Cookie Policy

Cookies are small text files that are stored on your device (computer, tablet, smartphone) when you visit a website. Cookies allow websites to recognise your device and store certain information about your preferences or past actions.

In addition to cookies, we may also use other similar technologies, such as:

• Local Storage – storing data in the browser

• Session Storage – temporarily storing data during a session

• Pixel tags (web beacons) – small images used for tracking

• JavaScript – for collecting information about website usage

For the purposes of this Policy, we will refer to all of these technologies collectively as "cookies".

We use the following types of cookies:

2.1 Necessary cookies

These cookies are essential for the website to function properly and cannot be turned off. They provide basic functions such as website navigation, access to secure areas of the site, and remembering your cookie preferences and other basic settings.

• Purpose: Ensuring the technical functionality of the website, security, remembering your cookie preferences

• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

• Retention period: Up to 12 months or until deleted by the user

• Can be declined: No (they are necessary for the website to function)

2.2 Analytics cookies

These cookies help us understand how visitors use our website; they collect statistics on traffic, the most visited pages, time spent on the site and similar. Microsoft Clarity additionally records how you interact with the pages (mouse movement, scrolling, clicks) in the form of anonymised session recordings and heatmaps. This information helps us improve the functionality and user experience of our website.

• Purpose: Website traffic analysis, user behaviour analysis (session recordings, heatmaps), improving user experience, content optimisation

• Legal basis: Your consent (Art. 6(1)(a) GDPR)

• Retention: Up to 24 months (Google Analytics), up to 13 months (Microsoft Clarity)

• Can be refused: Yes (you can refuse them in the cookie settings)

• Third parties: Google LLC (Google Analytics), Microsoft Corporation (Microsoft Clarity)

2.3 Marketing cookies

We use these cookies to measure the effectiveness of our advertising campaigns and to show relevant ads. The LinkedIn Insight Tag lets us measure conversions from LinkedIn campaigns and show you ads on that network (remarketing). We use Google Ads to measure conversions from Google Search and Display advertising, and the Meta Pixel to measure conversions from Facebook and Instagram campaigns.

If you consent to marketing cookies and submit the contact form, we additionally report that conversion to the relevant advertising platform from our server (a "Conversions API"). Only an irreversibly encrypted (hashed) form of your email address using the SHA-256 algorithm and the advertising click identifier are transmitted, never your name, phone number or the content of your message. The sole purpose is to match the conversion to an advertising campaign. Without marketing consent, none of this data is sent.

• Purpose: Measuring conversions from advertising campaigns, evaluating advertising effectiveness, remarketing, building advertising audiences

• Legal basis: Your consent (Art. 6(1)(a) GDPR)

• Retention: Up to 12 months (LinkedIn Insight Tag), up to 90 days (Google Ads click identifiers), up to 90 days (Meta Pixel)

• Can be refused: Yes (you can refuse them in the cookie settings, separately from analytics cookies)

• Third parties: LinkedIn Ireland Unlimited Company, Google Ireland Limited, Meta Platforms Ireland Limited

2.4 Cookieless analytics (Vercel Web Analytics)

For aggregated traffic statistics we also use the Vercel Web Analytics service provided by Vercel Inc. This service does not store any cookies or other identifiers on your device – it distinguishes visits using a short-lived anonymous hash of the incoming request, which is automatically deleted within 24 hours. Only aggregated data is recorded (pages viewed, country, device type and browser), from which no individual visitor can be identified or tracked across websites.

• Purpose: Aggregated website traffic statistics

• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

• Cookies: None

• Third parties: Vercel Inc. (more at https://vercel.com/docs/analytics/privacy-policy)

2.5 Protection of forms against bots (Cloudflare Turnstile)

To protect the contact form against automated (robotic) submissions, we use the Cloudflare Turnstile service provided by Cloudflare, Inc. In the default configuration we use, this service does not store any cookies on your device; during verification it only processes technical browser signals and your IP address.

• Purpose: Website security, protecting forms against spam and misuse

• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

• Cookies: None (in the default configuration we use)

• Third parties: Cloudflare, Inc. (more at https://www.cloudflare.com/turnstile-privacy-policy/)

3.1 Necessary cookies

Name: staybrand-cookie-preferences

• Purpose: Storing your cookie preferences

• Type: Local Storage

• Retention period: Up to 12 months

• Provider: Codity s.r.o.

Name: staybrand-cookie-consent

• Purpose: Recording whether you have given consent to the use of cookies

• Type: Local Storage

• Retention period: Up to 12 months

• Provider: Codity s.r.o.

