Rivalio Cookies Policy
Controller: Rivalio s.r.o., Company ID 29509751, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic.
Version: 1.3 · Effective from: 24 September 2026 · Related: Privacy Policy v1.7
Contact for queries: privacy@rivalio.cz
1. Introduction
1.1. This Policy describes which cookies and similar technologies Rivalio uses, what they do, and how the Data Subject can manage them. It complements the Privacy Policy (/privacy-policy), which it relies on in particular for legal bases and retention.
1.2. "Data Subject" means any visitor to the Rivalio website — whether signed in or anonymous.
2. What cookies and similar technologies are
2.1. Cookies are small text files stored by the website in your browser. They help remember your choices, keep you signed in, and may measure visitor behaviour.
2.2. Beyond classic HTTP cookies, Rivalio uses a few related technologies:
localStorage/sessionStorage— browser-local storage, never auto-sent to the server. Used to remember cookie banner choices and for the short-term deduplication of advertising-slot impression measurement (see Section 5.1).- Web pixels in e-mails — currently not used.
- Fingerprinting — not used.
2.3. "Cookies" in this document covers all of the above.
3. Legal framework
3.1. The use of cookies is governed by:
- Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications (in the wording effective from 1 January 2022) — opt-in regime: non-essential cookies may be stored only with the visitor's demonstrable consent.
- Regulation (EU) 2016/679 (GDPR) Article 6(1)(a) — consent as a legal basis; Article 7 — conditions for consent.
- Directive 2002/58/EC (ePrivacy) Article 5(3).
- EDPB Guidelines 03/2022 on deceptive design patterns — no dark patterns.
4. Categories of cookies
Cookies fall into 4 categories. The first category is always active; the rest require consent that you can change at any time (see Section 7).
4.1 Essential
Without them the site does not work, or its security and integrity could not be ensured — they keep you signed in, prevent CSRF attacks, remember your language, remember your saved cookie banner choice, recognise an already verified device for security notices, and ensure the accuracy of the aggregate (non-personal) counters of advertising-slot impressions. Consent is not required (Section 89(3) ZEK) — they are stored on the basis of the Controller's legitimate interest in providing and securing the Service.
4.2 Functional
For advanced features that require loading third-party content — typically embedded YouTube video playback and bot protection (Google reCAPTCHA). Consent required.
4.3 Statistical
For measuring website traffic and visitor behaviour. Consent required.
The Controller uses Google Analytics 4 (Google Ireland Limited). The measurement script is loaded in the browser only after you consent to the Statistical category; without consent it is not loaded at all. The data transferred and the transfer to the USA are described in the Privacy Policy, Sections 4.7.2, 7.4 and 8. The website's performance telemetry (Web Vitals) runs independently of this consent, entirely without cookies and without identifiers — see the Privacy Policy, Section 4.7.
4.4 Marketing
For measuring the effectiveness of Rivalio's paid advertising and for identifiers associated with measuring interactions with advertising. Consent required.
Meta Pixel (Meta Platforms Ireland Limited) measures whether a visitor who came from a Rivalio ad on Facebook or Instagram completed, for example, a registration. The script is loaded in the browser only after you consent to the Marketing category; without consent it is not loaded at all. The same consent also covers server-side conversion measurement (Meta Conversions API): without consent, Rivalio does not send anything about your conversion to Meta from its server. The scope of the data transferred, the transfer to the USA and the joint controllership with Meta are described in the Privacy Policy, Sections 4.7.2, 4.7.3, 7.4, 8 and 9.1.
On Rivalio's own advertising slots (sponsors, partner links, the Provider's own messages — see the Terms of Service, section "Advertising and partner content" for details) we do not use third-party advertising networks; creatives are loaded from
rivalio.cz. The only identifier stored for them is the short-lived first-party cookiead_click_{id}(Section 5.4), which prevents the same click from being counted more than once, and only with your consent to the Marketing category.
