Rivalio Cookies Policy
Controller: Rivalio s.r.o., Company ID 29509751, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic.
Version: 1.2 · Effective from: 18 July 2026 · Related: Privacy Policy v1.4
Contact for queries: privacy@rivalio.cz
1. Introduction
1.1. This Policy describes which cookies and similar technologies Rivalio uses, what they do, and how the Data Subject can manage them. It complements the Privacy Policy (/privacy-policy), which it relies on in particular for legal bases and retention.
1.2. "Data Subject" means any visitor to the Rivalio website — whether signed in or anonymous.
2. What cookies and similar technologies are
2.1. Cookies are small text files stored by the website in your browser. They help remember your choices, keep you signed in, and may measure visitor behaviour.
2.2. Beyond classic HTTP cookies, Rivalio uses a few related technologies:
localStorage/sessionStorage— browser-local storage, never auto-sent to the server. Used to remember cookie banner choices and for the short-term deduplication of advertising-slot impression measurement (see Section 5.1).- Web pixels in e-mails — currently not used.
- Fingerprinting — not used.
2.3. "Cookies" in this document covers all of the above.
3. Legal framework
3.1. The use of cookies is governed by:
- Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications (in the wording effective from 1 January 2022) — opt-in regime: non-essential cookies may be stored only with the visitor's demonstrable consent.
- Regulation (EU) 2016/679 (GDPR) Article 6(1)(a) — consent as a legal basis; Article 7 — conditions for consent.
- Directive 2002/58/EC (ePrivacy) Article 5(3).
- EDPB Guidelines 03/2022 on deceptive design patterns — no dark patterns.
4. Categories of cookies
Cookies fall into 4 categories. The first category is always active; the rest require consent that you can change at any time (see Section 7).
4.1 Essential
Without them the site does not work, or its security and integrity could not be ensured — they keep you signed in, prevent CSRF attacks, remember your language, remember your saved cookie banner choice, recognise an already verified device for security notices, and ensure the accuracy of the aggregate (non-personal) counters of advertising-slot impressions. Consent is not required (Section 89(3) ZEK) — they are stored on the basis of the Controller's legitimate interest in providing and securing the Service.
4.2 Functional
For advanced features that require loading third-party content — typically embedded YouTube video playback and bot protection (Google reCAPTCHA). Consent required.
4.3 Statistical
For traffic measurement, user behaviour, A/B testing. Consent required.
The Controller does not currently use any statistical cookies. The website's performance telemetry (Web Vitals) runs entirely without cookies and without identifiers — see the Privacy Policy, Section 4.7. The category is reserved for future activation (typically Google Analytics 4 or an alternative). If activated, the Policy will be updated and the Data Subject re-informed.
4.4 Marketing
For identifiers associated with the display of advertising and the measurement of interactions with it. Consent required.
Rivalio displays its own advertising slots (sponsors, partner links, the Provider's own messages — see the Terms of Service, section "Advertising and partner content" for details). We do not use any third-party advertising networks, remarketing or conversion tracking; no third-party advertising scripts are loaded into the browser. The only marketing identifier is the short-lived first-party cookie
ad_click_{id}(Section 5.4), which prevents the same ad click from being counted more than once. It is stored only with your consent to the Marketing category; without consent, no such cookie is stored.
5. Specific cookie list
5.1 Essential
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
rivalio_session |
rivalio.cz | Maintains sign-in and app state | 2 hours | HTTP, HttpOnly, Secure, SameSite=Lax |
XSRF-TOKEN |
rivalio.cz | CSRF protection | Session | HTTP, Secure |
remember_web_* |
rivalio.cz | Persistent sign-in ("Remember me" — only if you tick the box) | 400 days | HTTP, HttpOnly, Secure |
rivalio_device |
rivalio.cz | Recognises an already verified device — security notice on sign-in from a new device | 30 days | HTTP, HttpOnly, Secure |
cookie_consent_v3 |
rivalio.cz | Stores your cookie banner choices | persistent (until you change them) | localStorage |
cc_prefs |
rivalio.cz | Server-readable record of your consent choice (so the server knows which categories you allowed) | 12 months | HTTP, encrypted |
locale (when you change language) |
rivalio.cz | Language preference | 12 months | HTTP |
rv_view (if you manually switch the view) |
rivalio.cz | Mobile/desktop view preference | 30 days | HTTP |
ad_imp_* |
rivalio.cz | Short-term deduplication of advertising-slot impression measurement — ensures the same impression is not counted more than once toward the aggregate (non-personal) counter; contains no person identifier | 30 minutes | sessionStorage (cleared when the tab is closed) |
5.2 Functional (consent required)
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
_GRECAPTCHA (only if the organiser enables reCAPTCHA protection) |
google.com | Bot protection on public registration forms | 6 months | 3rd-party |
YSC, VISITOR_INFO1_LIVE, PREF (only after a "Load video" click) |
youtube-nocookie.com / youtube.com | Playback preferences and view counts | session / 6 months | 3rd-party |
YouTube embeds default to a placeholder with a "Load video" button. Cookies are only set after the visitor explicitly clicks Load video or grants Functional consent.
