Cookies, on your terms.
A cookie is a small file a website saves on your device. We use cookies to keep the platform working, to understand how it's used, and (with your permission) to show you Class2Class adverts on other sites. You're in control of all but the strictly necessary ones — and we never use cookie walls.
No cookie walls
You can browse the marketing site, the help centre, and the contact page without consenting to a single non-essential cookie.
Granular consent
Four categories you can toggle independently. Accept Statistical without Marketing, Functional without either — your call.
Children protected
No marketing cookies on student accounts under 18, regardless of consent state. IP anonymisation on Statistical for minors.
Easy withdrawal
Change your preferences anytime via the link at the bottom of every page. Withdrawing is as easy as giving consent.
What each category does, and what you control.
Class2Class organises every cookie into one of four categories, following the ePrivacy Directive's framework.
Class2Class Cookie Policy.
Version 1.3 · Last updated 3 June 2026.
Plain-language summary
A cookie is a small file a website saves on your device. We use cookies to keep the platform working, to understand how it's used, and (with your permission) to show you Class2Class adverts on other sites. You can change your cookie preferences at any time. We do not use cookie walls — you can use the platform's essential features without consenting to non-essential cookies.
Why this policy exists
This Cookie Policy explains the cookies and similar technologies (collectively, "cookies") used by class2class.org and the Class2Class platform. It complements:
- The Privacy & Accessibility statement (Privacy Policy v.2.0) — describes how we process personal data more generally
- The Terms & Conditions v.2.0
- The Sub-processor List
It is published in line with:
- ePrivacy Directive Article 5(3) — consent for cookies that are not strictly necessary
- GDPR Articles 6, 7, 8 — lawful basis, conditions for consent, child's consent
- EDPB Guidelines 05/2020 on consent — granular consent, no cookie walls, clear withdrawal
- Google Consent Mode v2 requirements for analytics and advertising in the EU
The four cookie categories
Class2Class organises cookies into four categories, following the ePrivacy Directive's framework and the CookieYes consent management platform:
| Category | What it does | Consent required? | You can turn off? |
|---|---|---|---|
| Necessary | Lets the platform function — sign-in, session management, security, load balancing | No (legitimate interest under ePrivacy Art. 5(3)) | No |
| Functional | Remembers preferences — language, time zone, interface settings | Yes | Yes |
| Statistical | Helps us understand platform use in aggregate; anonymised where possible | Yes | Yes |
| Marketing | Shows you Class2Class ads on other sites; measures whether those ads work | Yes | Yes |
The current list of cookies in each category — with each cookie's name, provider, lifespan, and purpose — is available in the CookieYes preference centre, which you can open at any time via the "Cookie preferences" link at the bottom of every page. CookieYes keeps that list current automatically; this document explains the framework around it.
Consent
3.1 The consent banner
When you first visit class2class.org, a consent banner appears. You can:
- Accept all — consent to all four categories
- Reject all — consent only to Necessary cookies (which are not consent-based but are listed for transparency)
- Customise — toggle Functional, Statistical, and Marketing independently (this is the granular consent EDPB Guidelines 05/2020 requires)
You can change your choice at any time — see §3.4.
3.2 No cookie walls
We do not use cookie walls. You can use the essential features of class2class.org (the public marketing site, the help centre, the contact page) without consenting to non-essential cookies. Logged-in features of the Class2Class platform require Necessary cookies (sign-in, session management, security) — those are not consent-based; they are strictly necessary under ePrivacy Art. 5(3).
This commitment aligns with EDPB Guidelines 05/2020 on consent (sections on freely given consent and on cookie walls).
3.3 Consent Mode v2 (Google products)
For Google Analytics and any future Google advertising products, we operate Google Consent Mode v2. This means:
- When you have not consented to Statistical or Marketing cookies, Google products receive a "denied" signal and operate in a privacy-preserving mode (no individual tracking; no advertising personalisation)
- When you have consented, Google products receive a "granted" signal and operate normally
- The signal is updated as soon as you change your preferences
Consent Mode v2 specifically signals two consent dimensions: analytics_storage (Statistical) and ad_storage / ad_user_data / ad_personalization (Marketing). Each is bound to its corresponding category in our consent banner.
