Cookie Policy
This Cookie Policy applies to branddeck.co, app.branddeck.co and related BrandDeck pages or tools that store information on, or access information from, a user's device. It must be read with the Privacy Policy.
1. Who we are
Snoepfabriek B.V., trading as BrandDeck ("BrandDeck", "we", "us" or "our") is responsible for the use of cookies and similar technologies on the BrandDeck website and application where BrandDeck determines their purposes. Our address is Vondellaan 146, 3521 GH Utrecht, the Netherlands. Questions can be sent to [email protected].
2. Scope and legal framework
This policy explains which cookies and similar technologies may be used, why they are used, whether consent is required, how long they remain and how a choice can be changed.
The placement of or access to information on a device is governed in the Netherlands by Article 11.7a of the Dutch Telecommunications Act. Where the information is personal data, the GDPR also applies. Strictly necessary technologies may be used without consent. Non-essential technologies are not activated before any consent required by law has been obtained.
3. What cookies and similar technologies are
A cookie is a small data file placed on a device when a website or application is used. BrandDeck may also use local storage, session storage, software development kits, pixels, tags or similar mechanisms. These technologies can maintain a secure session, remember a setting, record a consent choice, measure use or detect errors.
A technology may be first party, meaning it is set by a BrandDeck domain, or third party, meaning it is set by another provider. Session technologies expire when the session or browser closes; persistent technologies remain for a defined period unless deleted earlier.
4. Categories used by BrandDeck
| Category | Purpose | Consent position |
|---|---|---|
| Strictly necessary | Required to provide a feature explicitly requested by the user, such as authentication, secure session management, load balancing, fraud prevention, request integrity or saving a consent choice. | No consent where the legal exemption applies. These technologies cannot be disabled through the preference centre if the service cannot function safely without them. |
| Functional or preference | Remembers a user-requested preference, such as language or display settings. | No consent only where the technology is genuinely necessary to provide the requested setting and has no additional purpose; otherwise prior consent. |
| Analytics | Measures page views, feature use, navigation, session duration and aggregate performance to improve the website or application. | Prior consent unless the specific configuration qualifies for a narrow statutory exemption because it has no or only minor privacy impact. |
| Error and performance monitoring | Detects faults, crashes, latency and technical errors. | Classification depends on the data, provider and configuration. If not strictly necessary or if used for broader tracking, prior consent is required. |
| Advertising or cross-site tracking | Builds profiles or tracks users across websites or applications for advertising or commercial targeting. | Prior explicit consent is required. BrandDeck's current declared position is that it does not use these technologies; periodic technical scans must confirm this. |
For processing for which BrandDeck is the controller, BrandDeck is responsible for deciding why and how the personal data is processed. For Customer Content, the relevant BrandDeck customer is normally the controller or an upstream processor.
5. When consent is required
Where consent is required, the technology must remain blocked until the user has actively chosen to allow the relevant category. Consent must be freely given, specific, informed and unambiguous. Continuing to browse, silence or a pre-ticked box is not consent.
BrandDeck must not treat "legitimate interests" as a substitute for consent where the Dutch cookie rules require prior permission to store or access information on a device.
6. How the consent mechanism must work
The BrandDeck consent interface must implement the following controls:
- "Accept" and "Reject" options are presented with equal prominence on the first layer;
- non-essential categories are switched off by default;
- purposes and categories are described in clear language before a choice is made;
- the user can make a granular choice without unnecessary extra clicks;
- no non-essential technology loads before consent;
- refusal does not prevent access to the core website or service, except where a feature genuinely depends on the optional technology;
- the consent record stores the choice, policy version, time and technical evidence needed to demonstrate consent;
- withdrawal is as easy as giving consent; and
- the user is asked again only when necessary, for example after a material purpose or vendor change or expiry of the recorded choice.
reset cookies????
7. Third-party technologies and integrations
Where a third party places or receives data through a website technology, the controlled inventory must identify the provider, purpose, data, retention period, processing location and any transfer safeguards. A third party may act as BrandDeck's processor, joint controller or independent controller depending on the facts.
Optional sign-in or integration flows may temporarily set technologies on the provider's domain. When a user chooses such a flow, the provider's own cookie and privacy information may apply. Customer-enabled integrations are not activated merely because the BrandDeck website displays their availability.
8. How to change or withdraw a choice
Open the "Cookie settings" link on the BrandDeck website or application.
- Switch optional categories on or off.
- Save the new choice. Technologies that no longer have a valid basis must stop being used.
- Where technically possible, BrandDeck should remove its own non-essential cookies when consent is withdrawn. A user may also delete stored technologies through browser settings.
Withdrawal does not affect processing that was lawful before withdrawal. If analytics or another provider has already received personal data, deletion rights may need to be exercised separately in accordance with the Privacy Policy and the provider's role.
9. Browser controls
Most browsers allow users to view, delete or block cookies and site data. Blocking strictly necessary technologies may prevent authentication or other core features from working. Browser controls supplement, but do not replace, the BrandDeck consent mechanism for technologies that require prior consent.
10. Retention and review
Each technology must have the shortest retention period necessary for its purpose. Exact duration, domain and provider must appear in Appendix A. BrandDeck must review the inventory after material website or application changes and at least every six months through a technical scan of cookies, local storage, session storage, scripts, pixels and third-party network calls.
Consent records should be retained only for the period needed to demonstrate compliance and normally no longer than five years after a choice is replaced or withdrawn. A refusal should be remembered for a reasonable period so the user is not repeatedly asked.
11. Changes and contact
The current version will be published at branddeck.co/cookies. Material changes to purposes or providers require an updated inventory and, where necessary, renewed consent. Questions can be sent to [email protected].
