Legal

Cookie policy

Last updated: 17.07.2026

1. Purpose of this policy

This Cookie and Similar Technologies Policy explains how CERTCAR SRL, headquartered in Pantelimon, Șos. Cernica no. 24-30, ground floor, apt. 3, Ilfov, registered with the National Trade Register Office under no. J2025047290005, tax identification number RO 52064384, managed by Ioniță Cristian and Gavril Andrei, uses cookies, pixels, tags, online identifiers, localStorage, sessionStorage and other similar technologies on the website www.certcar.com, as well as, where applicable, on associated subdomains or platforms, including b2b.certcar.com and affiliate.certcar.com, to the extent they are operated by CERTCAR SRL.

This document aims to inform users of this website, before expressing any choice, about the types of cookies and similar technologies used, their purposes, storage duration, involved providers, the data that may be stored or accessed, and the ways in which users can manage or withdraw their choices while navigating this website.

2. What are cookies

A cookie is a small file consisting of letters and numbers stored in your browser or on your device when you access a website.

Cookies are installed at the request of a web server to a browser (e.g., Chrome, Edge) and do not contain software, viruses, or spyware. They cannot access information on your device and generally do not directly identify you as a person but collect information about your preferences or the device used, to provide a more efficient and personalized browsing experience.

In certain situations, information collected through cookies or similar technologies, such as IP addresses, online identifiers, device identifiers, or browsing behavior information, may constitute personal data when they allow the direct or indirect identification of the user. In such cases, processing is also carried out in compliance with the Privacy Policy.

The cookies and similar technologies used on the site have, depending on the category they belong to, purposes such as ensuring the proper functioning and security of the website, remembering user preferences, analyzing platform performance, measuring conversions, evaluating and optimizing advertising campaigns, and creating remarketing audiences. Non-essential cookies and similar technologies are activated only under the conditions described in this Policy and based on the user's consent.

We respect your right to privacy, which is why you have the option to choose which types of cookies you accept. However, disabling certain cookies may affect your browsing experience and the functionality of some website services.

3. What types of cookies we use

In brief, the website uses the following categories of cookies and similar technologies:

Our website may use first-party cookies set by CERTCAR SRL, as well as cookies or similar technologies placed by third parties, to the extent they are used on the site, such as analytics, marketing, security, payment, technical functionality, consent management, or social media service providers.

Strictly necessary cookies

Status

Active without consent

Main purpose

Authentication, security, payments, anti-bot protection, website operation

Impact of refusal

Blocking them may affect authentication, payment, site access, or form submission

Strictly necessary similar technologies

Status

Active without consent

Main purpose

Storing language, cookie preferences, checkout flow, and report generation progress

Impact of refusal

Blocking them may affect the purchase flow, the report, or preference storage

Performance / analytics cookies

Status

Active only with consent

Main purpose

Google Analytics 4, internal statistics on website usage

Impact of refusal

Refusal does not affect website functionality

Optional functional cookies

Status

Not currently used

Main purpose

Reserved for future functionality

Impact of refusal

No impact in the current configuration

Marketing / remarketing cookies

Status

Active only with consent

Main purpose

TikTok Pixel, Meta Pixel, and Google Ads: conversion measurement, advertising campaign optimization, and remarketing

Impact of refusal

Refusal does not affect website functionality

The specific list of cookies and similar technologies used is available in the tables below and will be updated whenever changes occur. First-party cookies are primarily necessary for ensuring the proper functioning of the website and for providing the services requested by users, without generally involving the processing of personal data that would allow their direct identification.

Cookies and similar technologies placed by third parties may be used, depending on the technical implementations on the site, for analyzing website performance, monitoring usage, ensuring platform security, processing payments, authenticating through third-party services, protecting against abuse, conversion measurement and attribution, advertising campaign optimization, creating remarketing audiences, and improving user experience.

CERTCAR SRL uses the TikTok Pixel, the Meta Pixel, and the Google Ads tag for conversion measurement and attribution, evaluation and optimization of advertising campaigns and, in the case of the TikTok Pixel and the Meta Pixel, the creation of remarketing audiences. These technologies fall under the marketing cookie category and are used under the conditions described in this Policy.

The website may include links to Certcar's social media pages and/or authentication functionalities through third-party services such as Google or Facebook/Meta, only to the extent they are effectively implemented. Authentication functionalities are distinct from the marketing technologies represented by the TikTok Pixel, the Meta Pixel, and the Google Ads tag. Marketing technologies are activated in accordance with the choices expressed by the user through the cookie management mechanism.

