Optional categories are off by default. Closing the banner leaves only necessary technical tools active.
1. Legal framework and approach
This Cookie Policy supplements the Privacy Policy and describes cookies, local storage and equivalent technologies. The consent manager is designed so that non-essential technologies requiring consent remain inactive until a valid choice, consistently with GDPR and applicable ePrivacy rules, including the Italian Data Protection Authority’s cookie guidance.
2. Cookies and equivalent identifiers
Cookies are small files or strings stored on or read from a device. Equivalent technologies may include local storage, session storage, pixels, tags, SDKs and server-side identifiers. Whether a technology is “necessary” depends on purpose and need for the user-requested service.
3. Current portal architecture
The portal uses technical technologies for theme preference, administrative-session continuity, security, form operation and consent storage. The consent centre includes optional Analytics and Marketing categories. Their presence does not mean that third-party providers are currently active; future optional tools must be inventoried and consent-gated before activation.
4. Categories and purposes
| Category | Default | Purpose |
|---|---|---|
| Necessary / technical | ON | security, sessions, requested preferences, forms, consent memory |
| Optional analytics | OFF | non-essential audience/performance measurement |
| Marketing / profiling | OFF | advertising, remarketing, profiling, tracked third-party content |
5. First-party technical inventory
| Name/key | Technology | Function | Indicative duration |
|---|---|---|---|
| lumifold_cookie_consent | first-party cookie | summary of cookie preferences | up to 180 days |
| lumifold_cookie_consent_v2 | localStorage | detailed choice, timestamp and policy version | up to 180 days / until material revision |
| lumifold-theme | localStorage | requested light/dark preference | persistent until cleared |
| admin session | session cookie | authentication and security | session / server configuration |
6. Consent mechanism
On first access, if no valid choice exists, users may reject optional tools, customise settings, accept all optional tools or close the banner while keeping technical defaults. Analytics and Marketing are not preselected. The choice is stored with a timestamp and policy version.
7. Analytics
If non-essential analytics tools are introduced, they will be loaded only after consent unless a different legal classification is properly documented. Provider, purposes, identifiers, duration and transfer information will be added before activation.
8. Marketing and embedded third-party content
Advertising pixels, remarketing, social plugins, maps, videos or embedded services may send identifiers to third parties. Where this is non-essential tracking, the relevant component must remain blocked or neutral until consent.
9. Local storage and functional preferences
Local storage may remember settings explicitly requested by the user, such as visual theme and cookie preferences. It is not used for profiling without consent.
10. Duration and renewal
Cookie choices are treated as valid for no more than approximately 180 days. A renewed choice may be requested earlier when purposes, categories, third parties or consent-manager version change materially.
11. Withdrawal and change
Users can review choices at any time. Withdrawal applies for the future and does not affect processing lawfully carried out before withdrawal.
12. Browser controls
Most browsers let users delete or block cookies/storage. Blocking necessary tools may prevent essential functionality, authentication, preference storage or form submission.
13. Third-party technologies
Where third-party services are actually deployed, the provider may act as processor or independent controller. UESE performs the required contractual and transparency assessment and keeps the operational inventory current.
14. Updates
This policy is reviewed when technologies, providers or legal requirements change. Version and date identify the current revision.
15. Technical record of the choice
The consent manager stores the selected categories, a timestamp and the policy/configuration version. This supports accountability and prevents unnecessary repeated requests. The consent record is not used for profiling.
16. Neutral choice and no pre-selection
Optional categories are not pre-selected. Rejecting optional technologies does not prevent access to the essential portal content. The interface separates categories clearly and users can change their choice later without providing a reason.
17. Embedded content and future integrations
If maps, video platforms, social widgets, chatbots, analytics or marketing technologies are introduced and involve non-essential terminal access or tracking, they should remain blocked or neutral until the appropriate choice is made, and the inventory will be updated with provider, purpose and duration.