English 
Български 
Deutsch 
العربية 
Čeština 
Dansk 
Ελληνικά 
Español 
Eesti 
Suomi 
Русский 
Türkçe 
Français 
Magyar 
Bahasa Indonesia 
Italiano 
日本語 
한국어 
Lietuvių 
Latviešu 
Norsk Bokmål 
Nederlands 
Polski 
Português 
Română 
Slovenčina 
Slovenščina 
Svenska 
Ukrainian 
中文 
Srpski 
Hrvatski 
Cookie Policy
2026-05-17 · v2.0 / maj 2026
The website findes.si and its partner platforms (Investra.io, Unifyr.space, sinisadagary.com) use cookies to provide a better user experience, analytics and content personalisation. This policy explains which cookies we use, why, how you can manage them and which third-party providers are involved. The data controller is Findes Marketing d.o.o., Litostrojska cesta 44A, 1000 Ljubljana.
1. What cookies are
Cookies are small text files that are stored in your browser when you visit a website. They allow the website to "remember" your settings and behaviour between visits.
| Type | Description | Example |
|---|---|---|
| Session cookies | Active only during the session — deleted when the browser is closed | Shopping cart, login session |
| Persistent cookies | Remain stored until expiry or manual deletion | Language preferences, GA |
| First-party cookies | Set directly by the website you are visiting | cookieconsent, _session |
| Third-party cookies | Set by an external provider (Google, Meta, Hotjar) | _ga, _fbp, _hjid |
2. Consent Management Platform (CMP)
Findes Group uses its own consent management solution (Cookie Consent Manager), implemented across all platforms of the ecosystem. The CMP ensures:
- Granular consent — the client consents separately to each category of cookies
- Audit trail — each consent is recorded with a timestamp, IP address (anonymised) and policy version
- Easy management — consent may be changed or withdrawn at any time
- GDPR compliance — consent is freely given, specific, informed and unambiguous (Article 7 GDPR)
Default state
On the first visit, only strictly necessary cookies are active. Analytical, functional and marketing cookies are activated only after your express consent. We store the consent in the cookie_consent_v2 cookie for a period of 12 months.
3. Cookie categories and legal bases
| Category | Purpose | Legal basis (GDPR) | Retention period | Status |
|---|---|---|---|---|
| Strictly necessary | Website operation, security, session, CSRF protection, load balancing | Legitimate interest (Article 6(1)(f)) — consent not required | Session – 1 year | Mandatory |
| Functional | Language settings, theme (light/dark), remembered forms, video presets | Consent (Article 6(1)(a)) | 1 year | |
| Analytical | Google Analytics 4 — traffic, behaviour and conversion analysis; Microsoft Clarity — heatmaps | Consent (Article 6(1)(a)) | 13 months | |
| Marketing | Meta Pixel — retargeting, conversions; Google Ads — remarketing; LinkedIn Insight Tag | Consent (Article 6(1)(a)) | 90 days – 2 years | |
| Personalisation | Content recommendations, offer adjustments based on behaviour | Consent (Article 6(1)(a)) + Article 22 for profiling | 6 months |
Warning
Disabling strictly necessary cookies will affect the operation of the website (login, security, shopping cart). All other cookies are optional and do not affect basic functionality.
4. Granular list of cookies
Below is the complete list of all cookies used by Findes Group. The list is updated with every Cookie Audit.
