Cookie Policy

1.What are cookies

Cookies are small text files placed on your device by a website you visit. They allow the website to remember information about your visit, such as your preferred language and other settings. "Similar technologies" include browser local storage, session storage, and pixel tags. In this policy we use "cookies" to refer to all of these.

Under Polish law (Article 398 of the Electronic Communications Law of 12 July 2024, Prawo komunikacji elektronicznej, which replaced the analogous provisions of the repealed Telecommunications Act of 2004 on 10 November 2024) and the EU ePrivacy Directive, we are required to inform you about cookies that are not strictly necessary for the operation of the service, and to obtain your consent before placing such cookies on your device. The two preference cookies described below are strictly necessary and need no consent. The cookies of Google Analytics and PostHog are not strictly necessary, so we ask for your consent through the cookie banner before either sets any, and you can decline or withdraw consent at any time. If you decline, PostHog's anonymous counting described below stores and reads no identifier on your device, so it is not a cookie use that requires consent.

2.Cookies on kepta.legal

Marketing website (kepta.legal): one strictly necessary cookie. Our marketing site sets one first-party cookie. `NEXT_LOCALE` remembers the site you chose with the country and language selector (for example Poland in English, or the United Kingdom) for 12 months, so that kepta.legal opens on that site next time. It contains only a site code such as `en-GB`, no personal data, and is set only when you choose a site. The country and language you see, including the price list and currency, come from the address of the page (for example /pl/en/ or /gb/en/), not from a cookie. An earlier version of the site also set a `kepta_jx` cookie for the price-list country; it is no longer used and is deleted on your next visit. `NEXT_LOCALE` is a strictly necessary preference cookie for the service you asked for and is therefore exempt from the consent requirement. Beyond it, the site sets analytics cookies only if you accept analytics (Google Analytics and PostHog) in the cookie banner (see below); there are no advertising pixels, no social-media widgets, no chat tools, and no marketing-automation scripts on kepta.legal.

Local storage: your cookie choice. When you accept or decline analytics in the cookie banner, a single browser local-storage entry (`kepta_consent`) records that choice, so the banner is not shown again on that browser and, if you accepted, Google Analytics and PostHog do not reload on every page. PostHog keeps its own note of the same choice in local storage (`__ph_opt_in_out_<project-key>`), so it knows whether to use cookies. Neither entry contains personal data or leaves your device, and you can clear them at any time in your browser settings to see the banner again.

Analytics: Google Analytics, opt-in. If you accept in the cookie banner, we use Google Analytics (Google Ireland Limited) to count page views and understand which pages are useful. It sets first-party cookies named `_ga` and `_ga_<container-id>`, active for up to 2 years, and Google processes the data under its own privacy policy and processor terms. It is not used if you decline, and you can withdraw consent at any time by clearing the `kepta_consent` local-storage entry described above. See our Privacy Policy for the retention period and the safeguards that apply to any transfer outside the EEA.

Analytics: PostHog, with cookies if you accept, anonymous if you decline. PostHog (PostHog, Inc.; our project is hosted in PostHog's EU cloud in Frankfurt) works in the mode PostHog itself recommends for sites with a cookie banner. Before you choose, it only loads its configuration from kepta.legal and records nothing. If you accept, it records page views, clicks and form-submission outcomes (for example whether a request was sent, never what you typed into the form), browser errors, and session recordings that replay how pages were used, with every form field masked; it sets one first-party cookie, `ph_<project-key>_posthog`, active for up to 1 year, holding a random identifier, and keeps a copy in local and session storage. If you decline, it sets no cookie, stores nothing on your device apart from the note of your choice described above, makes no session recordings and builds no profile; it only counts page views, clicks, form outcomes and errors anonymously. To tell unique visits apart on a given day, PostHog computes on its own servers a one-way hash of your IP address and browser user agent with a secret that changes every day, and does not store your IP address, so the same person visiting on two days counts as two visits and cannot be followed across days. To object to this anonymous counting, turn on Global Privacy Control or Do Not Track in your browser: kepta.legal then does not start PostHog at all unless you accept analytics in the banner. You can change your choice at any time by clearing the `kepta_consent` entry. See PostHog's privacy policy and DPA.

Fonts and assets. Web fonts are served from the same origin as the site (`kepta.legal`) and do not set cookies. No third-party font CDN is used.

3.Cookies on the Kepta Platform

The Kepta platform is not available at the launch of this website. When it goes live it will be served from `agent.kepta.legal` and other tenant subdomains, and will use a small number of strictly necessary cookies and local-storage items to operate. These are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are essential for the service the user has requested. Everything in this section applies only when you use the Kepta platform, not to the marketing website.

Authentication. A first-party session cookie (for example `kepta_session`) keeps you signed in for the duration of your session. It is HttpOnly, Secure, SameSite=Lax, and is deleted when you sign out.

CSRF protection. A short-lived first-party cookie (for example `kepta_csrf`) protects against cross-site request forgery on form submissions.

UI state. Local storage holds non-personal interface preferences such as panel widths, recently viewed items, and theme. This data never leaves your browser.

We will not deploy advertising, analytics-cookie, or fingerprinting technologies on the platform.

4.Your choices

Because kepta.legal sets only the strictly necessary language and price-list-country cookies and no non-essential cookies, there is nothing to decline on the marketing site. On the Kepta platform, once it is live, declining the strictly necessary session cookie would prevent you from signing in; we therefore cannot offer an opt-out for that single cookie without disabling the service.

You can manage cookies generally in your browser settings: every modern browser lets you view, delete, and block cookies. Instructions for the major browsers are linked from your browser vendor's help pages.

You can also block third-party scripts using a privacy extension. We test kepta.legal to remain fully functional with the most popular blockers enabled.

5.Changes to this policy

If we ever add a cookie that is not strictly necessary, for example, a third-party analytics product, a customer-support chat tool, or a marketing pixel, we will: (i) update this page; (ii) display a consent banner on the affected pages; and (iii) not place any non-essential cookie on your device before you have given explicit, informed, and freely given consent.

Material changes to this policy will be summarised at the top of the page for at least 30 days following publication.

6.Contact

Questions about cookies or about how we collect or use information should be sent to contact@kepta.legal. The data controller is Grasperly Sp. z o.o., ul. Zachodnia 70/417, 90-403 Łódź, Poland (KRS 0001238012, NIP 7252366483). You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.