# Cookie Policy

> A cookie is a small file a website saves on your device. We use cookies to keep the platform working, to understand how it's used, and (with your permission) to show you Class2Class adverts on other sites. You're in control of all but the strictly necessary ones — and we never use cookie walls.

Canonical: https://class2class.org/cookie-policy/

Content contract: 2.0

Revision: d5c004b5-6e7f-53b7-8ba9-d56b1362d338

Payload checksum (SHA-256): 5cff1a874e945caa08885a18bb6f8c39442edd67aac65b857c09b5facf700a35

Locale: en

A cookie is a small file a website saves on your device. We use cookies to keep the platform working, to understand how it's used, and (with your permission) to show you Class2Class adverts on other sites. You're in control of all but the strictly necessary ones — and we never use cookie walls.

[See the cookie list & change preferences](/cookie-policy/)

## What we use, what you control.

"We do not use cookie walls — you can use the platform's essential features without consenting to non-essential cookies."

### No cookie walls

You can browse the marketing site, the help centre, and the contact page without consenting to a single non-essential cookie.

### Granular consent

Four categories you can toggle independently. Accept Statistical without Marketing, Functional without either — your call.

### Children protected

No marketing cookies on student accounts under 18, regardless of consent state. IP anonymisation on Statistical for minors.

### Easy withdrawal

Change your preferences anytime via the link at the bottom of every page. Withdrawing is as easy as giving consent.

## What each category does, and what you control.

Class2Class organises every cookie into one of four categories, following the ePrivacy Directive's framework.

### Necessary

Lets the platform function — sign-in, session management, security, load balancing. Without these, you can't actually use Class2Class.

### Functional

Remembers preferences — language, time zone, interface settings. Helpful but not essential to platform operation.

### Statistical

Helps us understand how the platform is used in aggregate — which features are used, how long sessions last. Anonymised where possible.

### Marketing

Shows you Class2Class ads on other sites and measures whether those ads work. Never set on student accounts under 18, regardless of consent state.

[01 Why this policy exists](/cookie-policy/#section-1)

[02 The four categories](/cookie-policy/#section-2)

[03 Consent & the banner](/cookie-policy/#section-3)

[04 Children & teenagers](/cookie-policy/#section-4)

[05 Third-party cookies](/cookie-policy/#section-5)

[06 How long we keep them](/cookie-policy/#section-6)

[07 Withdrawal — beyond cookies](/cookie-policy/#section-7)

[08 Changes to this policy](/cookie-policy/#section-8)

[09 Contact](/cookie-policy/#section-9)

## Class2Class Cookie Policy.

Version 1.3 · Last updated 3 June 2026.

[dpo@class2class.org](mailto:dpo@class2class.org)

### Plain-language summary

A cookie is a small file a website saves on your device. We use cookies to keep the platform working, to understand how it's used, and (with your permission) to show you Class2Class adverts on other sites. You can change your cookie preferences at any time. We do not use cookie walls — you can use the platform's essential features without consenting to non-essential cookies.

## Why this policy exists

This Cookie Policy explains the cookies and similar technologies (collectively, "cookies") used by class2class.org and the Class2Class platform. It complements:

- The [Privacy & Accessibility statement (Privacy Policy v.2.0)](/privacy-and-accessibility/) — describes how we process personal data more generally
- The [Terms & Conditions v.2.0](/terms-and-conditions/)
- The [Sub-processor List](/data-processing-agreement/)

It is published in line with:

- ePrivacy Directive Article 5(3) — consent for cookies that are not strictly necessary
- GDPR Articles 6, 7, 8 — lawful basis, conditions for consent, child's consent
- EDPB Guidelines 05/2020 on consent — granular consent, no cookie walls, clear withdrawal
- Google Consent Mode v2 requirements for analytics and advertising in the EU

## The four cookie categories

Class2Class organises cookies into four categories, following the ePrivacy Directive's framework and the CookieYes consent management platform:

| Category | What it does | Consent required? | You can turn off? |
| --- | --- | --- | --- |
| Necessary | Lets the platform function — sign-in, session management, security, load balancing | No (legitimate interest under ePrivacy Art. 5(3)) | No |
| Functional | Remembers preferences — language, time zone, interface settings | Yes | Yes |
| Statistical | Helps us understand platform use in aggregate; anonymised where possible | Yes | Yes |
| Marketing | Shows you Class2Class ads on other sites; measures whether those ads work | Yes | Yes |

The current list of cookies in each category — with each cookie's name, provider, lifespan, and purpose — is available in the CookieYes preference centre, which you can open at any time via the "Cookie preferences" link at the bottom of every page. CookieYes keeps that list current automatically; this document explains the framework around it.