3.4 Changing your preferences
You can change your cookie preferences at any time:
- Cookie preferences link — at the bottom of every page on
class2class.org. Clicking it reopens the banner and lets you change any category. - Browser controls — you can also delete cookies or block specific categories through your browser settings; we cannot override your browser's choice
- Google Analytics opt-out — Google offers a browser-add-on opt-out at tools.google.com/dlpage/gaoptout for users who want to opt out of Google Analytics across all sites
Withdrawing consent is as easy as giving it. Withdrawing does not affect the lawfulness of processing already done with consent before the withdrawal — but it stops the processing going forward.
Children and teenagers (ages 13–17)
Class2Class is used by minors aged 13 and above (and, with parental consent, under 13 — see Privacy Policy §7). Our cookie practices reflect this:
- Necessary cookies are used for all users — they are strictly required for the platform to work
- Functional cookies are used where the user (or, for under-13 students, the teacher in the consent flow) has chosen to remember preferences
- Statistical cookies are configured to anonymise IP addresses (Google Analytics IP anonymisation is on); we minimise the data we collect on minors and we never use it to build a profile of any individual minor
- Marketing cookies are not set on accounts identified as student accounts under 18, regardless of consent state. Marketing cookies on the
class2class.orgmarketing site are set only with the visitor's explicit consent — we do not target minors with marketing - Granular consent — the four categories are independently toggleable, so a minor (or their teacher) can consent to Statistical without Marketing, or to Functional without either
For students under 13, parental consent under GDPR Article 8 governs all non-essential cookies; the teacher confirms in the consent flow on the parent's behalf, per Privacy Policy §7.4.
Third-party cookies — sub-processors
Some of the cookies we use are set by sub-processors who provide specific services on our behalf. The current sub-processor cookie sources, with their cookie purposes:
| Sub-processor | Purpose | Category |
|---|---|---|
| CookieYes (Synconize Solutions, India) | Stores your consent preferences | Necessary |
| Google Analytics (Google LLC, US) | Anonymised website analytics | Statistical |
| PostHog (PostHog Inc. — EU Cloud, Frankfurt) | Product-usage analytics inside the platform — EU-hosted, consent-gated, with session replay and exception capture switched off | Statistical |
| Nelio A/B Testing (Nelio Software, Spain) | A/B testing on the marketing site | Statistical |
| Chatbase (Chatbase, US) | Anonymous session identifier for the AI help chatbot | Statistical |
| Stape (Stape, Estonia) | First-party server-side analytics tagging proxy | Statistical |
| Meta Pixel (Meta, US) | Marketing measurement and advertising on Meta properties | Marketing |
| YouTube (Google LLC, US) | Embedded learning videos: required cookies are Necessary; tracking and ad-personalisation cookies are Marketing | NecessaryMarketing |
| Reddit (Reddit, US) | Marketing measurement and advertising on Reddit | Marketing |
| Google reCAPTCHA (Google LLC, US) | Bot/abuse protection on forms | Necessary |
| Stripe (Stripe, US) | Fraud prevention on payment forms | Necessary |
| Cloudflare (Cloudflare, US) | Bot management and DDoS protection | Necessary |
| Calendly (Calendly, US) | Powers the meeting booking widget on the marketing site | Necessary |
| Segment (Twilio, US) | Anonymous-visitor and user-event identifiers used to route events | NecessaryStatistical |
| Impact / Tapfiliate (Impact.com, US; Tapfiliate, NL) | Affiliate-referral attribution | Necessary |
| LinkedIn (LinkedIn Ireland) | Remembers your language preference on LinkedIn embeds | Functional |
| Brevo (Sendinblue, EU) | Email engagement tracking — only set if you click a link in a Class2Class marketing email | Marketing |
Each sub-processor's data location, transfer mechanism (Standard Contractual Clauses + Transfer Impact Assessment for US providers), and contractual data-protection commitments are listed in our public Sub-processor List.
