Cookie Policy

1. What cookies are

Cookies are small text files stored by a website in the visitor's browser. They may be necessary for the Application to work, remember a choice, or—only with consent—measure how the Application is used.

2. Necessary cookies

The Application uses the surface_identity_session cookie to maintain the server session required for security controls such as form protection. It is a first-party session cookie, is not used for advertising, and expires when the browser session ends.

The Application uses the surface_analytics_preference cookie to remember whether the visitor accepted or rejected optional site-usage measurement. It stores only the decision, this Cookie Policy version, and the decision time. It contains no lead identity, lasts for six months, and is necessary to respect the visitor's choice.

Necessary cookies do not require Analytics consent and cannot be used by the Application to activate Google Analytics.

3. Google Analytics cookies

If the visitor explicitly accepts Analytics, the Application loads Google Analytics 4, provided by Google LLC, solely to measure page views and aggregate site usage. The integration may set the first-party cookie _ga to distinguish visitors and a measurement-specific _ga_* cookie to preserve session state.

Surface Identity configures these cookies to expire after six months without extending their lifetime on each visit. Google documents a two-year default, which this Application intentionally shortens. No Analytics cookie is created by the Application before acceptance.

4. Data and purpose

Site-usage measurement may process page address and title, approximate geographic area, browser, device, operating system, language, session information, and page-view time. Google states that IP addresses from users in the EU, Switzerland, or the United Kingdom are used for coarse geolocation and discarded before they are logged or stored.

The Application does not send waiting-list names, e-mail addresses, professions, product interests, consent values, or other form data to Google. It sends page views only. Enhanced Measurement, custom events, Google Signals, advertising features, remarketing, advertising personalization, and Google Ads product links are outside this integration.

5. Legal basis, provider and transfers

Analytics is activated on the basis of the visitor's explicit consent. The Data Controller is Beniamino Ferrari, Via Gorizia 20, 26013 Crema, Tax Code FRRBMN82M11G842O, e-mail info@surfaceidentity.com. Google LLC acts as the Analytics provider and recipient of measurement data.

Google may process data outside the European Economic Area subject to the safeguards and data-processing terms described by Google. Further information is available in the Google Analytics data privacy and security documentation (external site).

6. Retention

The Analytics preference and Analytics cookies last for no more than six months. The Data Controller configures the GA4 property to retain user-level and event-level data for two months. Google may retain aggregated reports according to its service operation and applicable terms.

7. Giving, refusing and withdrawing consent

The visitor may accept or reject Analytics from the consent interface without losing access to the Application. Closing the interface, scrolling, or continuing to browse does not indicate consent.

The Cookie settings control in the footer allows the visitor to change the choice at any time. Withdrawal stops future measurement initiated by the Application and removes known _ga cookies accessible to the Application. Browser controls may also be used to inspect or delete cookies.

Policy version and publication date: 11/08/2026