## Consent

### 3.1 The consent banner

When you first visit class2class.org , a consent banner appears. You can:

- Accept all — consent to all four categories
- Reject all — consent only to Necessary cookies (which are not consent-based but are listed for transparency)
- Customise — toggle Functional, Statistical, and Marketing independently (this is the granular consent EDPB Guidelines 05/2020 requires)

You can change your choice at any time — see §3.4.

### 3.2 No cookie walls

We do not use cookie walls. You can use the essential features of class2class.org (the public marketing site, the help centre, the contact page) without consenting to non-essential cookies. Logged-in features of the Class2Class platform require Necessary cookies (sign-in, session management, security) — those are not consent-based; they are strictly necessary under ePrivacy Art. 5(3).

This commitment aligns with EDPB Guidelines 05/2020 on consent (sections on freely given consent and on cookie walls).

### 3.3 Consent Mode v2 (Google products)

For Google Analytics and any future Google advertising products, we operate Google Consent Mode v2 . This means:

- When you have not consented to Statistical or Marketing cookies, Google products receive a "denied" signal and operate in a privacy-preserving mode (no individual tracking; no advertising personalisation)
- When you have consented, Google products receive a "granted" signal and operate normally
- The signal is updated as soon as you change your preferences

Consent Mode v2 specifically signals two consent dimensions: analytics\_storage (Statistical) and ad\_storage / ad\_user\_data / ad\_personalization (Marketing). Each is bound to its corresponding category in our consent banner.

### 3.4 Changing your preferences

You can change your cookie preferences at any time:

- Cookie preferences link — at the bottom of every page on class2class.org . Clicking it reopens the banner and lets you change any category.
- Browser controls — you can also delete cookies or block specific categories through your browser settings; we cannot override your browser's choice
- Google Analytics opt-out — Google offers a browser-add-on opt-out at [tools.google.com/dlpage/gaoptout](https://tools.google.com/dlpage/gaoptout) for users who want to opt out of Google Analytics across all sites

Withdrawing consent is as easy as giving it. Withdrawing does not affect the lawfulness of processing already done with consent before the withdrawal — but it stops the processing going forward.

## Children and teenagers (ages 13–17)

Class2Class is used by minors aged 13 and above (and, with parental consent, under 13 — see [Privacy Policy §7](/privacy-and-accessibility/#section-7) ). Our cookie practices reflect this:

- Necessary cookies are used for all users — they are strictly required for the platform to work
- Functional cookies are used where the user (or, for under-13 students, the teacher in the consent flow) has chosen to remember preferences
- Statistical cookies are configured to anonymise IP addresses (Google Analytics IP anonymisation is on); we minimise the data we collect on minors and we never use it to build a profile of any individual minor
- Marketing cookies are not set on accounts identified as student accounts under 18, regardless of consent state. Marketing cookies on the class2class.org marketing site are set only with the visitor's explicit consent — we do not target minors with marketing
- Granular consent — the four categories are independently toggleable, so a minor (or their teacher) can consent to Statistical without Marketing, or to Functional without either

For students under 13, parental consent under GDPR Article 8 governs all non-essential cookies; the teacher confirms in the consent flow on the parent's behalf, per [Privacy Policy §7.4](/privacy-and-accessibility/#section-7) .

## Third-party cookies — sub-processors

Some of the cookies we use are set by sub-processors who provide specific services on our behalf. The current sub-processor cookie sources, with their cookie purposes:

| Sub-processor | Purpose | Category |
| --- | --- | --- |
| CookieYes (Synconize Solutions, India) | Stores your consent preferences | Necessary |
| Google Analytics (Google LLC, US) | Anonymised website analytics | Statistical |
| PostHog (PostHog Inc. — EU Cloud, Frankfurt) | Product-usage analytics inside the platform — EU-hosted, consent-gated, with session replay and exception capture switched off | Statistical |
| Nelio A/B Testing (Nelio Software, Spain) | A/B testing on the marketing site | Statistical |
| Chatbase (Chatbase, US) | Anonymous session identifier for the AI help chatbot | Statistical |
| Stape (Stape, Estonia) | First-party server-side analytics tagging proxy | Statistical |
| Meta Pixel (Meta, US) | Marketing measurement and advertising on Meta properties | Marketing |
| YouTube (Google LLC, US) | Embedded learning videos: required cookies are Necessary; tracking and ad-personalisation cookies are Marketing | Necessary Marketing |
| Reddit (Reddit, US) | Marketing measurement and advertising on Reddit | Marketing |
| Google reCAPTCHA (Google LLC, US) | Bot/abuse protection on forms | Necessary |
| Stripe (Stripe, US) | Fraud prevention on payment forms | Necessary |
| Cloudflare (Cloudflare, US) | Bot management and DDoS protection | Necessary |
| Calendly (Calendly, US) | Powers the meeting booking widget on the marketing site | Necessary |
| Segment (Twilio, US) | Anonymous-visitor and user-event identifiers used to route events | Necessary Statistical |
| Impact / Tapfiliate (Impact.com, US; Tapfiliate, NL) | Affiliate-referral attribution | Necessary |
| LinkedIn (LinkedIn Ireland) | Remembers your language preference on LinkedIn embeds | Functional |
| Brevo (Sendinblue, EU) | Email engagement tracking — only set if you click a link in a Class2Class marketing email | Marketing |

