Cookie Policy

Effective date: 20 October 2026 · Last updated: 20 October 2026 · Version 1.0

This policy explains the cookies and browser storage used on nexadeco.com, what each one does, how long it lasts and how you can change your mind. It should be read together with our Privacy Policy.

1. Our position: essential only

We run no advertising, marketing, social-media or profiling cookies, no third-party analytics and no cross-site trackers. The storage we use is limited to what the site needs to function (remembering your language and, for staff, an authenticated admin session) plus a record of the choice you made in the consent banner. As of the effective date of this policy the list of non-essential scripts is empty: if we ever add one (for example an external analytics or support widget), it will be registered in the consent gate in assets/js/main.js, it will not load until you press "Accept all", and this page will be updated first.

2. What we store on your device

Name	Type	Purpose	Lifetime
`nexa_cookie_consent`	localStorage – essential / consent record	Stores your choice ("accepted" or "rejected"), the policy version, whether your browser sent a Global Privacy Control signal, and the time of the choice. Without it the banner would ask you again on every page.	Until you clear your browser storage for this site or a new policy version is published.
`nexa.lang`	localStorage – essential	Remembers the language you selected so the next page you open keeps it.	Until you clear your browser storage or pick another language.
`PHPSESSID`	Cookie – strictly necessary, staff only	Keeps an administrator signed in to the back office. It is set only when a member of staff authenticates on the admin path; ordinary visitors never receive it.	Session, or until sign-out.

All of these are first-party (set by nexadeco.com itself). None of them contain your name, email address or any other data you typed into a form, and none are shared with advertisers.

3. Third-party requests that are not cookies

Google Fonts – our pages request Inter and Poppins webfont files from fonts.googleapis.com and fonts.gstatic.com. Google therefore sees your IP address and user-agent for that request. The request sets no cookie in your browser.
WhatsApp / Meta – the floating WhatsApp button and footer links point to wa.me. Nothing is sent to Meta unless you click one; after that, Meta's own privacy policy applies to the conversation.
Payment providers and carriers – only in the context of an actual order, and never as a result of simply browsing this site.

4. Our cookie-less page counter

We measure which pages are useful with a first-party counter that stores no cookie and no visitor identifier. It sends only the requested path, the referring host, your screen size and your language. Your IP address is salted and one-way hashed with SHA-256 and only the first 16 characters are kept, and the user-agent is reduced to device class, browser and operating system. Records are aggregated and used only for traffic reporting. If your browser sends Do Not Track or Global Privacy Control, the counter sends nothing at all.

5. The consent banner: accept, reject, change

On your first visit a small banner appears at the bottom of the page with two equally easy choices:

Reject non-essential – only the essential storage above is used; nothing else is loaded. This is a real choice, not a dead end: the site works exactly the same.
Accept all – the same essential storage, plus permission to load the non-essential scripts listed in section 1 (currently none).

Your answer is stored locally in nexa_cookie_consent, so the banner stays out of your way on later visits. Declining is never punished: no feature is disabled and no content is hidden.

6. How to withdraw consent

Use the Cookie settings link on this page (or the same link in the banner) to reopen the dialog and change your answer at any time. Withdrawal applies from that moment; it does not affect processing carried out before it. You can also delete the stored value in your browser settings, which makes the banner ask again on your next visit.

7. Browser controls and Do Not Track

Every mainstream browser lets you view, block and delete cookies and site data (Chrome: Settings → Privacy and security → Third-party cookies / Site data; Safari: Settings → Privacy; Firefox: Settings → Privacy & Security; Edge: Settings → Cookies and site permissions). Blocking essential storage can stop the language switcher or the admin sign-in from working, but the public pages will still render.

We honour the Global Privacy Control (GPC) opt-out signal: when it is present we do not load non-essential scripts and the cookie-less counter stays off. We do not treat Do Not Track as consent, and we do not try to detect that you have configured your browser this way.

8. How long the consent record is kept

The consent record lives in your own browser, not on our servers, and stays there until you clear it or we publish a new policy version – at which point the banner asks again so that your choice always refers to the current policy. Our servers keep no copy of your choice; aggregate statistics about how many visitors accepted or rejected are not linked to any individual.

9. Changes to this policy

If we introduce a new cookie or script, we update this page, change the policy version and ask for your consent again through the banner. The effective date and version are shown at the top of this page.

10. Contact

Questions about this policy or about privacy in general: danizhi@nexadeco.com. We answer within 30 days.

Effective: 20 October 2026 · Version: 1.0