Name: NEXT_LOCALE

• Purpose: Remembering your selected language version of the website

• Type: HTTP Cookie

• Retention period: Until the end of the browser session

• Provider: Codity s.r.o.

Name: staybrand-theme

• Purpose: Remembering your selected website appearance (light/dark mode)

• Type: Local Storage

• Retention period: Until deleted by the user

• Provider: Codity s.r.o.

3.2 Analytics cookies (Google Analytics)

Name: _ga

• Purpose: Distinguishing between individual users

• Type: HTTP Cookie

• Retention period: 2 years

• Provider: Google LLC

• Domain: .staybrand.io

Name: _ga_[ID]

• Purpose: Maintaining session state

• Type: HTTP Cookie

• Retention period: 2 years

• Provider: Google LLC

• Domain: .staybrand.io

Name: _gid

• Purpose: Distinguishing between individual users

• Type: HTTP Cookie

• Retention period: 24 hours

• Provider: Google LLC

• Domain: .staybrand.io

Name: _gat (if used)

• Purpose: Throttling the request rate

• Type: HTTP Cookie

• Retention period: 1 minute

• Provider: Google LLC

• Domain: .staybrand.io

3.3 Analytics cookies (Microsoft Clarity)

Name: _clck

• Purpose: Storing the Clarity user identifier and settings unique to this website

• Type: HTTP Cookie

• Retention period: 12 months

• Provider: Microsoft Corporation

• Domain: .staybrand.io

Name: _clsk

• Purpose: Linking multiple page views into a single session recording

• Type: HTTP Cookie

• Retention period: 24 hours

• Provider: Microsoft Corporation

• Domain: .staybrand.io

Name: CLID

• Purpose: Identifying the first time a visitor is recorded by Clarity

• Type: HTTP Cookie

• Retention period: 12 months

• Provider: Microsoft Corporation

• Domain: clarity.ms

Name: MUID, MR, SM, ANONCHK

• Purpose: Technical Microsoft cookies used to distinguish browsers and synchronise identifiers across Microsoft domains

• Type: HTTP Cookie

• Retention period: 10 minutes to 13 months (depending on the specific cookie)

• Provider: Microsoft Corporation

• Domain: clarity.ms / bing.com

3.4 Marketing cookies (LinkedIn Insight Tag, Google Ads, Meta Pixel)

Name: li_fat_id

• Purpose: First-party measurement of conversions from LinkedIn advertising campaigns

• Type: HTTP Cookie

• Retention: 30 days

• Provider: LinkedIn Ireland Unlimited Company

• Domain: .staybrand.io

Name: bcookie, lidc, li_gc, li_sugr, AnalyticsSyncHistory, UserMatchHistory, lms_ads, lms_analytics

• Purpose: Browser identification, consent, matching advertising identifiers and measuring LinkedIn campaigns

• Type: HTTP Cookie (third party)

• Retention: 24 hours to 12 months (depending on the cookie)

• Provider: LinkedIn Ireland Unlimited Company

• Domain: .linkedin.com / .ads.linkedin.com

Name: _gcl_au, _gcl_aw

• Purpose: Measuring conversions from Google Ads campaigns (storing information about an ad click)

• Type: HTTP Cookie

• Retention: 90 days

• Provider: Google Ireland Limited

• Domain: .staybrand.io

Name: _fbp, _fbc

• Purpose: Conversion measurement and remarketing in Facebook and Instagram advertising campaigns

• Type: HTTP Cookie

• Retention: 90 days

• Provider: Meta Platforms Ireland Limited

• Domain: .staybrand.io

4.1 Google Analytics

We use the Google Analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to analyse traffic on our website.

Google Analytics uses cookies to analyse how visitors use our website. The information generated by cookies about your use of our website (including your IP address) may be transmitted to and stored on Google's servers in the USA.

Google may use this information to evaluate your use of our website, compile reports on website activity for the website operator, and provide other services relating to website activity and internet usage.

For more information on how Google uses your data, see Google's Privacy Policy: https://policies.google.com/privacy

You can also opt out of the use of cookies by Google by downloading and installing the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

4.2 Microsoft Clarity

We use the Microsoft Clarity service provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA) to analyse visitor behaviour on our website.

Microsoft Clarity records how visitors interact with the pages (mouse movement, scrolling and clicks) and creates anonymised session recordings and heatmaps from this data. Sensitive data (e.g. form content) is automatically masked in the recordings. We use this information solely to improve the usability and content of the website.

Clarity only starts running once you have given consent to analytics cookies, and we pass your consent to it via its Consent API. If you withdraw your consent, Clarity deletes its cookies and stops recording the session.