Each sub-processor's data location, transfer mechanism (Standard Contractual Clauses + Transfer Impact Assessment for US providers), and contractual data-protection commitments are listed in our public [Sub-processor List](/data-processing-agreement/) .

Note (v1.3): PostHog, CookieYes, Stape, and Nelio A/B Testing are operationally active and listed in this Cookie Policy; the public [Sub-processor List](/data-processing-agreement/) and the DPA are being updated to include them. Hotjar and Microsoft Clarity were removed from the platform and the marketing site on 3 June 2026 and no longer set cookies. Until the Sub-processor List update publishes, this Cookie Policy is the more current of the two documents on these vendors.

The full per-cookie list — name, provider, lifespan, purpose — is available in the CookieYes preference centre via the "Cookie preferences" link at the bottom of every page, and is updated monthly.

## How long cookies are kept

| Type | Default lifespan |
| --- | --- |
| Session cookies | Deleted when you close your browser |
| Persistent Functional cookies | Up to 12 months from last visit |
| Persistent Statistical cookies | Up to 14 months (Google Analytics default; configurable) |
| Persistent Marketing cookies | Up to 13 months (Meta default) |

The exact lifespan of each cookie is in the auto-updated CookieYes preference centre, which you can open via the "Cookie preferences" link at the bottom of every page.

When a persistent cookie has not been "refreshed" by a return visit within its lifespan, it is automatically deleted.

## Withdrawal — beyond cookies

Withdrawing consent for cookies does not, by itself, withdraw consent for other personal-data processing. If you also want to:

- Stop receiving marketing emails — use the unsubscribe link in any marketing email, or write to [dpo@class2class.org](mailto:dpo@class2class.org)
- Withdraw consent for your account-level data — see [Privacy Policy §11](/privacy-and-accessibility/#section-11) and the Parental DSAR Request Process
- Lodge a complaint — Datatilsynet (Danish Data Protection Authority), [dt@datatilsynet.dk](mailto:dt@datatilsynet.dk) , or your own national supervisory authority

## Changes to this policy

This policy is updated monthly by CookieYes for changes to the cookie inventory itself (new cookie added, old cookie removed, lifespan change). For substantive policy changes (a new sub-processor category, a change to the consent framework, a regulatory development requiring rewording), the DPO updates this document, increments the version number, and announces material changes via the platform per [Privacy Policy §13](/privacy-and-accessibility/#section-13) .

### v1.3 changelog (3 June 2026)

Reflects the post-migration analytics stack confirmed in the CookieYes scan of 1 June 2026. Added PostHog (PostHog Inc., EU Cloud / Frankfurt) as the platform's product-usage analytics tool — EU-hosted, consent-gated, with session replay and exception capture switched off — replacing Mixpanel, which no longer sets cookies on the platform (historical Mixpanel data is retained in the data warehouse only and is covered by the Privacy Policy retention schedule). Removed Hotjar and Microsoft Clarity : neither tool is deployed on the platform or the marketing site, and both were removed from the CookieYes inventory on 3 June 2026 — confirm with a fresh scan that they do not repopulate. Confirmed CookieYes (consent management, Necessary) and Stape (first-party server-side tagging proxy, Statistical) as active sub-processors. The §5 note and the FAQ now track PostHog, CookieYes, Stape, and Nelio A/B Testing as listed-in-Cookie-Policy-but-pending-DPA-update. Removed the embedded per-cookie inventory widget from this page; the live per-cookie list is now reached through the "Cookie preferences" link (CookieYes preference centre), and the references throughout were updated accordingly.

