Legal
Cookie Policy
This page explains which online identifiers we use, which ones are strictly necessary, which third-party services may become active only on the basis of consent, and what rights you have in relation to those choices.
Last updated: 4 August 2026
1. How to read this policy
This policy applies to the public site, dashboards, authentication flows, and other digital surfaces operated by Nesqual Tech SRL. It should be read together with our Privacy Policy because many cookies and similar technologies are linked to personal data or online identifiers.
Company information
Nesqual Tech SRL
VAT: RO50341187
Trade register no.: J2024000605182
Address: Strada 22 Decembrie 1989, Nr. 31, Bloc G15, Scara 3, Apartament 43, Oras Rovinari, Judet Gorj, Cod postal 215400, Romania
Representative: Norbert-Vasile Vaduva-Lapadatescu
2. The legal rules that govern cookies
The baseline rule comes from Article 5(3) of the ePrivacy Directive and, for Romanian users, Article 4(5) of Law no. 506/2004: we do not store or access information on your device for non-essential purposes without clear notice and, where required, prior consent.
Where cookies are linked to personal data, we also apply the GDPR, especially Article 6 on legal basis, Article 7 on consent conditions, and Articles 12-13 on transparency.
3. Categories of technologies and their legal logic
- Strictly necessary: allow us to maintain session state, protect authentication, remember your consent choice, and route traffic to a functioning service. These do not depend on a separate opt-in where they are indispensable to the requested service.
- Analytics and performance: help us understand product usage, errors, and user journeys. We activate them only after consent where the law requires it.
- Monitoring and diagnostics: may measure errors, latency, and stability. When they are not strictly necessary for security or immediate functionality, we treat them as consent-gated tools — Sentry Session Replay, for example, starts only with analytics consent.
- Marketing and attribution: the Meta pixel and our attribution cookies (nt_utm, nt_ref) measure campaign effectiveness and credit partners who refer us. They are not written before marketing consent and are deleted if you withdraw it.
The banner has exactly two optional toggles — Analytics and Marketing — because those are the only categories we actually use. A previous 'AI telemetry' toggle has been removed: it controlled nothing in practice, and a control that appears to do something without doing it is itself a transparency problem.
4. Full cookie inventory
The table below lists every cookie the platform can set. Cookies in the Analytics and Marketing categories are NOT written before you consent: until then Google Consent Mode is set to 'denied', and the Meta pixel and the attribution cookies are not loaded at all.
| Cookie | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| nt_access | Nesqual Tech (Microsoft Entra External ID) | Holds the access token that keeps you signed in. HttpOnly, SameSite=Strict. | Strictly necessary | Expires with the token (about 1 hour) |
| nt_id | Nesqual Tech (Microsoft Entra External ID) | Identity token: name, email, and the roles of the current session. HttpOnly. | Strictly necessary | Expires with the token (about 1 hour) |
| nt_refresh | Nesqual Tech (Microsoft Entra External ID) | Renews your session without re-entering your password. HttpOnly. | Strictly necessary | 30 days |
| nt_mfa0…N | Nesqual Tech | Holds your pending sign-in, encrypted, between the password step and entering your two-factor code. While only this cookie exists you are not signed in. HttpOnly. | Strictly necessary | 5 minutes |
| nt_pkce | Nesqual Tech | Temporary PKCE/state value protecting the sign-in redirect against CSRF. Deleted as soon as sign-in completes. | Strictly necessary | 10 minutes |
| user_role | Nesqual Tech | Routing hint that sends signed-in users to the right portal area. Never used to grant access — access is checked server-side against the token. | Strictly necessary | 30 days |
| nesqualtech_cookie_consent | Nesqual Tech | Stores your cookie choice so we do not ask again. Also mirrored into localStorage. | Strictly necessary | 180 days |
| nesqualtech_locale | Nesqual Tech | Remembers your chosen language (Romanian / English). | Strictly necessary | 1 year |
| ph_* | PostHog (EU cloud) | Product analytics: distinguishes visitors and measures pageviews and usage events. | Analytics | Up to 1 year (provider-defined) |
| _ga | Google Analytics 4 | Distinguishes visitors. Not written before analytics consent — until then Consent Mode blocks storage and Google receives only cookieless signals. | Analytics | 2 years |
| _ga_* | Google Analytics 4 | Persists measurement session state for the GA4 property. Same consent gate as _ga. | Analytics | 2 years |
| _fbp | Meta Platforms (Facebook) | Browser identifier used by the Meta pixel for campaign measurement and remarketing. The pixel is not loaded at all without marketing consent. | Marketing | 3 months |
| nt_utm | Nesqual Tech | Stores the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) from the URL so a later enquiry can be attributed to the right campaign. | Marketing | 30 days |
| nt_ref | Nesqual Tech | Stores the referral code from ?ref so a partner can be credited if you later submit an enquiry. | Marketing | 30 days |
Beyond cookies we also use browser storage: your cookie choice is mirrored into localStorage, and Sentry Session Replay (active only with analytics consent) keeps a session identifier in sessionStorage. If you withdraw consent, recording stops immediately without a page reload.
Traffic to the site passes through a CDN/WAF (Cloudflare), which may set its own strictly necessary security and anti-abuse cookies (for example __cf_bm, around 30 minutes). These serve traffic integrity, not profiling.
5. Third-party technologies we may activate
Depending on your consent choice we may activate: PostHog (product analytics, hosted in the EU cloud), Google Analytics 4 (traffic measurement), Sentry (error diagnostics and Session Replay), and the Meta pixel (campaign measurement). Cloudflare acts as CDN/WAF and is strictly necessary for delivering and securing the site.
Google and Meta are US-based providers: activating them involves a transfer of data outside the EU, carried out on the basis of standard contractual clauses and the EU-US Data Privacy Framework. You can avoid that transfer entirely by declining the Analytics and Marketing categories.
These providers may act as processors, independent controllers, or in a mixed role depending on configuration. For that reason, we seek consent where the law requires it and document the role split in the relevant privacy and contractual materials.
6. Consent management and your choices
On your first visit we present a banner that lets you accept all categories, reject non-essential technologies, or customize your preferences. From the perspective of Article 7 GDPR, your choice must be freely given, specific, informed, and unambiguous.
You can change your choices at any time through the Cookie Settings control available in the footer. If you withdraw consent, we stop future loading of technologies that depend on it without affecting strictly necessary operations.
7. Browser settings, practical effects, and contact
Most browsers let you block or delete cookies. However, if you block strictly necessary technologies, login, session continuity, anti-abuse protections, or secure routing may stop working properly.
Privacy: privacy@nesqualtech.com
Office: office@nesqualtech.com
Address: Strada 22 Decembrie 1989, Nr. 31, Bloc G15, Scara 3, Apartament 43, Oras Rovinari, Judet Gorj, Cod postal 215400, Romania