Cookie Policy

1. About this Cookie Policy

This Cookie Policy explains how DrugCards OÜ (“DrugCards”, “we”, “us” or “our”)
uses cookies and other similar tracking technologies on the website
drug-card.io
(the “Website”), what those technologies do, why we use them, how long they remain
on your device, and the choices that are available to you.

This Cookie Policy forms part of, and should be read together with, our
Privacy Policy,
which describes in more detail how we process personal data, the legal bases we rely
on, the recipients of the data and the rights available to you as a data subject.

This Cookie Policy is written in plain language. The current version can be downloaded
from the Website as a PDF file, so that you can save or print a copy for your own records.

By “cookies” in this Policy we mean cookies and equivalent technologies — pixels and
web beacons, software development kits, tags, and information stored in or read from
your browser’s local and session storage. All of these are subject to the same consent rules.

2. Who we are

The controller responsible for the processing of personal data collected through cookies
on the Website is:

Where third-party providers listed in this Policy set cookies through the Website,
those providers act as independent controllers or as joint controllers in respect of
the data they collect. Their own privacy notices, linked in Section 8, govern their processing.

3. What cookies are and how they work

A cookie is a small text file that a website places on your device (computer, tablet
or mobile phone) when you visit it. Cookies allow the website to recognise your device,
to remember your preferences and, in some cases, to build a picture of how you use the site.

3.1 First-party and third-party cookies

• First-party cookies are set by drug-card.io itself.
  They are used for functions such as remembering your consent choices and displaying
  pages correctly.
• Third-party cookies are set by service providers whose technology
  we have integrated into the Website — for example analytics, chat, video-embedding,
  security and advertising providers. These providers may recognise your device on
  other websites that use the same technology.

3.2 Session and persistent cookies

• Session cookies exist only while your browser is open and are
  deleted automatically when you close it.
• Persistent cookies remain on your device for a defined period,
  or until you delete them. The retention period for each cookie is listed in Section 7.

3.3 Similar technologies

In addition to cookies, the Website may use pixels and web beacons (small transparent
images that record whether a page or e-mail has been opened) and browser local storage
(which stores information in the browser rather than in a cookie file). Where these
technologies are not strictly necessary, they are subject to the same consent requirement
as cookies and are only activated after you have given your consent.

4. Legal basis for using cookies

Our use of cookies is governed by Article 5(3) of Directive 2002/58/EC
(the ePrivacy Directive), as implemented in Estonia by the Electronic Communications Act,
and by Regulation (EU) 2016/679 (GDPR).

No cookie other than a strictly necessary cookie is placed on your device before you
have given your consent. Withdrawing your consent does not affect the lawfulness of any
processing carried out before the withdrawal.

5. How we ask for and record your consent

We use the CookieYes consent management platform to obtain, record and manage your cookie
consent. When you visit the Website for the first time, a consent banner is displayed and
the following principles apply:

• Non-essential cookies remain blocked until you have made a choice.
  Continuing to browse, scrolling or closing the banner is not treated as consent.
• Consent is granular. You may accept or refuse each category of
  cookies separately.
• Refusing is as easy as accepting. The banner offers a “Reject all”
  control alongside “Accept all”, presented with equal prominence.
• No box is pre-ticked. Every optional category is switched off by default.
• Your choice is recorded. We keep a record of when consent was given,
  which categories were accepted or refused and which version of the banner text was shown,
  so that we can demonstrate consent as required by Article 7(1) GDPR.
• Consent is time-limited. We ask you to confirm your preferences again
  at least every twelve months, and sooner if we introduce new cookies or new purposes.
• You can change your mind at any time. See Section 10.

6. Categories of cookies we use

7. Cookies used on the Website

The tables below list the cookies used on drug-card.io at the date of the last review
of this Policy. The stated durations are the maximum lifetime of each cookie; they may
be shorter if you delete cookies from your browser. Because third-party providers
occasionally change the names and lifetimes of their cookies, the live and always current
list is available in the cookie settings panel accessible from the footer of the Website.

7.1 Strictly necessary cookies

7.2 Functional cookies

7.3 Performance cookies

7.4 Analytics cookies

7.5 Advertising cookies

8. Third-party providers and international transfers

Some of the providers listed below are established outside the European Economic Area,
or may process data on infrastructure located outside the EEA. Where that is the case,
the transfer takes place on the basis of an adequacy decision of the European Commission —
including the EU–US Data Privacy Framework for certified US organisations (GDPR Art. 45) —
or on the basis of the European Commission’s Standard Contractual Clauses together with
supplementary technical and organisational measures (GDPR Art. 46). We have a data
processing agreement in place with each provider that acts on our behalf.