### v1.2 changelog (29–30 April 2026)

Renamed CMP from "Cookie Information" to CookieYes throughout (correcting a v1.1 factual error — CookieYes has been the live CMP since the migration). Expanded §5 sub-processor table from 5 entries to 19 to reflect cookies actually discovered by the CookieYes scan on 23 April 2026. Per DPO direction, YouTube cookies that are required to play embedded learning videos are categorised as Necessary; YouTube tracking/measurement cookies remain Marketing. Aligned the live CookieYes category names with the policy's four categories (Analytics → Statistical; Advertisement → Marketing; the Performance category was hidden after its single cookie was reclassified as Statistical). On 30 April 2026 the DPO removed two first-party UTM cookies ( utm\_source , c2c\_utm ) from the CookieYes inventory; backend confirmation that the underlying inline JS no longer writes them is tracked separately.

## Contact

| If you want to | Use this contact |
| --- | --- |
| Change your cookie preferences | The "Cookie preferences" link at the bottom of any page |
| Ask a question about cookies | dpo@class2class.org |
| Lodge a complaint about our cookie practices | Datatilsynet — dt@datatilsynet.dk , or your own national supervisory authority |
| Find the up-to-date list of every cookie | The "Cookie preferences" link at the bottom of any page (opens the CookieYes preference centre, auto-updated monthly) |

## Quick answers about cookies on Class2Class.

No. You can use the public marketing site, the help centre, and the contact page without consenting to a single non-essential cookie. Logged-in features of the platform require Necessary cookies (sign-in, session, security) — those aren't consent-based; they're strictly necessary under ePrivacy Art. 5(3). See §3.2.

Click the "Cookie preferences" link at the bottom of any page. The banner will reopen and you can toggle Functional, Statistical, and Marketing independently. You can also clear cookies or block specific categories through your browser settings — we'll respect whatever your browser tells us.

Withdrawing consent is as easy as giving it. Section 3.4 has the detail.

No. Marketing cookies are not set on accounts identified as student accounts under 18, regardless of consent state. Marketing cookies on the class2class.org marketing site are set only with the visitor's explicit consent — we do not target minors with marketing. See §4.

It's the framework Google uses to receive your consent state from our cookie banner. When you decline Statistical cookies, Google Analytics receives a "denied" signal and operates in a privacy-preserving mode — no individual tracking. When you decline Marketing cookies, Google's advertising products receive "denied" for ad personalisation. The signal updates as soon as you change your preferences. See §3.3.

PostHog, CookieYes, Stape, and Nelio A/B Testing are operationally active and listed in this Cookie Policy, but the main [Sub-processor List](/data-processing-agreement/) is being updated to reflect them. Until then, this Cookie Policy is the more current of the two documents on those vendors. The DPO is tracking the update. (Hotjar and Microsoft Clarity were removed on 3 June 2026 and no longer appear in either document.)

Session cookies are deleted when you close your browser. Persistent cookies last anywhere from a few minutes to about 14 months depending on the cookie — typical defaults are 12 months for Functional, 14 months for Statistical (Google Analytics), and 13 months for Marketing (Meta). The exact lifespan of every cookie is in the auto-updated CookieYes preference centre, which you can open via the "Cookie preferences" link at the bottom of every page.

Google offers a browser-add-on opt-out at [tools.google.com/dlpage/gaoptout](https://tools.google.com/dlpage/gaoptout) . It blocks Google Analytics across all sites, not just Class2Class.

No — they're separate. Cookie consent governs what runs in your browser. To stop marketing emails, use the unsubscribe link in any marketing email, or write to [dpo@class2class.org](mailto:dpo@class2class.org) . To withdraw consent for your account-level data, see [Privacy Policy §11](/privacy-and-accessibility/#section-11) . Section 7 has the cross-reference.

## Have a cookie question?

If something on this page is unclear, if you found a cookie that isn't in our inventory, or if you want to escalate a cookie concern — write to our DPO directly. You can also lodge a complaint with Datatilsynet (the Danish Data Protection Authority) or your own national supervisory authority.

[Email the DPO](mailto:dpo@class2class.org)

[Anonymous report](https://docs.google.com/forms/d/e/1FAIpQLSeAF3v2teesglPN51qsKEJLk71PvhGf6ozOC4Bt3PqN-w2tKg/viewform)

- Cookie or privacy question Giancarlo Mena (DPO) — dpo@class2class.org
- Change cookie preferences "Cookie preferences" link at the bottom of any page
- General concern support@class2class.org
- Concern about the CEO Independent Reviewer — class2class.org@gmail.com
- Lodge a complaint Datatilsynet — dt@datatilsynet.dk

## Looking to change your preferences right now?

Click below to reopen the cookie banner. You can toggle Functional, Statistical, and Marketing independently — or accept or reject all in one click.

[Open cookie preferences](/cookie-policy/)