Cookie Policy

---

1. What this policy covers

This Cookie Policy explains which cookies and similar technologies we use on stoneroots.club and on our web shop at shop.stoneroots.club, what they do, how long they last, and how you can control them.

It supplements our Privacy Policy, available at https://stoneroots.club/privacy/, which explains more generally how we process personal data.

We use cookies in accordance with Article 225 of the Slovenian Electronic Communications Act (Zakon o elektronskih komunikacijah, ZEKom-2) and Regulation (EU) 2016/679 (GDPR).

---

2. What cookies are

A cookie is a small text file that a website stores on your device when you visit it. On a later visit the website can read the file back. Cookies allow a site to remember things such as the contents of your cart, your language choice, or whether you have already been shown a notice.

Alongside cookies, similar technologies exist that serve the same purposes, including local storage, session storage and pixels, meaning small invisible images loaded from another server that register that a page has been opened. Where we refer to cookies in this policy, we mean all of these.

Cookies set by us under our own domain are first-party cookies. Cookies set by a service we use, under that service's domain, are third-party cookies.

---

3. Your consent

Strictly necessary cookies are set without your consent, because the site cannot function without them and the law does not require consent for them. They are the ones that keep your cart, your session and the checkout working, and that protect the site against abuse.

All other cookies, meaning analytics, functional preference and marketing cookies, are set only after you have given your consent through the cookie banner shown on your first visit. You can accept all, reject all, or choose by category. Rejecting them has no effect on your ability to browse the site or complete a purchase.

You may withdraw or change your consent at any time through the cookie settings link in the footer of our website. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before it.

Where cookies process personal data, the legal basis is your consent under Article 6(1)(a) GDPR, except for strictly necessary cookies, where the basis is our legitimate interest in the secure and functional operation of the web shop under Article 6(1)(f) GDPR, and, for the checkout, the performance of a contract under Article 6(1)(b) GDPR.

---

4. Which cookies we use

Our web shop runs on the Shopify platform, and Shopify sets a number of cookies that are required for the shop, the cart and the checkout to work. Our website is delivered through Cloudflare, which sets cookies to protect the site against automated traffic. The tables below list the main ones. Exact names, durations and the presence of individual cookies may change when the platform or an app is updated, and we review this list periodically.

4.1 Strictly necessary

Cookie	Set by	Purpose	Duration
_ab	Shopify	Access to the shop administration	2 years
cart, cart_ts, cart_ver, cart_sig, cart_currency	Shopify	Keeps the contents, currency and integrity of your shopping cart	up to 2 weeks
checkout, checkout_token	Shopify	Runs the checkout process	up to 3 weeks
_secure_session_id, secure_customer_sig	Shopify	Secure session and, where you have an account, secure sign-in	24 hours / 20 years
storefront_digest	Shopify	Remembers whether you have entered the password on a protected storefront	2 years
keep_alive	Shopify	Keeps the buyer's regional session	up to 2 weeks
localization	Shopify	Remembers the country and language you selected	2 weeks
_tracking_consent, _cmp_a	Shopify	Records your cookie preferences so that we do not ask again on every page	1 year
shopify_pay_redirect	Shopify	Manages the accelerated checkout redirect	session to 1 year
__cf_bm	Cloudflare	Distinguishes human visitors from automated traffic	30 minutes
cf_clearance	Cloudflare	Records that a security check has been passed	up to 1 year

4.2 Analytics

Set only with your consent. They tell us how many people visit, which pages and which drops they look at, and where they came from, in aggregate. We use this to improve the shop.

Cookie	Set by	Purpose	Duration
_shopify_y, _y	Shopify	Distinguishes unique visitors for shop analytics	1 year
_shopify_s, _s	Shopify	Distinguishes individual visits (sessions)	30 minutes
_shopify_sa_t, _shopify_sa_p	Shopify	Analytics relating to marketing and referrals	30 minutes
_landing_page, _orig_referrer	Shopify	Records the page you landed on and the site you arrived from	up to 2 weeks
_ga, _ga_*	Google Analytics	Statistics about the use of the site, distinguishing visitors and sessions	up to 2 years

4.3 Marketing

Set only with your consent. They allow us to measure whether an advertisement or a post led to a visit or a purchase, and to show our ads to people who have already shown interest.

Cookie	Set by	Purpose	Duration
_fbp	Meta	Measures the effect of advertising on Facebook and Instagram and enables audience targeting	3 months
_gcl_au	Google	Measures conversions from advertisements	3 months

If we do not run advertising campaigns in a given period, no marketing cookies are set even if you consent to them.

---

5. Third parties and their own policies

Some cookies are set by third parties who determine the purposes of their own processing and act as independent controllers for it. We recommend that you also read their policies:

• Shopify Inc., our web shop platform: https://www.shopify.com/legal/privacy
• Cloudflare, Inc., delivery and security of our website: https://www.cloudflare.com/privacypolicy/
• Meta Platforms Ireland Ltd., advertising measurement and our social media presence: https://www.facebook.com/privacy/policy
• Google Ireland Ltd., analytics and advertising: https://policies.google.com/privacy

Where a third-party service transfers personal data outside the European Economic Area, that transfer is governed by the safeguards described in Section 8 of our Privacy Policy.

---

6. Controlling cookies in your browser

Independently of our cookie banner, you can block or delete cookies in your browser settings, and set your browser to warn you before a cookie is stored. Blocking all cookies, including the strictly necessary ones, will prevent the cart and the checkout from working.

Instructions for the most common browsers:

• Chrome: Settings → Privacy and security → Third-party cookies
• Safari: Settings → Privacy
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Edge: Settings → Cookies and site permissions

Deleting cookies also deletes the record of your consent choices, so the banner will appear again on your next visit.

---

7. Other technologies

Local and session storage. Our site and the Shopify platform store some data locally in your browser, for example your language preference or the state of the cart. This data is not sent to a server with each request and is deleted when you clear your browser data.

Email tracking. Our newsletters are sent through Brevo and contain a tracking pixel that registers whether an email has been opened and which links in it have been clicked, so that we can see whether our mailings are of interest. You can prevent this by setting your email client not to load remote images, and by unsubscribing using the link in every email.

Our WhatsApp channel is operated on the WhatsApp platform. Joining it is a separate decision on your side, and processing there is governed by the WhatsApp and Meta terms and privacy policy in addition to our own Privacy Policy.

---

8. Changes to this policy

We may amend this Cookie Policy when we change the tools we use or when the law changes. The current version, with its version number and date, is always published on our website. Where we introduce a new category of cookies requiring consent, we will ask for your consent again.

---

9. Contact