5.3 Statistical (consent required) — currently empty
No statistical cookies are currently used.
5.4 Marketing (consent required)
| Cookie / key | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
ad_click_{id} |
rivalio.cz | Prevents the same advertising-slot click from being counted more than once (deduplication of the aggregate click counter); contains no person identifier | 5 minutes | HTTP, first-party |
Without consent to the Marketing category, this cookie is not stored — clicking an ad works normally (you are redirected to the target); each click is simply counted toward the aggregate counter without short-term deduplication.
6. Third parties
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Google LLC (reCAPTCHA, YouTube) | Bot protection, video playback | https://policies.google.com/privacy |
Whenever you accept a non-essential category (Functional, Statistical, Marketing), data is sent directly to the third party, which processes it as its own controller (or joint controller). See Privacy Policy Section 7 for details.
Rivalio's advertising slots are fully first-party — creatives are loaded from rivalio.cz, and no data is sent to third parties in connection with advertising.
Note: Inter (typeface) is self-hosted from rivalio.cz, so no requests reach Google — regardless of consent.
7. How to manage cookies
7.1 Cookie banner
On your first visit, a banner is shown with three buttons of equal visual weight:
- Accept all — enables all four categories,
- Reject all — keeps only Essential, disables the rest,
- Customise — opens a per-category toggle modal.
7.2 "Manage cookies" in the footer
Every Rivalio page has a Manage cookies link in the footer that reopens the banner / modal and lets you change your existing choice. The change applies immediately and is written to the audit trail (see Section 8).
7.3 Browser settings
You can also manage cookies in your browser directly:
- Chrome:
chrome://settings/cookies - Firefox:
about:preferences#privacy - Safari: Preferences → Privacy → Cookies and website data
- Edge:
edge://settings/content/cookies
Clearing cookies in the browser also clears the choices saved in localStorage, so the banner will reappear on your next visit.
8. Consent audit trail
To meet the burden of proof in case of an ÚOOÚ inspection, the Controller stores every consent given or withdrawn in an internal audit log. Each record contains:
- a unique consent identifier,
- a snapshot of category choices at the moment of consent,
- a snapshot of the category text you saw,
- the site language and schema version,
- an anonymised IP address (IPv4 truncated to
/24, IPv6 to/48), - the User-Agent string,
- a server-side timestamp.
The record is immutable — if you change your choice, a new row is created and linked to the previous one. Retention: 24 months from the last consent (or withdrawal), then automatically cleaned up.
9. Consequences of refusal
| What you refuse | What you lose |
|---|---|
| Functional | YouTube embeds show a placeholder with a "Load video" button; reCAPTCHA does not load, anti-spam falls back to honeypot + rate limiting. |
| Statistical | Currently nothing — the category is not in use. |
| Marketing | Nothing functional — ads are displayed the same way and clicking them works normally; only the short-term click deduplication (ad_click_{id}) is not stored. |
| Essential | Cannot be refused — Rivalio would not work without them (sign-in, CSRF, security). |
Remember: the Service must work even with all non-essential cookies refused. If refusing breaks something, that is a bug — please contact us at info@rivalio.cz.
10. Changes and contact
10.1. This Policy may be updated at any time. We will inform you of material changes pursuant to Section 16 of the Privacy Policy (e-mail, in-app notice, at least 30 days before the effective date).
10.2. If a change affects the categories of cookies, we invalidate existing consents and ask you to decide afresh. This also applies to this version 1.2 — because the list of cookies used is changing, the cookie banner will reappear for you after deployment.
10.3. Questions and complaints: privacy@rivalio.cz. A complaint with the supervisory authority may be lodged at the Office for Personal Data Protection (https://www.uoou.cz) or the supervisory authority of your country of habitual residence.
End of Cookies Policy. Version 1.2.