Cookie Policy

1. What cookies and browser storage are

Cookies are small text files stored by a website in your browser. Local or session storage can hold similar technical information. Ufront uses these technologies for requested functionality, security, preferences and, only with permission, analytics.

2. Essential technologies

Essential storage is required to deliver the site or portal and does not depend on analytics consent.

• NEXT_LOCALE remembers the selected language for up to 12 months.
• ufront_consent stores your cookie choice for up to 12 months.
• __Host-ufront_session keeps an authenticated portal session for up to 30 days.
• Organisation selection and a short-lived OAuth state value are used when those features are requested; OAuth state normally expires within minutes.

3. Optional analytics

Google Analytics 4 loads only after you allow analytics, and we load it directly rather than through a tag-management container. Both ufront.eu and ufront.es use the same measurement stream; your cookie choice is stored separately on each domain. Analytics may use _ga and _ga_* cookies for up to 12 months, plus a first-party session identifier and temporary event queue. With the same consent our own server records which public pages were viewed during that browser session and in what order, together with actions such as sending an enquiry; the session identifier is random and lasts only while the browser tab is open, and these records are kept for 90 days. Advertising consent remains denied, and Google signals and ad personalisation stay switched off. Our page-view events exclude private portal and authentication routes and strip URL query strings; a referring address is reduced to its domain. Use Cookie settings to withdraw consent; optional analytics cookies are then removed.

4. Cookieless visit statistics

Separately from the optional analytics above, our own server counts the pages it serves so that we can tell whether the site is visited at all. This counting happens entirely on our servers: it sets no cookie, uses no local or session storage, and neither reads nor writes anything on your device, so it does not depend on — and is not changed by — your cookie choice. We keep only daily totals: a date, a page path, a country, a preferred language and whether the request came from a phone or a computer, each as a separate counter. We also count every page viewed, the kind of place a visit came from (a search engine, a social network, another site or none, never the address itself) and how many moves there were from one of our pages to another. Because moving between our pages often happens without the page reloading, the page itself tells our server which two of our page addresses a move was between: it sends nothing else, no cookie and no identifier, reads nothing stored on your device, and is not sent at all if your browser signals Do Not Track or Global Privacy Control. No record of an individual visit exists, and no IP address, user-agent string, session or device identifier or full referring address is stored anywhere. Your IP address is used only in memory, for the moment it takes to look up a country in a database held on our own server, and is then discarded — it is never written to a file, a log or a database, and never sent to anyone. To stop one address from inflating the page-to-page counts, a one-way hash of it, salted with a random value that never leaves our server, is also held in memory for at most one minute and then dropped. That lookup uses the DB-IP IP to Country Lite database by DB-IP (db-ip.com), made available under the Creative Commons Attribution 4.0 International licence; no request about you leaves our servers. Requests from robots, link previewers, uptime checks and our own monitoring are excluded, and portal and authentication pages are not counted at all.

5. Your choice and legal basis

Essential technologies are used because they are necessary to provide a service you request or support service security. Optional analytics relies on your consent. Rejecting analytics does not prevent use of the public website's core functions. The cookieless visit counters need no consent, because they neither store anything on your device nor read anything stored on it and produce only aggregate totals in which no individual appears; we rely on our legitimate interest in knowing whether our own website is visited.

6. Changing or withdrawing consent

You can revisit the cookie controls on the website and withdraw analytics consent at any time. You may also delete or block cookies in your browser. Blocking essential storage can prevent sign-in, language preferences or other portal features from working.

7. Third-party services

Links to external services and provider-hosted pages may apply their own cookies and policies. The Ufront policy covers storage controlled through our sites; review the third party's notice before using an external service.

8. Updates and contact

We update this policy when storage purposes, retention periods or providers materially change. Questions about cookies or analytics can be sent to dpo@ufront.eu.