Note (v1.3): PostHog, CookieYes, Stape, and Nelio A/B Testing are operationally active and listed in this Cookie Policy; the public Sub-processor List and the DPA are being updated to include them. Hotjar and Microsoft Clarity were removed from the platform and the marketing site on 3 June 2026 and no longer set cookies. Until the Sub-processor List update publishes, this Cookie Policy is the more current of the two documents on these vendors.
The full per-cookie list — name, provider, lifespan, purpose — is available in the CookieYes preference centre via the "Cookie preferences" link at the bottom of every page, and is updated monthly.
How long cookies are kept
| Type | Default lifespan |
|---|---|
| Session cookies | Deleted when you close your browser |
| Persistent Functional cookies | Up to 12 months from last visit |
| Persistent Statistical cookies | Up to 14 months (Google Analytics default; configurable) |
| Persistent Marketing cookies | Up to 13 months (Meta default) |
The exact lifespan of each cookie is in the auto-updated CookieYes preference centre, which you can open via the "Cookie preferences" link at the bottom of every page.
When a persistent cookie has not been "refreshed" by a return visit within its lifespan, it is automatically deleted.
Withdrawal — beyond cookies
Withdrawing consent for cookies does not, by itself, withdraw consent for other personal-data processing. If you also want to:
- Stop receiving marketing emails — use the unsubscribe link in any marketing email, or write to [email protected]
- Withdraw consent for your account-level data — see Privacy Policy §11 and the Parental DSAR Request Process
- Lodge a complaint — Datatilsynet (Danish Data Protection Authority), [email protected], or your own national supervisory authority
Changes to this policy
This policy is updated monthly by CookieYes for changes to the cookie inventory itself (new cookie added, old cookie removed, lifespan change). For substantive policy changes (a new sub-processor category, a change to the consent framework, a regulatory development requiring rewording), the DPO updates this document, increments the version number, and announces material changes via the platform per Privacy Policy §13.
v1.3 changelog (3 June 2026)
Reflects the post-migration analytics stack confirmed in the CookieYes scan of 1 June 2026. Added PostHog (PostHog Inc., EU Cloud / Frankfurt) as the platform's product-usage analytics tool — EU-hosted, consent-gated, with session replay and exception capture switched off — replacing Mixpanel, which no longer sets cookies on the platform (historical Mixpanel data is retained in the data warehouse only and is covered by the Privacy Policy retention schedule). Removed Hotjar and Microsoft Clarity: neither tool is deployed on the platform or the marketing site, and both were removed from the CookieYes inventory on 3 June 2026 — confirm with a fresh scan that they do not repopulate. Confirmed CookieYes (consent management, Necessary) and Stape (first-party server-side tagging proxy, Statistical) as active sub-processors. The §5 note and the FAQ now track PostHog, CookieYes, Stape, and Nelio A/B Testing as listed-in-Cookie-Policy-but-pending-DPA-update. Removed the embedded per-cookie inventory widget from this page; the live per-cookie list is now reached through the "Cookie preferences" link (CookieYes preference centre), and the references throughout were updated accordingly.
v1.2 changelog (29–30 April 2026)
Renamed CMP from "Cookie Information" to CookieYes throughout (correcting a v1.1 factual error — CookieYes has been the live CMP since the migration). Expanded §5 sub-processor table from 5 entries to 19 to reflect cookies actually discovered by the CookieYes scan on 23 April 2026. Per DPO direction, YouTube cookies that are required to play embedded learning videos are categorised as Necessary; YouTube tracking/measurement cookies remain Marketing. Aligned the live CookieYes category names with the policy's four categories (Analytics → Statistical; Advertisement → Marketing; the Performance category was hidden after its single cookie was reclassified as Statistical). On 30 April 2026 the DPO removed two first-party UTM cookies (utm_source, c2c_utm) from the CookieYes inventory; backend confirmation that the underlying inline JS no longer writes them is tracked separately.