Depending on the technology used, accessing the website or interacting with these functionalities may result in the transmission of information to third parties, such as IP addresses, online identifiers, browser information, device information, or pages accessed. Certain third parties (e.g., web analytics, marketing, or social media service providers) may process personal data outside the European Economic Area. In such cases, the transfer is carried out in compliance with the guarantees provided by Articles 44-49 of Regulation (EU) 2016/679, such as standard contractual clauses adopted by the European Commission or applicable adequacy mechanisms.

Regarding the collection and transmission of data to third parties through these technologies, CERTCAR SRL may act as a data controller or, as applicable, joint controller, within the limits determined by applicable legislation and the specific method of implementation. For subsequent processing carried out by third parties for their own purposes, they act according to their own privacy policies.

Non-essential cookies and similar technologies that involve storing information on the user's device or accessing already-stored information are activated only after the user expresses consent. The TikTok Pixel and the Meta Pixel remain disabled before consent is expressed for the marketing category. The Google Ads tag operates under the conditions described in section 3.4, including, in the absence of consent, through the possibility of transmitting cookieless technical signals. Please consult the privacy policies of the respective providers to understand how they process your data and to learn how you can manage the information associated with their services.

Cookie duration may vary depending on the purpose for which they are used:

  • cookies that are used only during website use and are deleted when you close your browser;
  • cookies that remain stored on your device until they reach their expiration date or until you decide to delete them through your browser settings.

3.1. Necessary cookies

These cookies are essential for the proper functioning of the website and cannot be disabled through our settings. They are used to record and manage actions performed by users, such as expressing privacy preferences, authenticating into accounts, or submitting forms.

Users can set their browser to block or signal the use of these cookies, but in this case certain website functionalities may become unavailable or may not function properly.

These cookies are used without user consent, as they are strictly necessary for the functioning of the website, for providing the service expressly requested by the user, for authentication, security, remembering cookie preferences, fraud prevention, or carrying out communication through the electronic communications network.

To the extent that the information processed through these cookies constitutes personal data, the legal basis for processing may be, as applicable, the performance of a contract, the legitimate interest of CERTCAR SRL, or the fulfillment of a legal obligation, in accordance with Article 6(1) of Regulation (EU) 2016/679 (GDPR), namely the need to ensure the proper functioning of the website.

These cookies are not used for marketing or behavioral analysis purposes. They may be placed by CERTCAR SRL or by technical providers used for the operation, security, authentication, fraud prevention, consent management, or provision of services requested by the user. The list of cookies used in this category is as follows:

auth_token

Cookie usage source

Certcar / Certcar backend infrastructure

Technology description

First-party cookie used to maintain the JWT authentication session, shared across .certcar.com subdomains, configured in production as HttpOnly, Secure, and SameSite=None.

Validity period

7 days

Blocking effect

The user cannot authenticate and cannot access their account, dashboard, reports, or checkout for authenticated users.

connect.sid

Cookie usage source

Certcar / Passport.js

Technology description

First-party temporary session cookie, used exclusively during the Facebook authentication process.

Validity period

Session

Blocking effect

Facebook authentication may fail; email or Google authentication may remain functional.

__stripe_mid

Cookie usage source

Stripe

Technology description

Cookie placed by Stripe, used for fraud prevention and securing payment processing.

Validity period

approximately 1 year

Blocking effect

Payment may be refused, delayed, or flagged as suspicious.

__stripe_sid

Cookie usage source

Stripe

Technology description

Cookie placed by Stripe, used for fraud prevention during the checkout process.

Validity period

approximately 30 minutes

Blocking effect

The checkout process may fail.

__cf_bm

Cookie usage source

Cloudflare

Technology description

Cookie placed by Cloudflare for automated traffic management and bot protection.

Validity period

approximately 30 minutes

Blocking effect

Website access may be degraded, limited, or blocked.

_cfuvid

Cookie usage source

Cloudflare

Technology description

Cookie placed by Cloudflare for rate limiting and infrastructure security.

Validity period

Session

Blocking effect

Website access may be degraded, limited, or blocked.

cf_clearance

Cookie usage source

Cloudflare

Technology description

Cookie placed by Cloudflare when a security verification is required.