5. Specific cookie list
5.1 Essential
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
rivalio_session |
rivalio.cz | Maintains sign-in and app state | 2 hours | HTTP, HttpOnly, Secure, SameSite=Lax |
XSRF-TOKEN |
rivalio.cz | CSRF protection | Session | HTTP, Secure |
remember_web_* |
rivalio.cz | Persistent sign-in ("Remember me" — only if you tick the box) | 400 days | HTTP, HttpOnly, Secure |
rivalio_device |
rivalio.cz | Recognises an already verified device — security notice on sign-in from a new device | 30 days | HTTP, HttpOnly, Secure |
cookie_consent_v3 |
rivalio.cz | Stores your cookie banner choices | 12 months if you accepted all categories, otherwise 6 months | localStorage |
cc_prefs |
.rivalio.cz | Record of your category choices and consent ID. Valid across rivalio.cz and its subdomains (e.g. app.rivalio.cz) so you do not have to decide twice; withdrawing consent on one of them applies to the others too. Written by your browser after you choose in the banner; the server only reads it. | 12 months if you accepted all categories, otherwise 6 months | HTTP, SameSite=Lax |
locale (when you change language) |
rivalio.cz | Language preference | 12 months | HTTP |
rv_view (if you manually switch the view) |
rivalio.cz | Mobile/desktop view preference | 30 days | HTTP |
ad_imp_* |
rivalio.cz | Short-term deduplication of advertising-slot impression measurement — ensures the same impression is not counted more than once toward the aggregate (non-personal) counter; contains no person identifier | 30 minutes | sessionStorage (cleared when the tab is closed) |
5.2 Functional (consent required)
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
_GRECAPTCHA (only if the organiser enables reCAPTCHA protection) |
google.com | Bot protection on public registration forms | 6 months | 3rd-party |
YSC, VISITOR_INFO1_LIVE, PREF (only after a "Load video" click) |
youtube-nocookie.com / youtube.com | Playback preferences and view counts | session / 6 months | 3rd-party |
YouTube embeds default to a placeholder with a "Load video" button. Cookies are only set after the visitor explicitly clicks Load video or grants Functional consent.
5.3 Statistical (consent required)
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
_ga |
rivalio.cz (set by the Google Analytics 4 script) | Random identifier Google Analytics 4 uses to distinguish visitors | 2 years | HTTP, first-party |
_ga_<ID> |
rivalio.cz (set by the Google Analytics 4 script) | Keeps session state for traffic measurement | 2 years | HTTP, first-party |
Without consent to the Statistical category, the Google Analytics 4 script is not loaded and none of these cookies is stored.
5.4 Marketing (consent required)
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
_fbp |
rivalio.cz (set by the Meta Pixel script) | Random browser identifier Meta uses to link a visit with a later conversion (e.g. a registration) | 90 days | HTTP, first-party |
_fbc |
rivalio.cz (set by the Meta Pixel script) | Identifier of a click on a Facebook or Instagram ad (the fbclid parameter), if you arrived from such an ad |
90 days | HTTP, first-party |
ad_click_{id} |
rivalio.cz | Prevents the same advertising-slot click from being counted more than once (deduplication of the aggregate click counter); contains no person identifier | 5 minutes | HTTP, first-party |
Without consent to the Marketing category, the Meta Pixel script is not loaded, none of these cookies is stored and Rivalio does not send anything about your conversions to Meta, not even from its server. Clicking Rivalio's advertising slots works normally (you are redirected to the target); each click is simply counted toward the aggregate counter without short-term deduplication.
6. Third parties
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Google LLC (reCAPTCHA, YouTube) | Bot protection, video playback | https://policies.google.com/privacy |
| Google Ireland Limited (Google Analytics 4) | Website traffic statistics (Statistical category) | https://policies.google.com/privacy |
| Meta Platforms Ireland Limited (Meta Pixel, Conversions API) | Measuring the effectiveness of paid advertising on Facebook and Instagram (Marketing category); joint controller under Art. 26 GDPR | https://www.facebook.com/privacy/policy |
Whenever you accept a non-essential category (Functional, Statistical, Marketing), data is sent directly to the third party, which processes it as its own controller (or joint controller). Google and Meta process part of the data in the USA under the EU-US Data Privacy Framework and standard contractual clauses. See Privacy Policy Sections 7 to 9 for details.