For more information on how Microsoft processes your data, see Microsoft's Privacy Statement: https://privacy.microsoft.com/privacystatement

4.3 Vercel Web Analytics

We use the Vercel Web Analytics service provided by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) for aggregated traffic statistics of our website.

Vercel Web Analytics does not store any cookies and does not collect personal identifiers that could be used to track visitors across websites or between individual days. It distinguishes visits using an anonymous hash created from the incoming request, which is automatically deleted within 24 hours. Only aggregated data is recorded: the page viewed, the referring page, country, operating system, browser and device type.

Because the service does not store any information on your device, it is not subject to consent for analytics cookies.

For more information about privacy in Vercel Web Analytics, see: https://vercel.com/docs/analytics/privacy-policy

4.4 LinkedIn Insight Tag and LinkedIn Conversions API

We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) to measure conversions from LinkedIn advertising campaigns and for remarketing on that network.

The Insight Tag collects data about your visit to our website (including the URL, referring page, truncated IP address and device identifiers) and may link it to your LinkedIn member profile if you are signed in to LinkedIn.

The Insight Tag only loads after you give consent to MARKETING cookies. If you withdraw consent, the tag will not load and we delete the li_fat_id first-party cookie.

If you have consented to marketing cookies and submit the contact form, we also report the conversion to LinkedIn through the LinkedIn Conversions API directly from our server. Only an irreversibly encrypted (hashed) form of your email address (SHA-256) and the advertising click identifier are transmitted; your name, phone number and the content of your message are not. Without marketing consent, no such transmission takes place.

In relation to the Insight Tag we act as joint controllers with LinkedIn within the meaning of Art. 26 GDPR; this relationship is governed by the Joint Controller Addendum forming part of the LinkedIn Ads terms.

For more information on how LinkedIn processes your data, see the LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy

You can opt out of LinkedIn advertising remarketing here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

4.5 Google Ads

We use Google Ads provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to measure conversions from advertising campaigns in Google Search and the Google Display Network.

Google Ads records whether you came to our website by clicking one of our ads and whether you subsequently converted (submitted the contact form). We also use Enhanced Conversions, where your email address is irreversibly encrypted (hashed) with the SHA-256 algorithm directly in your browser before being sent, so Google never receives your email address in readable form.

Google Ads only loads after you give consent to MARKETING cookies. We also use Google Consent Mode v2: until you give consent, all advertising signals are set to "denied" and Google does not store any advertising identifiers on your device.

For more information, see the Google Privacy Policy: https://policies.google.com/privacy

You can turn off Google ad personalisation here: https://adssettings.google.com

4.6 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) to measure conversions from Facebook and Instagram advertising campaigns and for remarketing on those networks.

The Meta Pixel records your visit to our website and any conversion, and may link this data to your Facebook or Instagram account if you are signed in. If you have consented to marketing cookies and submit the contact form, we also report the conversion to Meta through the Meta Conversions API from our server, solely as an irreversibly encrypted (hashed) email address (SHA-256), the advertising click identifier, your IP address and browser information.

The Meta Pixel only loads after you give consent to MARKETING cookies. Without that consent it does not load and no data is transmitted to Meta.

In relation to conversion measurement we act as joint controllers with Meta within the meaning of Art. 26 GDPR under the Meta Controller Addendum.

For more information, see the Meta Privacy Policy: https://www.facebook.com/privacy/policy

You can adjust your Facebook ad settings here: https://www.facebook.com/adpreferences

4.7 Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to manage the measurement and advertising tags on our website.

Google Tag Manager is a tag management tool. It does not itself store any cookies on your device and does not collect personal data. It only loads the measurement and advertising tags described in these Policies. When it loads, your IP address and technical information about your browser are transmitted to Google, as these are required to deliver the file.

The container loads only after you have given your consent to analytics or marketing cookies. Without your consent it does not load and no data is transmitted to Google. Your consent is passed on to the individual tags inside the container through Google Consent Mode v2, so a tag intended for advertising purposes will not fire if you have allowed analytics cookies only.

For more information about how Google processes your data, see the Google Privacy Policy: https://policies.google.com/privacy

4.8 Transfer of data to third countries

Because Google Analytics, Google Ads, Google Tag Manager, Microsoft Clarity, Vercel Web Analytics, the LinkedIn Insight Tag and the Meta Pixel may transfer data to the USA, we rely on the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework, under which Google LLC, Microsoft Corporation, Vercel Inc., LinkedIn Corporation and Meta Platforms, Inc. are certified) and on standard contractual clauses approved by the European Commission to ensure an adequate level of protection for your personal data.