Validity period

approximately 30 minutes - 1 year

Blocking effect

The user may repeatedly receive security verifications.

_GRECAPTCHA

Cookie usage source

Google reCAPTCHA v3

Technology description

Cookie used for anti-bot protection and abuse prevention in contact, support, and account creation forms.

Validity period

approximately 6 months

Blocking effect

Contact, support, or account creation forms may become impossible to submit.

voucher

Cookie usage source

Certcar

Technology description

First-party cookie that remembers the discount (voucher) code applied by the user, to be used at checkout.

Validity period

30 days

Blocking effect

The discount associated with the voucher is no longer applied automatically at checkout.

The _GRECAPTCHA cookie is used to protect forms against abuse, spam, and automated access. It is treated as necessary technology for website security and for the functioning of relevant forms. If CERTCAR SRL modifies the implementation of this technology or uses an alternative solution, this policy and the consent mechanism will be updated accordingly.

3.1.1. Strictly necessary similar technologies

In addition to the cookies mentioned above, the website uses localStorage and sessionStorage technologies. These are not cookies per se, but may involve storing information in the user's browser. They are used for the functioning of the requested service, remembering essential preferences, and carrying out the platform's technical flows.

Blocking or deleting these technologies may cause the cookie banner to appear repeatedly, loss of language preferences, interruption of the checkout flow, inability to resume the purchase process, or incorrect display of report generation progress.

i18nextLng

Technology type

localStorage

Purpose

Remembers the language chosen by the user, e.g., Romanian or English.

Persistence

Until manually deleted or browser storage is cleared.

cc:consent, cc:decided

Technology type

localStorage

Purpose

Remembers the user's expressed choices regarding cookies and similar technologies.

Persistence

Until manually deleted or browser storage is cleared.

vin, completeVin, priceObject, priceContext, priceId, lastPage, isOnboarding, redirectLink, email, userId

Technology type

localStorage

Purpose

Stores information necessary for checkout, package selection, report generation, and resuming the purchase flow.

Persistence

Until manually deleted or browser storage is cleared.

freshGenerationId, reportProgress:<id>

Technology type

sessionStorage

Purpose

Temporarily stores report generation progress and enables correct display of the progress interface.

Persistence

For the duration of the session, until the tab or browser is closed.

3.2. Performance cookies

These cookies are activated exclusively based on consent expressed by the user when accessing the website, in accordance with Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR).

Through these cookies, statistical data regarding the number of visits and traffic sources is collected, information that allows us to evaluate and optimize the website's performance. They help us identify pages with high or low access rates and understand how visitors generally use the site.

Depending on the tools used and their configuration, the data may be aggregated or may include online identifiers, IP addresses, browser information, device information, and browsing behavior. CERTCAR SRL does not use this information to directly identify users; however, certain information may constitute personal data within the meaning of GDPR. If these cookies are not accepted, we will not be able to determine when the website was accessed or monitor its efficiency and performance.

The list of cookies used in this category is as follows:

_ga

Cookie usage source

Google Analytics 4

Technology description

Cookie used to distinguish users for statistical purposes and to measure website usage.

Validity period

approximately 2 years

_ga_<property-id>

Cookie usage source

Google Analytics 4

Technology description

Cookie used to maintain session state for each active Google Analytics 4 property. Properties indicated in the technical inventory are: customer G-3TLZ9VP8C3, business G-QCM4T7R6PP, affiliate G-KC2D61HM6F.

Validity period

approximately 2 years

_gid

Cookie usage source

Google Analytics 4

Technology description

Cookie used to distinguish users for statistical purposes.

Validity period

24 hours

_gat, _gat_gtag_*

Cookie usage source

Google Analytics 4

Technology description

Cookie used to limit the rate of requests sent to Google Analytics.

Validity period

approximately 1 minute

Google Analytics 4 cookies are activated only based on user consent, through the consent mechanism implemented on the site. Refusing these cookies does not affect website functionality but limits CERTCAR SRL's ability to obtain internal statistics regarding platform usage and performance.

3.3. Functional cookies

Currently, the website does not use optional functional cookies distinct from the strictly necessary cookies and similar technologies mentioned in sections 3.1 and 3.1.1 above.

Certain preferences or information necessary for providing the service requested by the user, such as the chosen language, cookie preferences, or information necessary for the checkout and report generation flow, are stored through localStorage or sessionStorage technologies, as described in the section dedicated to strictly necessary similar technologies.