Contact
| If you want to | Use this contact |
|---|---|
| Change your cookie preferences | The "Cookie preferences" link at the bottom of any page |
| Ask a question about cookies | [email protected] |
| Lodge a complaint about our cookie practices | Datatilsynet — [email protected], or your own national supervisory authority |
| Find the up-to-date list of every cookie | The "Cookie preferences" link at the bottom of any page (opens the CookieYes preference centre, auto-updated monthly) |
Quick answers about cookies on Class2Class.
Do you use cookie walls?
No. You can use the public marketing site, the help centre, and the contact page without consenting to a single non-essential cookie. Logged-in features of the platform require Necessary cookies (sign-in, session, security) — those aren't consent-based; they're strictly necessary under ePrivacy Art. 5(3). See §3.2.
How do I change my cookie preferences?
Click the "Cookie preferences" link at the bottom of any page. The banner will reopen and you can toggle Functional, Statistical, and Marketing independently. You can also clear cookies or block specific categories through your browser settings — we'll respect whatever your browser tells us.
Withdrawing consent is as easy as giving it. Section 3.4 has the detail.
Do you set marketing cookies on student accounts?
No. Marketing cookies are not set on accounts identified as student accounts under 18, regardless of consent state. Marketing cookies on the class2class.org marketing site are set only with the visitor's explicit consent — we do not target minors with marketing. See §4.
What is Google Consent Mode v2?
It's the framework Google uses to receive your consent state from our cookie banner. When you decline Statistical cookies, Google Analytics receives a "denied" signal and operates in a privacy-preserving mode — no individual tracking. When you decline Marketing cookies, Google's advertising products receive "denied" for ad personalisation. The signal updates as soon as you change your preferences. See §3.3.
Why are some sub-processors not yet listed in the main DPA?
PostHog, CookieYes, Stape, and Nelio A/B Testing are operationally active and listed in this Cookie Policy, but the main Sub-processor List is being updated to reflect them. Until then, this Cookie Policy is the more current of the two documents on those vendors. The DPO is tracking the update. (Hotjar and Microsoft Clarity were removed on 3 June 2026 and no longer appear in either document.)
How long does a cookie typically last?
Session cookies are deleted when you close your browser. Persistent cookies last anywhere from a few minutes to about 14 months depending on the cookie — typical defaults are 12 months for Functional, 14 months for Statistical (Google Analytics), and 13 months for Marketing (Meta). The exact lifespan of every cookie is in the auto-updated CookieYes preference centre, which you can open via the "Cookie preferences" link at the bottom of every page.
What if I want to opt out of Google Analytics on every site?
Google offers a browser-add-on opt-out at tools.google.com/dlpage/gaoptout. It blocks Google Analytics across all sites, not just Class2Class.
If I withdraw cookie consent, am I also unsubscribed from emails?
No — they're separate. Cookie consent governs what runs in your browser. To stop marketing emails, use the unsubscribe link in any marketing email, or write to [email protected]. To withdraw consent for your account-level data, see Privacy Policy §11. Section 7 has the cross-reference.
Have a cookie question?
If something on this page is unclear, if you found a cookie that isn't in our inventory, or if you want to escalate a cookie concern — write to our DPO directly. You can also lodge a complaint with Datatilsynet (the Danish Data Protection Authority) or your own national supervisory authority.
- Cookie or privacy questionGiancarlo Mena (DPO) — [email protected]
- Change cookie preferences"Cookie preferences" link at the bottom of any page
- General concern[email protected]
- Concern about the CEOIndependent Reviewer — [email protected]
- Lodge a complaintDatatilsynet — [email protected]
Looking to change your preferences right now?
Click below to reopen the cookie banner. You can toggle Functional, Statistical, and Marketing independently — or accept or reject all in one click.
Open cookie preferences