Cookie policy

This Cookie Policy explains which cookies and similar storage technologies we use on our websites, why we use them, and how you can manage them. It applies to all Digital Front domains, including digitalfront.nl and any subdomains.

This policy supplements our Privacy Policy. For full information on how we process personal data, including data collected via cookies, please refer to our Privacy Policy. In the event of any inconsistency, the Privacy Policy shall prevail.

Digital Front is the data controller for the cookies and tracking technologies on our websites, as defined in the General Data Protection Regulation (GDPR) and the Dutch Telecommunications Act.

Cookies are small text files that websites store on your device when you visit them. They help the site remember your preferences and understand how you use the site. In addition to traditional cookies, we also use similar browser technologies such as localStorage and sessionStorage, which store data directly in your browser.

• First-party storage is set by the website you are visiting (our domains). It can only be read by our site.
• Third-party cookies are placed by external services embedded on our site, such as booking tools or error-tracking services. These services may read their cookies across different websites.

Dutch law requires us to explain the legal basis for each type of cookie.

A complete overview of all cookies and browser storage used on our site, grouped by category.

Some cookies are placed by external services embedded on our site. These services may process data outside the European Economic Area (EEA). The table below shows where each provider is located and which safeguards apply:

All providers act as processors on our behalf. Where data is transferred outside the EEA, we use EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework to ensure an adequate level of protection.

On your first visit to our site, a cookie banner appears with three options: Accept all, Reject all, or Customise.

• No pre-loading: analytical and functional cookies are never placed before you have made an active choice. If you do nothing, only strictly necessary cookies are used.
• Your choice is stored in a first-party cookie (df_consent, valid for one year) and recorded in a pseudonymised audit log in which your IP address is hashed with a daily rotating key hash.
• You can change your choice at any time by clicking the cookie icon at the bottom left of any page. Withdrawing consent is as easy as giving it, as required by article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
• Our cookie banner gives equal visual weight to all options. We do not use dark patterns or pre-ticked boxes.
• You have access to the full site even if you refuse all non-essential cookies. We never make access to content or functionality conditional on accepting tracking cookies.

You have two ways to manage cookies:

• Our cookie settings: click the cookie icon at the bottom left of any page to reopen the banner and adjust your preferences.
• Your browser settings: you can delete or block cookies via your browser. Please refer to your browser's help pages for instructions. Note that blocking all cookies, including strictly necessary ones, may cause the site to function improperly.

If you delete cookies in your browser, your df_consent cookie will also be removed. On your next visit, the banner will appear again so you can make a new choice.

Different cookies and related data have different retention periods:

• Consent cookie (df_consent): 1 year, then automatically deleted.
• Theme preference (localStorage): until you clear your browser data.
• Analytics beacons (Vercel Analytics, Speed Insights): per page view, no persistent storage. Sentry session cookies: deleted when you close your browser. Cal.eu: __clnds cookie persists for 1 year, session cookies are deleted when you close your browser.
• Chat messages (sessionStorage): deleted when you close the browser tab.
• Form drafts (sessionStorage): deleted when you close the tab or submit the form.
• AI chat sessions (server-side): 30 days, then automatically deleted via Redis TTL.
• Consent log: 5 years, in accordance with the accountability requirement in article 7(1) GDPR and guidance from the Dutch Data Protection Authority.

External providers may retain data in accordance with their own policies. We recommend consulting their privacy policies directly.

Under the GDPR, you have the following rights in relation to personal data processed via cookies:

• Right of access: to request which data we hold about you.
• Right to rectification: to have inaccurate data corrected.
• Right to erasure: to request deletion of your data.
• Right to restriction: to ask us to temporarily stop processing.
• Right to data portability: to receive your data in a machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: to withdraw your cookie consent at any time, without affecting the lawfulness of earlier processing.

To exercise any of these rights, please email info@digitalfront.nl. We will respond within one month, as required by article 12(3) GDPR.

If you believe we have not handled your request properly, you have the right to lodge a complaint with the Dutch supervisory authority:

We may update this Cookie Policy when we add or remove cookies, change providers, or when the law requires it. The "last updated" date at the top of this page always shows the most recent version. For material changes that require renewed consent, such as adding a new cookie category, we will reset your preferences and show the cookie banner again.

Questions about our use of cookies? Please email info@digitalfront.nl. We aim to respond within one month.