5.1 Necessary cookies

The processing of personal data through necessary cookies is based on our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the technical functionality and security of our website.

5.2 Analytics cookies

The processing of personal data through analytics cookies is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by changing your cookie settings in your browser or using our cookie banner.

5.3 Marketing cookies

Processing of personal data through marketing cookies, including reporting a conversion to an advertising platform from our server (Conversions API), is based on your consent (Art. 6(1)(a) GDPR). You give this consent separately and independently of your consent to analytics cookies, and you may withdraw it at any time in the cookie settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

In connection with the processing of your personal data through cookies, you have the following rights:

• Right of access to data (Art. 15 GDPR) – you have the right to obtain information about what personal data we process about you

• Right to rectification (Art. 16 GDPR) – you have the right to request the correction of inaccurate data

• Right to erasure (Art. 17 GDPR) – you have the right to request the deletion of your data (the "right to be forgotten")

• Right to restriction of processing (Art. 18 GDPR) – you have the right to request that the processing of your data be restricted

• Right to data portability (Art. 20 GDPR) – you have the right to receive your data in a structured format

• Right to object (Art. 21 GDPR) – you have the right to object to the processing of your data

• Right to withdraw consent (Art. 7(3) GDPR) – you have the right to withdraw your consent to the processing of data for marketing purposes at any time

• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) – you have the right to lodge a complaint with the Office for Personal Data Protection

To exercise your rights, contact us at the email address: info@staybrand.io or in writing at: Codity s.r.o., Plzeňská 3352/156, Smíchov, 150 00 Prague 5, Czech Republic.

7.1 Managing cookies through our website

The first time you visit our website, a cookie banner will appear where you can:

• Accept all cookies

• Reject all non-essential cookies

• Customise your cookie settings according to your preferences

Your preferences are stored in your browser's Local Storage and will be respected on subsequent visits.

7.2 Managing cookies through your browser

Most browsers accept cookies automatically. However, you can set your browser to refuse cookies or to notify you when a website wants to store a cookie. Below you will find links to instructions for managing cookies in the most widely used browsers:

• Google Chrome: https://support.google.com/chrome/answer/95647

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox

• Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

• Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac

• Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Please note that blocking or deleting cookies may affect the functionality of our website, and some features may not be available.

Personal data collected through cookies is retained only for as long as necessary to fulfil the purpose for which it was collected, or for the period laid down by law.

• Necessary cookies: retained for the duration of the session, or for a maximum of 12 months

• Analytics cookies: retained for a maximum of 24 months (Google Analytics), or a maximum of 13 months (Microsoft Clarity), or a maximum of 12 months (LinkedIn Insight Tag)

• Marketing cookies: Retained for a maximum of 12 months (LinkedIn Insight Tag) and a maximum of 90 days (Google Ads and Meta Pixel)

• Cookieless analytics (Vercel Web Analytics): the anonymous visit hash is deleted within 24 hours; data is further retained only in aggregated form

Once the retention period has expired, personal data is automatically deleted or anonymised.

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include:

• Encryption of data in transit (HTTPS)

• Restricting access to personal data to authorised persons only

• Regular review and updating of security measures

• The use of secure servers and data centres

Despite these measures, we cannot guarantee the absolute security of data transmitted over the internet.

Our website is not intended for persons under the age of 16. We do not knowingly collect personal data from children. If we discover that we have collected personal data from a child under 16 without the consent of a parent or legal guardian, we will delete this data without undue delay.

We may update this Policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons. The date of the last update is shown in the header of this Policy.

We recommend that you check this Policy regularly to stay informed about how we use cookies. If there are significant changes to our use of analytics cookies, we will ask you to renew your consent via our cookie banner.

In the event of significant changes, we will inform you via our website or by email.

If you have any questions, comments or requests regarding this Policy or our use of cookies, you can contact us at:

Codity s.r.o.

Plzeňská 3352/156

150 00 Prague 5 – Smíchov

Czech Republic

Email: info@staybrand.io

Office for Personal Data Protection

Pplk. Sochora 27

170 00 Prague 7

Czech Republic

Website: https://www.uoou.cz

Email: posta@uoou.cz

Phone: +420 234 665 111

This Policy supplements our Privacy Policy. We recommend that you also read that document for a full understanding of how we process your personal data.

This Policy has been prepared in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR)

• Act No. 110/2019 Coll., on the Processing of Personal Data

• Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in electronic communications (the ePrivacy Directive)

This Policy is effective from the date of its publication on our website.