the relevant domain.

localStorage is browser storage allocated to a particular website. Information held in localStorage is not automatically attached to network requests. Website code can read it to restore a setting on a later visit.

The THaiva public website uses:

• a necessary localStorage record for privacy preferences; and
• optional cookies and related mechanisms used by Microsoft Clarity, activated only after analytics consent has been given.

3. Necessary privacy preference record

The website stores the visitor’s choice in localStorage under the key thaiva.landing.consent.v2. The record contains:

• version – the version of the consent mechanism;
• necessary – a fixed value confirming that the necessary category is active;
• analytics – whether the visitor has permitted Microsoft Clarity;
• updatedAt – the date and time of the most recent update;
• source – how the choice was recorded, for example through the banner, the settings panel or migration of an earlier preference.

The record is used only to remember and apply the selected setting. It does not measure the visitor’s activity and is not, by itself, transmitted to the Controller.

If the browser contains the previous thaiva-analytics-consent entry with the value accepted or rejected, the website migrates that choice once to the current format and then removes the old entry. This preserves the visitor’s earlier decision following the introduction of the revised settings panel.

The local record is technically necessary to remember and apply the privacy setting selected by the visitor. Where the record constitutes personal data, processing is based on the Controller’s legitimate interest in respecting and evidencing that choice under Article 6(1)(f) GDPR.

4. Optional Microsoft Clarity analytics

Microsoft Clarity is a behavioural analytics service used to improve the readability, navigation and usability of the public website. The Clarity script is neither downloaded nor activated before analytics consent has been given.

After consent, the website uses Clarity’s ConsentV2 mechanism to communicate the following settings:

• analytics_Storage: granted – permission for analytics-related storage;
• ad_Storage: denied – no permission for advertising-related storage.

Clarity may then set cookies on the visited domain, including:

• _clck, which stores a pseudonymous visitor identifier used by Clarity and preferences for the website;
• _clsk, which links multiple page views into a single Clarity session.

Microsoft’s documentation also lists identifiers that may be used on Microsoft domains, including CLID, ANONCHK, MR, MUID and SM. Their actual use may depend on the browser, service configuration, region, privacy settings and consent signals.

Clarity uses these technologies to produce aggregated analytics, heatmaps and session replays generated from interaction data. The categories of personal data involved are described in the Privacy Notice.

The lawful basis for Clarity analytics is consent under Article 6(1)(a) GDPR together with the consent required by Article 399 of the Polish Electronic Communications Law of 12 July 2024.

5. Choices available to visitors

Where no preference has yet been stored, the website allows the visitor to:

• reject optional analytics;
• open the detailed settings; or
• give consent to Microsoft Clarity analytics.

Inactivity is not treated as consent. Clarity remains disabled until the visitor gives explicit consent to analytics.

The Necessary category cannot be disabled in the panel because it consists only of the local record required to remember the selection. Delivering and protecting the website does not depend on optional analytics being enabled.

6. Changing the selection and withdrawing consent

After a choice has been stored, the Privacy settings button remains available on the website. It may be used at any time to reopen the panel and change the selection. Withdrawing consent is intended to be as straightforward as giving it.

When consent is withdrawn, the website:

• stores the updated refusal in localStorage;
• notifies Clarity that consent has been denied by setting analytics_Storage: denied and ad_Storage: denied, if the service is still active on the page;
• removes the _clck and _clsk cookies where they are accessible to the website on the current domain;
• reloads the page so that the Clarity script is not activated again.

Cookies stored exclusively on Microsoft domains cannot be removed directly by the THaiva website. They can be managed through the browser or Microsoft’s privacy controls.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Storage and retention periods

The localStorage preference remains on the device until:

• the visitor changes the selection;
• the website data is cleared in the browser; or
• the current consent mechanism is replaced following a material change that requires a new choice.

Microsoft determines the lifespan of individual Clarity cookies and may update those periods. According to the documentation current on the date of this Notice:

• Clarity playback data is retained for 30 days;
• click data, heatmap data, and labelled or favourited sessions are retained for 9 months.

8. Browser controls

Visitors may also delete or block cookies and localStorage through their browser settings. Blocking or clearing all website storage may cause the privacy panel to appear again on a later visit.

Microsoft Clarity does not currently interpret the browser’s Do Not Track signal as either granting or refusing consent. The THaiva public website activates Clarity only on the basis of an explicit choice made through its own privacy controls.

9. Changes to this Notice

This Notice may be revised when the provider, analytics purpose, technologies or legal requirements change. A change affecting the validity of an earlier consent may result in a new consent-mechanism version and the privacy panel being displayed again.

The current version is published at thaiva.com/cookies/.