Cookie policy

1. What this document covers

This document lists the cookies and other storage that Easy Nonconformity uses in the browser of those who visit it, together with their purpose and their duration. It is updated whenever those change, and the date of the latest update is given at the top.

It covers cookies only. For who processes personal data, why, for how long and with what rights, please refer to the notice on the processing of personal data, which remains the reference document.

2. Where there are cookies, and where there are none

Where	Cookies
Public presentation page	Analytics, and only after consent
Contact form on the public page	One security cookie, set by Google, only once you start filling in the form and only if spam protection is on (point 4)
The application, once signed in	None
The mobile application	None, and no analytics tools

Before consent is given, no analytics cookie is written in the browser and no third-party service is contacted. Anyone who declines stays in that condition. The one exception is the contact form spam check described in point 4: it does not depend on consent because it is needed to send the message the person is writing, and it starts only when they start writing it.

3. The analytics cookies

These are installed only if you choose "Accept" in the notice shown on your first visit to the public page. They are set by Google Analytics, through a script loaded on our own domain.

Name	Type	Duration	What it is for
_ga	Analytics	400 days	Tells one visitor from another, so that the same person coming back is not counted as two separate visits.
_ga_H09ETRNBXG	Analytics	400 days	Holds the state of the current visit for the measurement property. The trailing part of the name is that property's identifier: if the property changes, the name of the cookie changes with it.

They are first-party cookies — written on the easynonconformity.com domain, not by an external one — but the information they collect is transmitted to Google, which processes it under its own terms. Once consent has been given, the browser contacts www.googletagmanager.com to load the script and region1.google-analytics.com to send the measurements.

We use no profiling cookies, no advertising cookies, no tracking pixels and no social network tools.

4. The contact form spam check

The contact form on the public page can be protected by Google reCAPTCHA v3, which checks that a person, not an automated program, is writing. It asks you to click nothing: it assesses the interaction with the page and returns a score, which our server checks before forwarding the message.

Google's script loads only once you start filling in the form, and only if the protection has been turned on. Anyone who reads the page without writing does not load it. Once it is loaded, the browser contacts www.google.com, www.gstatic.com and fonts.gstatic.com.

Name	Where	Type	Duration	What it is for
_GRECAPTCHA	www.google.com	Security, third-party	180 days	Set by Google for the risk analysis that tells a person from an automated program.

The information the script collects — including the IP address and data about the interaction with the page — is transmitted to Google, which processes it under its own Privacy Policy and Terms of Service. The form says so next to the send button.

The list above was checked by loading the script in a browser; it will be checked again when the protection is turned on for the site.

5. Why we set no technical cookies of our own

It is a fair question, given that nearly every application has them: here the session does not rest on a cookie. The token that keeps you signed in is held in the browser's local storage and travels in the header of each request. As a result our server sets no cookies, on any page.

That does not mean nothing is left in the browser: what is left is listed in the next point, but it is not a cookie. The only cookie that can appear outside analytics is Google's, described in point 4, which is not ours and is not set by our server.

6. Browser local storage

These are not cookies — they do not travel with requests and no third-party site can read them — but they are data held on the device, and they deserve to be declared all the same. They remain until they are deleted, either by signing out or by clearing the site's data from the browser settings.

Item	Where	What it is for
analytics.consent	Public page	Remembers whether tracking was accepted or declined, so that the notice is not shown again on every visit.
_grecaptcha	Public page	Written by Google's reCAPTCHA script (point 4), only after you have started filling in the contact form.
accessToken	The application	Keeps the session of a signed-in user open.
tenantUuid	The application	Remembers the selected organisation, for those who belong to more than one.
language	The application	Remembers the language chosen by hand from the flag.
datatables.*	The application	Holds preferences about tables — visible columns, widths, sorting, filters.
maintenance.dismissedFor	The application	Remembers which maintenance notice has already been dismissed, so that it is not shown again.

We transmit none of these items to third parties; _grecaptcha is used by Google's script for the check described in point 4.

7. How you choose, and how you change your mind

On your first visit to the public page a notice appears with two equivalent options: accept or decline. Until you choose, no analytics starts.

The choice can be changed at any time through the "Cookie preferences" control at the foot of the public page, which reopens the same notice. When consent is withdrawn, the analytics cookies already present are deleted.

You can also delete cookies from your own browser settings, which likewise allow you to block them in advance. Blocking the analytics cookies does not impair the service. Blocking the reCAPTCHA script or cookie may instead prevent the contact form from being sent: in that case the form says so and gives the email address to write to us directly.

8. On what legal basis

The analytics cookies described here are not necessary in order to provide the service: they are installed only upon prior consent, under art. 6(1)(a) GDPR and art. 122 of the Italian data protection code. Consent may be withdrawn at any time, with the effect described in point 7, and withdrawal does not affect the lawfulness of processing carried out beforehand.

The spam check in point 4 rests instead on our legitimate interest in protecting the contact form from automated submissions (art. 6(1)(f) GDPR), and it starts only to send the message the person is writing, that is, to provide the service they asked for (art. 122 of the Italian code). Anyone who prefers not to use it can write to us at the address below.

9. Contact

For any matter concerning this document or personal data, write to techsupport@orlandoeandc.com.