If CERTCAR SRL subsequently implements optional functional cookies, they will be activated only after the user expresses consent and will be included in the table below.

No optional functional cookies are currently used.

3.4. Targeting/marketing cookies

Marketing cookies are activated only based on consent expressed by the user, in accordance with Article 6(1)(a) of Regulation (EU) 2016/679. The TikTok Pixel and the Meta Pixel do not set cookies and do not transmit data to the respective providers before consent is expressed for the marketing category. Regarding the Google Ads tag, in the absence of consent no advertising cookies are set, and only the cookieless technical signals described in this section may be transmitted. Refusing marketing cookies does not affect the operation of the website or the user's ability to access Certcar's services.

These technologies are used for measuring the effectiveness of advertising campaigns, attributing conversions, evaluating and optimizing campaigns and, where applicable, creating remarketing audiences on the platforms of third-party providers.

Currently, the certcar.com website uses the following marketing technologies:

  • a) the TikTok Pixel, a technology provided by TikTok Technology Limited, used for conversion measurement and attribution, correlating events occurring on the site with TikTok advertising campaigns, campaign optimization, and the creation of remarketing audiences. The TikTok Pixel identifier used is D8TSDMBC77UEASQ4JSHG;
  • b) the Meta Pixel, a technology provided by Meta Platforms Ireland Limited, used for conversion measurement and attribution, evaluation and optimization of advertising campaigns run on Meta platforms, and the creation of remarketing audiences. The Meta Pixel identifier used is 1324863263126495;
  • c) the Google Ads tag, a technology provided by Google Ireland Limited, used for conversion measurement and attribution and optimization of Google Ads advertising campaigns. The Google Ads tag identifier used is AW-18310688463.

The TikTok Pixel and the Meta Pixel are loaded in a held state and do not set cookies and do not transmit data to TikTok or Meta, respectively, before the user expresses consent for the marketing category through the cookie management mechanism. Refusing consent keeps these technologies disabled, and subsequent withdrawal of consent stops any further transmission of data through them.

The Google Ads tag is implemented through Google Consent Mode v2. In the absence of consent for the marketing category, no Google Ads advertising cookies are set. Cookieless technical signals may be transmitted to Google, used for aggregate conversion modeling and estimation. After consent is expressed for the marketing category, the Google Ads tag may operate including by setting the cookies indicated in the table below.

Through marketing technologies, depending on the technology and the event tracked, information may be processed such as IP address, online identifiers, cookie and device identifiers, browser and operating system information, pages viewed, traffic source, the URL of the previously visited page, the user's interactions with the site, and events such as viewing a page, initiating the checkout process, or completing a payment.

_ttp

Usage source

TikTok Pixel

Technology description

Cookie used for conversion measurement and attribution and for correlating events occurring on the site with TikTok advertising campaigns.

Validity period

approximately 13 months

_tt_enable_cookie

Usage source

TikTok Pixel

Technology description

Cookie used to determine whether the TikTok Pixel is allowed to set and use cookies.

Validity period

approximately 13 months

ttwid

Usage source

TikTok

Technology description

Cookie used to identify the browser for advertising, measurement, and analytics purposes.

Validity period

approximately 13 months

_fbp

Usage source

Meta Pixel

Technology description

Cookie used to identify the browser, measure and attribute conversions, and display relevant advertising communications across Meta platforms.

Validity period

approximately 3 months

_fbc

Usage source

Meta Pixel

Technology description

Cookie used to store the fbclid advertising click identifier for conversion attribution, when the user accesses the site via a Meta ad.

Validity period

approximately 3 months

_gcl_au

Usage source

Google Ads (gtag.js)

Technology description

Cookie used for measuring and attributing conversions originating from Google Ads advertising campaigns. It is set after consent is expressed for the marketing category.

Validity period

approximately 3 months

_gcl_aw

Usage source

Google Ads

Technology description

Cookie used to store the gclid advertising click identifier for conversion attribution, when the user accesses the site via a Google Ads ad.

Validity period

approximately 3 months

Marketing cookies are managed through the consent mechanism implemented on the site. The user may refuse their activation or subsequently withdraw consent by accessing the "Cookie Settings" option. Refusing or withdrawing consent does not affect the general functionality of the site but limits the ability of CERTCAR SRL and the providers involved to measure conversions, optimize advertising campaigns and, where applicable, carry out remarketing activities.