4.1 Strictly necessary cookies
| Cookie name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
_session | Findes Group | Session of the logged-in user | Session | First-party |
csrf_token | Findes Group | Protection against CSRF attacks | Session | First-party |
cookie_consent_v2 | Findes Group | Storing your cookie consent | 12 months | First-party |
__cf_bm | Cloudflare | Bot protection and DDoS prevention | 30 minutes | Third-party |
cf_clearance | Cloudflare | Security challenge (CAPTCHA) | 1 year | Third-party |
4.2 Functional cookies
| Cookie name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
lang_pref | Findes Group | Stores the selected interface language | 1 year | First-party |
ui_theme | Findes Group | Light/dark theme | 1 year | First-party |
form_autofill | Findes Group | Pre-filling of forms | 30 days | First-party |
yt-player-cookies-enabled | YouTube | YouTube player settings | 6 months | Third-party |
4.3 Analytical cookies
| Cookie name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
_ga | Google Analytics 4 | Distinguishing between users (anonymised ID) | 13 months | Third-party |
_ga_XXXXXXXX | Google Analytics 4 | Storing GA4 session state | 13 months | Third-party |
_gid | Google Analytics | Distinguishing between users (24h) | 24 hours | Third-party |
_gat | Google Analytics | Request rate limiting | 1 minute | Third-party |
_clck | Microsoft Clarity | Unique ID for heatmap analytics | 1 year | Third-party |
_clsk | Microsoft Clarity | Grouping clicks into a single session | 1 day | Third-party |
4.4 Marketing cookies
| Cookie name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
_fbp | Meta (Facebook) | Conversion tracking and retargeting | 90 days | Third-party |
_fbc | Meta (Facebook) | Tracking clicks on ads | 90 days | Third-party |
_gcl_au | Google Ads | Google Ads conversion tracking | 90 days | Third-party |
_gcl_aw | Google Ads | Tracking clicks on ads | 90 days | Third-party |
li_fat_id | LinkedIn Insight Tag — conversion tracking | 30 days | Third-party | |
UserMatchHistory | ID synchronisation for LinkedIn retargeting | 30 days | Third-party |
5. Cookies by platform
Findes Group operates several platforms. Each platform has its own cookie implementation, which differs slightly:
| Platform | Necessary | Analytical | Marketing | Specifics |
|---|---|---|---|---|
| findes.si | Yes | GA4 + Clarity | Meta + Google Ads + LinkedIn | Main site — all cookies |
| Investra.io | Yes | GA4 | Meta Pixel | Investment platform — without LinkedIn |
| Unifyr.space | Yes | GA4 | Google Ads | SaaS platform — without Meta |
| sinisadagary.com | Yes | GA4 + Clarity | Meta + Google Ads | Personal brand |
Shared consent
Your consent on findes.si applies only to findes.si. Each platform collects consent separately. Cookies are not transferred automatically between platforms.
6. Cross-border data transfers via cookies
Some third-party providers whose cookies we use transfer data to countries outside the EU/EEA. Below is an overview of all transfers and their legal mechanisms:
| Provider | Country of transfer | Legal mechanism | Privacy policy |
|---|---|---|---|
| Google (Analytics, Ads) | USA (Google LLC) | EU-US Data Privacy Framework (DPF) — in force since Jul. 2023 | policies.google.com |
| Meta (Facebook Pixel) | USA (Meta Platforms) | EU-US Data Privacy Framework (DPF) | facebook.com/privacy |
| Microsoft (Clarity) | USA (Microsoft Corp.) | EU-US Data Privacy Framework (DPF) + SCCs | privacy.microsoft.com |
| USA (LinkedIn Corp.) | EU-US Data Privacy Framework (DPF) | linkedin.com/legal | |
| Cloudflare | USA (Cloudflare Inc.) | SCCs (Standard Contractual Clauses) + DPF | cloudflare.com |
| YouTube (Google) | USA (Google LLC) | EU-US Data Privacy Framework (DPF) | policies.google.com |
Note on the DPF
The EU-US Data Privacy Framework was adopted in July 2023 (Commission Decision C(2023) 4745). It ensures an adequate level of protection for transfers to the USA. In the event the DPF is invalidated, we will switch to SCCs immediately. Findes Group has implemented IP anonymisation in Google Analytics 4 (anonymize_ip: true).
7. Session replay, heatmap and live chat tools
7.1 Microsoft Clarity (Heatmap & Session Replay)
Findes Group uses Microsoft Clarity to analyse visitor behaviour through heatmaps and session recordings (session replay). Clarity collects:
- Mouse movements, clicks and scrolling on the page
- Session recordings (anonymised video of interaction with the page)
- Device and browser data
Protective measures
Clarity automatically masks all input fields (passwords, email addresses, credit cards). Findes Group has activated additional masking for all forms containing personal data. Session recordings are retained for 30 days, after which they are deleted automatically.
7.2 Live Chat (Crisp)
Findes Group uses Crisp for live chat support. Crisp sets the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
crisp-client%2Fsession%2F* | Live chat conversation session | 6 months |
crisp-client%2Fwebsite%2F* | Website identification | Persistent |
Crisp stores data in the EU (France). Privacy policy: crisp.chat/privacy
8. Managing and withdrawing consent
8.1 Via the Cookie Consent Manager
Click the cookie icon in the bottom-left corner of any Findes Group page and select the categories of cookies that you allow or refuse.
8.2 Via browser settings
| Browser | Path to cookie settings |
|---|---|
| Google Chrome | Settings → Privacy and security → Cookies and other site data |
| Mozilla Firefox | Settings → Privacy and security → Cookies and site data |
| Safari | Settings → Privacy → Manage website data |
| Microsoft Edge | Settings → Cookies and site permissions |
| Opera | Settings → Advanced → Privacy and security → Content settings |
8.3 Opt-out at individual providers
- Google Analytics opt-out: tools.google.com/dlpage/gaoptout
- Meta (Facebook) opt-out: facebook.com/adpreferences
- Google Ads opt-out: adssettings.google.com
- LinkedIn opt-out: linkedin.com/psettings
- Microsoft Clarity opt-out: privacy.microsoft.com
- General advertising opt-out: www.youronlinechoices.eu
Warning
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Strictly necessary cookies remain active regardless of your decision.
9. Consent archive and Do Not Track (DNT)
9.1 Consent archive
Findes Group maintains an audit trail of all consents in accordance with Article 7(1) GDPR. Each record contains:
- Timestamp of the consent (date, time, time zone)
- Version of the cookie policy in force at the time of consent
- Cookie categories for which consent was given
- Anonymised device identifier (not the IP address)
Consent records are retained for 3 years after the consent expires, after which they are securely deleted. Access to the archive is restricted to the DPO and an authorised compliance officer.
9.2 Do Not Track (DNT) signal
Findes Group's position on DNT
Findes Group honours the browser's DNT signal for analytical cookies. If your browser sends a DNT=1 signal, Findes Group will not activate Google Analytics and Microsoft Clarity, regardless of your consent in the CMP. Note: the DNT signal does not affect strictly necessary cookies, which are required for the website to operate.
10. Cookies and minors
In accordance with Article 8 GDPR and the Consumer Protection Act (ZVPot-1), Findes Group takes the following measures to protect minors:
| Platform | Min. age | Required consent | Action upon breach |
|---|---|---|---|
| findes.si | 18 years | Parental consent for 16–17 years | Immediate deletion of the account and data |
| Findes Academy | 16 years | Parental consent for 16–17 years | Access disabled, refund of payment |
| Investra.io | 18 years | Not permitted for minors | Immediate deletion, notification to parents |
Marketing cookies and minors
Findes Group does not collect marketing cookies from persons known or reasonably suspected to be under 18 years of age. Meta Pixel and Google Ads are configured to exclude targeting of minors.
11. Rights of individuals in relation to cookies
In relation to cookies, you have the following rights under the GDPR:
| Right | Description | How to exercise | Response deadline |
|---|---|---|---|
| Withdrawal of consent | Withdraw consent for optional cookies at any time | Cookie Consent Manager | Immediate effect |
| Access to data | Request a list of cookies and data we hold about you | dpo@findes.si | 30 days |
| Erasure of data | Request the deletion of all cookies and data collected via them | dpo@findes.si or browser settings | 30 days |
| Complaint | Complaint to the supervisory authority | Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia): www.ip-rs.si | — |
DPO contact
For all requests concerning cookies and data protection, contact our Data Protection Officer: dpo@findes.si
12. Policy changes and Cookie Audit
12.1 Changes to the cookie policy
We may update this cookie policy at any time. We will notify you of material changes:
- Via a banner on the website (for all visitors)
- Via email (for registered users)
- Through a new consent request via the CMP (for material changes)
12.2 Cookie Audit
| Audit date | Policy version | Person responsible | Findings |
|---|---|---|---|
| 17 May 2026 | v2.0 | DPO Findes Marketing d.o.o. | Added: Clarity, LinkedIn, Crisp; cross-border transfers updated (DPF) |
| 1 January 2026 | v1.0 | DPO Findes Marketing d.o.o. | Initial version |
The next Cookie Audit is scheduled for: May 2027
Compliance
This cookie policy complies with: GDPR (EU Regulation 2016/679), the ePrivacy Directive (2002/58/EC), the Electronic Communications Act (ZEKom-2), EDPB guidelines on cookies (May 2020, updated 2023) and the EU-US Data Privacy Framework (July 2023).
Findes Marketing d.o.o.
Litostrojska cesta 44A, 1000 Ljubljana
dpo@findes.si | +386 70 774 277
Document version
Date of adoption: 17 May 2026 | Version: 2.0 | Next revision: May 2027