Legal
Cookie policy
Position
This site operates no advertising pixel, no social-media embed and no cross-site tracker. One product-analytics service, PostHog, is loaded only after the analytics category has been accepted, from PostHog's European Union cloud (eu.i.posthog.com), and records only the named events listed under analytics cookies below. The content security policy permits no other external script origin, so a tracker cannot be introduced by a tag manager or by a change to page markup alone.
Non-essential cookies and similar technologies are blocked at the JavaScript level until consent is given. Nothing beyond the strictly necessary category is loaded, executed or contacted before that point. Consent is not inferred from continued browsing, from scrolling, or from closing the notice. The functional and marketing categories are empty; they are listed so that their emptiness is explicit.
Categories
| Category | Default | Purpose | Blocked until consent |
|---|---|---|---|
| Strictly necessary | On, cannot be disabled | The consent record, the age-and-capacity confirmation, signed-in sessions and the supply region shown | No — exempt under Art. 5(3) ePrivacy |
| Functional | Off | None operated | Yes |
| Analytics | Off | One first-party cookie, dohrna_sid, and the PostHog analytics script, both only if this category is accepted. The site keeps a first-party, server-side record of a few events (a visit begun and where it came from, a product page viewed, a pack added to the basket, checkout reached, an order recorded, a destination refused, a referral link opened); it sets nothing in the browser for this, and links the events of one visit together only where this category is accepted; PostHog records the named journey events listed below — see the privacy policy |
Yes |
| Marketing | Off | None operated | Yes |
Strictly necessary cookies
| Name | Purpose | Lifetime |
|---|---|---|
dohrna_consent |
Records the consent decision per category, with a timestamp and policy version | 12 months |
dohrna_capacity |
Records the age-and-capacity confirmation | 12 months |
dohrna_customer |
Maintains a signed-in customer session | Session |
dohrna_affiliate |
Maintains a signed-in affiliate-portal session | Session |
dohrna_session |
Maintains a signed-in operator session on the administration routes | Session |
dohrna_geo |
The country the connection was detected from, so the site can state the supply position for that country | 30 days |
dohrna_region |
The supply region shown — detected from the connection, or chosen with the region control; a choice outranks the detection | 30 days |
dohrna_net |
Whether the connection appeared to be routed through a VPN or proxy, where that check is enabled; the value is ok, vpn or unknown |
30 days |
None of these cookies identifies a person to a third party, and none is read by any party other than this site.
Analytics cookies
Set only where the analytics category has been accepted. Nothing in this section is set otherwise, and the site operates normally without it.
| Name | Purpose | Lifetime |
|---|---|---|
dohrna_sid |
An opaque random identifier, so the site's own event record can tell one visit apart from another. It is not derived from an IP address, a device, an account or an email address, and it is never stored in this form: the event record keeps only a salted, non-reversible hash of it | 90 days |
ph_…_posthog (cookie and browser storage) |
PostHog's own identifier for the browser, so that the events below from one browser can be read as one journey. Set by the PostHog script, which is loaded only after this category is accepted | 12 months |
PostHog is operated by PostHog Inc. from its European Union cloud; events are sent to eu.i.posthog.com and the script is served from eu-assets.i.posthog.com. It runs with automatic capture, page-view capture and heat maps switched off, and records these named events: a referral link opened (the referral code and the page), a product page viewed (the product), a pack added to or removed from the basket (the product, the pack and its price), the account step before checkout shown, a checkout opened (the number of lines and their value), an order submitted (the order reference, the number of lines, their value and the settlement route), a WhatsApp button pressed (which button) and an account registered. Session recording is on for catalogue and product pages only: every form input is masked, and the checkout, account, affiliate and operator pages are never recorded. No event carries an email address, a delivery address, an IP address or the contents of an order beyond product and pack. A person who has an account is identified to PostHog by their account number, with the name given at registration and the referral code the account belongs to, if any; before that, a person who submits an order is identified by a one-way hash of their email address, never the address itself. dohrna_sid is read by this site alone and is not sent to PostHog. There is no Google, no Meta, no tag manager and no pixel of any kind.
Partner-link cookie
Set when a page is opened through a partner's link, whatever was chosen on the consent notice, for the same purpose as the dohrna_ref entry in browser storage below: so that the partner who sent the visitor is credited with an order placed afterwards.
| Name | Purpose | Lifetime |
|---|---|---|
dz_aff |
The partner code, the placement tag on the link and a four-character message reference, for the first and the most recent partner link followed in the last 30 days, with the time of each. Nothing about the visitor | 30 days from the last page viewed |
Browser storage
Two values are kept in the browser's own storage rather than in cookies, and are never sent to the site except as part of an order the customer places:
| Key | Purpose | Lifetime |
|---|---|---|
dohrna_ref |
A referral code from a link the visitor arrived by, or a code typed at checkout, attached to an order placed while it is held | 365 days |
| Basket | The lines and quantities in the basket, so it survives a page change and a return visit | 30 days from the last change |
How consent is obtained
The first layer of the consent notice presents "Reject all" and "Accept selected" with equal visual weight — the same size, the same contrast and the same position. Neither is emphasised over the other, and the reject control is not hidden behind a second screen.
Category toggles default to off. Consent is granular: a category may be accepted without accepting any other.
Withdrawing or changing consent
A Cookie settings link appears in the footer of every page and is available at all times. Changing a category to off stops the associated scripts from loading on the next page load and clears the cookies in that category.
Re-consent
A consent decision is retained for twelve months. After that period the notice is presented again.
Record of consent
Each decision is logged with a timestamp, the categories accepted, and the version identifier of this policy. Consent records are retained for twelve months and are described in the privacy policy.
Contact
Enquiries about this policy: dpo@dohrna.com.