3.5. Third-party services that may set cookies on their own domains

When using the website or certain functionalities thereof, the user may interact with third-party services that may set cookies or similar technologies on their own domains. These cookies are managed by the respective providers, according to their own privacy policies and cookie policies.

Depending on the cookie category accepted and the tools effectively used on the site, information such as: IP address, online identifiers, cookie identifiers, device identifiers, browser type and version, operating system, browser language, access date and time, pages viewed, URL of the previously visited page, events accessed on the site, traffic source, site interactions, technical information about the device and approximate location derived from the IP address may be processed. In the case of the marketing and advertising technologies used on the site, information may also be processed regarding advertising campaigns, the user's interactions with them, and conversion events, in compliance with the law and according to the user's expressed preferences.

We do not collect precise GPS location data through cookies, except in cases where such functionality is implemented separately and expressly brought to the user's attention.

Separately from cookies and similar technologies, CERTCAR SRL may carry out certain technical server-side processing, necessary for the security, operation, and protection of the platform against abuse. This processing does not necessarily involve storing information on the user's device and is described in the Privacy Policy.

For more information about the data processed, please visit our Privacy Policy section.

Stripe

Relevant domains or services

js.stripe.com

General purpose

Payment processing, fraud prevention, and checkout security.

Google

Relevant domains or services

accounts.google.com, google.com, Google OAuth and Google reCAPTCHA services

General purpose

Google authentication, anti-bot protection, and abuse prevention.

Facebook / Meta

Relevant domains or services

Meta OAuth services; may include cookies such as fr, datr, sb on Meta domains

General purpose

Facebook authentication, if the user chooses this authentication method.

Cloudflare

Relevant domains or services

Cloudflare infrastructure used for protection and content delivery

General purpose

Security, anti-bot protection, rate-limiting, traffic management, and website availability.

Google Analytics

Relevant domains or services

Google Analytics 4

General purpose

Statistical analysis of website usage, only based on user consent.

Google Ads

Relevant domains or services

googleadservices.com, googleads.g.doubleclick.net, google.com/pagead

General purpose

Conversion measurement and optimization of Google advertising campaigns. Operates through Google Consent Mode: advertising cookies are set only based on the user's consent for the marketing category; without it, only aggregated, cookieless signals are transmitted.

TikTok

Relevant domains or services

analytics.tiktok.com, TikTok domains

General purpose

Conversion measurement, advertising campaign optimization, and remarketing, only based on the user's consent for the marketing category.

Meta (Facebook / Instagram)

Relevant domains or services

connect.facebook.net, facebook.com/tr, Meta domains

General purpose

Conversion measurement, advertising campaign optimization, and remarketing via the Meta Pixel, only based on the user's consent for the marketing category.

The validity periods indicated in this policy are those communicated in the technical inventory available at the date of the last update or those indicated by third-party providers and may be approximate, especially for cookies managed by third-party services. CERTCAR SRL will periodically update this policy based on technical changes to the website, the introduction of new providers, or changes in storage durations established by existing providers.

4. Managing cookies

If you do not agree with the use of cookies or with any provisions of the Cookie Policy, you can accept, reject, or configure non-essential cookies through the cookie banner displayed upon first accessing the site or at any time thereafter by accessing the "Cookie Settings" link available on the site.

Withdrawing consent is as easy as giving it and does not affect the legality of processing carried out prior to withdrawal.

Strictly necessary cookies cannot be disabled through our preferences panel, as they are necessary for the functioning of the website and the provision of requested services. However, they can be blocked from browser settings, in which case certain website functionalities may become unavailable, may not function properly, or, in certain situations, access to the site or certain services may be limited.

You can also delete cookies using the "Privacy" option in the Settings category of your browser. You can access the links below to identify, depending on the browser you use, the procedure to follow to configure these settings. Please note that by doing so, disabling the option to accept cookies may subsequently prevent access to important websites.

If you have questions regarding this Cookie and Similar Technologies Policy or wish to exercise your rights regarding personal data protection, you can contact us at the email address: [email protected]

The Cookie Policy will be updated periodically, whenever we deem it necessary. When we modify this document, we will change the revision date at the top of this page, and the updated policy will take effect regarding you and your information from that revision date. We recommend that you periodically visit this Cookie Policy to stay informed about how we protect your information.