Rivalio's own advertising slots are fully first-party — creatives are loaded from rivalio.cz, and no data is sent to third parties in connection with displaying or clicking them. Measuring Rivalio's advertising campaigns on Facebook and Instagram (Meta Pixel) is a separate purpose described in Section 4.4.
Note: Inter (typeface) is self-hosted from rivalio.cz, so no requests reach Google — regardless of consent.
7. How to manage cookies
7.1 Cookie banner
On your first visit, a banner is shown with two equally sized buttons side by side and a settings option:
- Accept all — enables all four categories,
- Reject all — keeps only Essential, disables the rest,
- Settings — opens a per-category toggle modal (all optional categories start switched off).
Your choice is valid for 12 months if you accept all categories, otherwise for 6 months. After that the banner is shown again. The choice applies to rivalio.cz and its subdomains.
7.2 "Manage cookies" in the footer
Every Rivalio page has a Manage cookies link in the footer that reopens the banner / modal and lets you change your existing choice. The change applies immediately and is written to the audit trail (see Section 8).
7.3 Browser settings
You can also manage cookies in your browser directly:
- Chrome:
chrome://settings/cookies - Firefox:
about:preferences#privacy - Safari: Preferences → Privacy → Cookies and website data
- Edge:
edge://settings/content/cookies
Clearing cookies in the browser also clears the choices saved in localStorage, so the banner will reappear on your next visit.
8. Consent audit trail
To meet the burden of proof in case of an ÚOOÚ inspection, the Controller stores every consent given or withdrawn in an internal audit log. Each record contains:
- a unique consent identifier,
- a snapshot of category choices at the moment of consent,
- a snapshot of the category text you saw,
- the site language and schema version,
- an anonymised IP address (IPv4 truncated to
/24, IPv6 to/48), - the User-Agent string,
- a server-side timestamp.
The record is immutable — if you change your choice, a new row is created and linked to the previous one. Retention: 24 months from the last consent (or withdrawal), then automatically cleaned up.
9. Consequences of refusal
| What you refuse | What you lose |
|---|---|
| Functional | YouTube embeds show a placeholder with a "Load video" button; reCAPTCHA does not load, anti-spam falls back to honeypot + rate limiting. |
| Statistical | Nothing functional — the website works the same, your visit is just not counted in the traffic statistics. |
| Marketing | Nothing functional — ads are displayed the same way and clicking them works normally; Meta Pixel is not loaded, your conversion is not sent to Meta and the short-term click deduplication (ad_click_{id}) is not stored. |
| Essential | Cannot be refused — Rivalio would not work without them (sign-in, CSRF, security). |
Remember: the Service must work even with all non-essential cookies refused. If refusing breaks something, that is a bug — please contact us at info@rivalio.cz.
10. Changes and contact
10.1. This Policy may be updated at any time. We will inform you of material changes pursuant to Section 16 of the Privacy Policy (e-mail, in-app notice, at least 30 days before the effective date).
10.2. If a change affects the categories of cookies or the tools we use in them, we invalidate existing consents and ask you to decide afresh. This also applies to this version 1.3 — Google Analytics 4 and Meta Pixel were added to the Statistical and Marketing categories, so the cookie banner will reappear for you after deployment and an earlier consent does not cover these tools.
10.3. Questions and complaints: privacy@rivalio.cz. A complaint with the supervisory authority may be lodged at the Office for Personal Data Protection (https://www.uoou.cz) or the supervisory authority of your country of habitual residence.
End of Cookies Policy. Version 1.3, effective 24 September 2026.