Cookie Policy
This policy explains which cookies we use on panonex.com, for what purposes, and how you can manage them. We always use strictly necessary and functional cookies, and Google Analytics and Google Ads cookies only with your consent, given separately for each service.
1. What are cookies
Cookies are small text files stored on your device when you visit the site. They enable the site to function properly, to remember your settings, and to keep your purchase secure.
2. Which cookies we use
Strictly necessary and functional cookies are needed for the site to work or remember your settings. We set Google Analytics and Google Ads cookies only if you have allowed them:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| panonex-session | Maintaining the user session and request security (CSRF). | Session (up to 2 hours) | Strictly necessary |
| XSRF-TOKEN | Protection against CSRF attacks when submitting forms. | Session (up to 2 hours) | Strictly necessary |
| cart_token | Linking a guest's cart to the device and order. | 30 days | Strictly necessary |
| locale | Remembering the selected site language. | Up to 400 days | Functional |
| currency | Remembering your chosen display currency (EUR/RSD). | Up to 400 days | Functional |
| appearance | Remembering the selected display theme. | Up to 1 year | Functional |
| cf_* (Cloudflare Turnstile) | Protection against abuse and automated attacks during payment. | Third party (Cloudflare) | Strictly necessary |
| __stripe_mid | Stripe — euro payment processing and fraud prevention. | Up to 1 year | Strictly necessary |
| __stripe_sid | Stripe — euro payment processing and fraud prevention. | 30 minutes | Strictly necessary |
| _ga | Google Analytics — distinguishes visitors in aggregate site usage statistics. | Up to 2 years | Analytics (with consent) |
| _ga_G543LC54BV | Google Analytics — keeps the session state (visit count and time). | Up to 2 years | Analytics (with consent) |
| _gcl_au | Google Ads — links a booking to a visit from one of our ads. | 90 days | Advertising (with consent) |
| _gcl_aw, _gcl_ag, _gcl_gb | Google Ads — the click identifier of our ad, to measure the bookings the ad brought. | 90 days | Advertising (with consent) |
| _gcl_gs | Google Ads — technical data on the visit from an ad. | 90 days | Advertising (with consent) |
| _gcl_ls | Google Ads — the tag's working record of visits from ads. | Until deleted (browser local storage) | Advertising (with consent) |
Audience measurement without cookies
We measure visits to the site with Umami, open-source software that runs on our own server. Umami sets no cookies, stores nothing on your device and does not follow you across other websites. That is why it is not in the table above, and why we do not ask for your consent to it.
What Umami records, and on what legal basis, is described in the Privacy Policy.
3. Legal basis and consent
Strictly necessary cookies are set on the basis of the legitimate interest in providing the requested service, and, in accordance with the personal data protection regulations (GDPR / Personal Data Protection Act), no separate consent is required for them.
We set Google Analytics and Google Ads cookies solely on the basis of your prior consent, which you give separately for each service in the cookie notice. Until you give either, Google's script does not load and no data is sent to Google; if you allow only one service, the other stays off.
4. Third-party cookies
To protect against abuse during payment, we use the Cloudflare Turnstile service, which may set its own technical cookies. During the payment itself, on the bank's secured pages, the processor Banca Intesa ad Beograd may also set cookies.
Google Analytics
If you allow analytics, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), whose parent company is Google LLC (USA). The cookies _ga and _ga_G543LC54BV are then set on your device, and Google records which pages you visit, where you came from, your device and browser type, your approximate location and the steps of your search and purchase. We do not send your name, email address or phone number with this data.
The purpose is aggregate statistics on how the site is used, so that we can improve it, and the legal basis is your consent. We do not use the data for advertising: Google signals and ad personalisation are switched off. The _ga cookies expire after 2 years at most.
The data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found that certified companies provide an adequate level of data protection.
Google Ads
If you allow Google Ads, we use Google Ads, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), whose parent company is Google LLC (USA), only to measure which of our ads lead to bookings. When you reach the site by clicking one of our ads, Google adds a click identifier to the page address, which we then keep in the _gcl_aw cookie (_gcl_ag or _gcl_gb on some devices); the _gcl_au cookie lets a booking be linked to that visit. As it loads, the Google Ads tag also sends Google the address of the page you are on, but never the address of your order's page. When you complete a booking, we send Google the order number and what the booking is worth to us, and Google links them to the ad click.
The legal basis is your consent. We do not send your name, email address or phone number, and ad personalisation and remarketing are switched off. The _gcl_* cookies expire after 90 days, and alongside them the tag keeps a _gcl_ls entry in your browser's local storage. Google may also set its own cookies on its own domains (such as google.com and doubleclick.net), under its own rules.
The data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found that certified companies provide an adequate level of data protection.
5. Managing cookies
You can delete or block cookies at any time in your web browser's settings. Please note that blocking strictly necessary cookies may prevent purchases and the proper functioning of certain parts of the site.
You can withdraw your consent to Google Analytics and Google Ads at any time, for each service separately and as easily as you gave it: with the button below or under “Cookie settings” in the site footer. Withdrawal does not affect the lawfulness of processing before it. Once you withdraw, we stop sending data to Google for that service and delete its cookies (_ga, or the _gcl_* cookies and the _gcl_ls entry) from your device.
6. Changes to this policy
We may update this policy from time to time in order to align it with changes to the site or with regulations. The applicable version is always published on this page.
7. Contact
For questions regarding cookies and data protection, please see our Privacy Policy or contact us:
- info@panonex.com
- Phone
- —