You can find further information about how each provider processes personal data
in their own privacy notices, which are linked from the cookie settings panel on the Website.

9. What data cookies collect and how long we keep it

Cookies used on the Website may collect the following categories of data: online identifiers
assigned to your browser or device; IP address (truncated or otherwise anonymised where the
provider offers that option); browser and device type; operating system; referring website;
pages viewed and time spent on them; interactions such as clicks and scrolling; and approximate
geographic location at city level derived from the IP address.

We do not use cookies to collect health data, and cookies are not used to identify you by name.
Where a cookie identifier is later linked to information you provide voluntarily — for example
when you submit a contact form — that processing is described in our
Privacy Policy.

The retention period for each individual cookie is given in Section 7.
In addition, the following general periods apply:

• Session cookies — deleted when you close your browser.
• Analytics data held by the provider — up to 26 months in aggregated
  or pseudonymised form, unless a shorter period is configured.
• Advertising cookies — up to 3 months, unless the provider applies
  a shorter period.
• Consent records — retained for the duration of the consent and for
  a further period necessary to demonstrate compliance, and in any event not longer
  than required by the applicable limitation periods.

10. How to manage, change or withdraw your consent

10.1 Through the Website

You can review and change your choices at any time by opening the

“Cookie settings”

link in the footer of every page of the Website. The change takes effect immediately
for all cookies that we control, and no further optional cookie will be set once consent
has been withdrawn.

10.2 Through your browser

Most browsers allow you to block or delete cookies, to be notified before a cookie is placed,
and to remove cookies that have already been stored. Instructions are available in the help
pages of each browser:

• Google Chrome:
  
  support.google.com/chrome/answer/95647
  
• Mozilla Firefox:
  
  support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
  
• Apple Safari:
  
  support.apple.com/guide/safari/manage-cookies-sfri11471
  
• Microsoft Edge:
  
  support.microsoft.com/microsoft-edge
  

Please note that blocking strictly necessary cookies may prevent parts of the Website
from working correctly.

10.3 Provider opt-outs

Several providers offer their own opt-out mechanisms, which apply in addition to the
controls described above:

• Google Analytics browser opt-out add-on:
  
  tools.google.com/dlpage/gaoptout
  
• Google advertising settings:
  
  myadcenter.google.com
  
• Meta advertising preferences:
  
  facebook.com/adpreferences
  
• LinkedIn advertising settings:
  
  linkedin.com/psettings/advertising
  
• Microsoft Clarity opt-out:
  
  privacy.microsoft.com
  

11. Do Not Track and Global Privacy Control

Our consent banner is the primary mechanism through which you express your choices.
Where your browser transmits a Global Privacy Control signal, we treat that signal as
an objection to the setting of advertising cookies. There is at present no uniform
industry standard for responding to the older “Do Not Track” browser header, and we
therefore do not rely on it; please use the cookie settings panel instead.

12. Your rights

In relation to personal data collected through cookies you have the right to:

• withdraw your consent at any time, without giving a reason (GDPR Art. 7(3));
• request access to the personal data we hold about you (Art. 15);
• request the correction of inaccurate data (Art. 16);
• request the erasure of your data (Art. 17);
• request the restriction of processing (Art. 18);
• receive the data you provided in a structured, commonly used and
  machine-readable format (Art. 20);
• object to processing based on our legitimate interests, including profiling (Art. 21).

To exercise any of these rights, please write to
office@drug-card.io.
We will respond within one month of receiving your request. If your request is complex,
we may extend that period by a further two months and will tell you if we do so.

You also have the right to lodge a complaint with a supervisory authority.
Our lead authority is the Estonian Data Protection Inspectorate
(Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia —

www.aki.ee
.
You may alternatively complain to the supervisory authority of the EU Member State
in which you live or work.

13. Changes to this Cookie Policy

We review this Cookie Policy at least once every twelve months, and additionally whenever
we add, remove or change a tracking technology used on the Website. Where a change affects
the purposes for which cookies are used, or introduces a new category of cookies, we will
ask for your consent again through the consent banner.

The date on which the current version took effect is shown at the top of this page.
Previous versions are archived and can be requested at
office@drug-card.io.

14. Contact us

If you have any question about this Cookie Policy, about the cookies used on the Website,
or about how we handle your personal data, please contact us: