Cookie Policy
Effective:
1. In short
- We set one cookie of our own, and only if you use the EN/HR language switch: it remembers the language you picked. We don't use social media pixels.
- We store your consent choice in your browser's local storage.
- Google Tag Manager loads on every page. It sets no cookies and measures nothing by itself: it runs our Google tools only once you allow them.
- We load analytics (Cloudflare Web Analytics, which is cookie-free, and Google Analytics, which sets cookies) only if you allow it.
- With a separate "Ad measurement" consent, Google Ads learns when a visit from one of our ads ends in an inquiry.
- With a separate "Personalised ads" consent, Google may add you to our ad audiences and show you our ads later (retargeting).
- You can change your choice at any time: .
2. What cookies and similar technologies are
Cookies are small files a website stores in your browser. The same rules cover similar technologies such as local storage and scripts that read information from your device. Under Art. 43(4) of the Croatian Electronic Communications Act (ZEK), which implements Art. 5(3) of the EU ePrivacy Directive, we may use them without your consent only when they are strictly necessary for a service you asked for. Everything else needs your prior consent.
3. Strictly necessary (always active)
| Name | Provider / type | Purpose | Duration |
|---|---|---|---|
| cookie-consent | sourc.co / local storage | Remembers your choice about analytics and ad measurement, so we don't ask on every page | 12 months, then we ask again |
| lang | sourc.co / cookie | Remembers the language you picked with the EN/HR switch, so the site opens in it next time. Set only when you click the switch | 12 months |
| __cf_bm | Cloudflare / cookie | Detects and blocks malicious bots. Set only when Cloudflare's protection needs it | 30 minutes of inactivity |
| cf_clearance | Cloudflare / cookie | Remembers that you passed a security check. Set only if a check is shown | Per the security check, usually minutes to hours |
Your consent choice never leaves your browser. We don't receive it.
Visitors from Croatia first see the Croatian version of the site. For that, our host Cloudflare passes the country of your internet connection (worked out from your IP address) with each page request. Nothing is stored on your device and we don't keep it. The language switch always overrides it.
4. Google Tag Manager (loads on every page)
| Tool | Provider | What it does | Storage on your device |
|---|---|---|---|
| Google Tag Manager (gtm.js) | Google Ireland Limited, Ireland (with Google LLC, USA) | Loads our Google tools and runs only the ones you allowed. Until you choose, Google's consent mode is set to deny everything | None: no cookies or local storage |
Loading it, like loading any file from another server, sends Google your IP address and browser details. According to Google, Tag Manager keeps only standard request logs, deleted within 14 days, and aggregated data about which tags fired, without IP addresses; see Google's Tag Manager data privacy page. The legal basis is our legitimate interest in running the site's measurement tools and enforcing your cookie choice (Art. 6(1)(f) GDPR).
5. Analytics (only with your consent)
| Tool | Provider | What it collects | Storage on your device |
|---|---|---|---|
| Cloudflare Web Analytics (beacon.min.js) | Cloudflare, Inc., USA | Page URL, referrer, browser and device type, country, page-load timings, reported in aggregate | None: no cookies or local storage, no fingerprinting |
| Google Analytics 4 (through Google Tag Manager) | Google Ireland Limited, Ireland (with Google LLC, USA) | Pages viewed, how far down a page you scroll (25, 50, 75 and 90%), referrer and campaign, browser and device type, approximate location (country, city), whether you sent a contact or quote form (with the "I am" type you picked and the page you sent it from) and whether you requested the sourcing guide. Never your name, email, phone, company or what you wrote. Google doesn't store IP addresses. Google signals stay off unless you allow personalised ads | Cookies _ga and _ga_<ID>: tell visits apart, 13 months |
Both tools read information from your browser, so they run only after you click "Accept all" or switch analytics on. Before that, Cloudflare's analytics doesn't load and Google Analytics doesn't run: the only request to Google is Google Tag Manager itself (see above). The legal basis is your consent (Art. 6(1)(a) GDPR). More about the processing is in our Privacy Policy.
6. Ad measurement (only with your consent)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au (and the gclid in the address of an ad click) | Google Ireland Limited, Ireland (with Google LLC, USA) | Lets Google Ads count an inquiry as a conversion when the visit came from one of our Google ads, so we know which ads work | 90 days |
This works through Google Analytics, so it only applies when analytics is also on. In Google's consent mode it grants ad_storage and ad_user_data. On its own it doesn't put you in any ad audience. The legal basis is your consent (Art. 6(1)(a) GDPR).
7. Personalised ads and retargeting (only with your consent)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| IDE (on doubleclick.net), test_cookie | Google Ireland Limited, Ireland (with Google LLC, USA) | Recognises your browser on Google's ad network so Google can show you sourc:co ads on Google Search, YouTube and partner sites, and limit how often you see them. Set on Google's own domain | IDE 13 months, test_cookie 15 minutes |
| Google signals | Google Ireland Limited, Ireland (with Google LLC, USA) | If you're signed in to a Google account with ad personalisation on, links your visits across devices for our audiences and reports | Per your Google account settings |
With this consent Google Analytics may add you to our remarketing audiences in Google Ads (for example "visited the pricing page"). In Google's consent mode it grants ad_personalization, and it only applies when analytics is also on. Google acts as an independent controller for how it uses this data in its ad network; see Google's business data responsibility page. You can also manage ad personalisation in your Google account at myadcenter.google.com. The legal basis is your consent (Art. 6(1)(a) GDPR).
8. What we don't use
- No social media pixels (Meta, LinkedIn, TikTok) and no selling of data.
- No embedded videos, maps or social widgets. Fonts are served from our own domain.
- The WhatsApp button is a plain link. WhatsApp receives data only when you click it and open the chat.
9. Changing your choice
- Click "Cookie settings" in the footer, or . Withdrawing consent is as easy as giving it, and it doesn't affect processing that already took place. When you withdraw it, we delete the Google cookies set on our domain. Cookies Google sets on its own domains (such as IDE) can only be removed in your browser settings.
- You can also block or delete cookies and site data in your browser settings. The site keeps working without them.
10. Contact
Questions about cookies: marko@sourc.co. This policy applies to https://sourc.co.