Cookie policy

This Cookie Policy explains how PLASTOPEX uses cookies and similar technologies on its website.

It should be read together with the Privacy Policy.

1. Website operator

The website is operated by:

Društvo za proizvodnju trgovinu i usluge PLASTOPEX DOO OSEČINA
Short business name: PLASTOPEX DOO
Pere Jovanovića - Komirićanca 50
14253 Osečina, Republic of Serbia
Company registration number: 21431893
Tax identification number: 111142066
Email: info@plastopex.com
Telephone: +381 69 723 200

2. What cookies are

Cookies are small text files that a website or service provider may store on your device.

The website may also use:

• browser local storage;
• session storage;
• pixels and tags;
• analytics scripts;
• session identifiers;
• server-side consent records;
• third-party embedded content.

In this Policy, “cookies” also covers similar technologies where they serve the same or a related purpose.

3. How consent works

On your first visit, you should be able to:

• accept all cookies;
• reject all non-essential cookies;
• open settings and choose individual categories.

Non-essential technologies should not operate before consent: they set and read no cookies, create no identifiers and collect no personal data until you consent.

The exception is Google Analytics 4, which loads in consent mode (Google Consent Mode) with storage denied by default. In that state it sets no cookies and collects no personal data, but a basic cookieless signal is sent to Google. Measurement begins only after your analytics consent. If you expressly refuse analytics, that signal is switched off too. See the Google Analytics 4 section for detail.

Optional categories are not pre-selected.

Strictly necessary technologies may operate without consent where genuinely required for:

• transmission of communications;
• security;
• storage of privacy choices;
• form submission;
• a function you expressly requested.

Accepting the Terms of Use or Privacy Policy is not consent to analytics or marketing cookies.

4. Cookie categories

4.1. Strictly necessary

These technologies support:

• basic website operation;
• security;
• form protection;
• bot and abuse prevention;
• storage of cookie choices;
• language selection;
• session management;
• product configurators;
• the current Plastiša session;
• a feature expressly requested by the user.

They are not used for advertising.

4.2. Functional

Functional technologies support enhanced features such as:

• remembering user preferences;
• continuing a product configuration;
• loading Google Maps;
• playing YouTube content;
• displaying Instagram or other social content;
• other third-party functions that are not required for basic website operation.

A non-essential third-party function is activated after consent or after you expressly choose to load it.

4.3. Analytics

Analytics technologies help us understand:

• visitor numbers;
• commonly visited pages;
• navigation paths;
• technical errors;
• website performance;
• content and campaign effectiveness.

They operate only after consent.

4.4. Marketing

Marketing technologies may be used for:

• advertising measurement;
• campaign attribution;
• aggregated audience creation;
• frequency control;
• delivery of more relevant advertising on other platforms.

They operate only after marketing consent.

Marketing and cross-site tracking cookies must not be enabled by default.

Where a new marketing service is introduced, it should be displayed in the cookie settings panel and remain blocked until consent is provided.

5. PLASTOPEX and Payload CMS technologies

The website may use the following first-party technologies.

5.1. Cookie preference record

Purpose:

• stores accepted and rejected categories;
• prevents the banner from appearing continuously;
• records the user’s choice.

Typical duration:

• up to 12 months.

Category:

• strictly necessary.

5.2. Language preference

Purpose:

• stores the Serbian or English language choice.

Typical duration:

• session or up to 12 months.

Category:

• necessary or functional.

5.3. Session and security identifiers

Purpose:

• secure form submission;
• prevention of forged requests;
• abuse limitation;
• maintenance of a technical session.

Typical duration:

• session or a short period afterwards.

Category:

• strictly necessary.

5.4. Configurator session

Purpose:

• temporarily stores selections and configurator progress.

Typical duration:

• session or up to 30 days.

Category:

• necessary or functional.

5.5. Plastiša session identifier

Purpose:

• connects messages within one conversation;
• maintains context for the current session.

Typical duration:

• session or a limited period required to continue the conversation.

Category:

• necessary or functional.

Form content, newsletter subscriptions and Plastiša conversations may be stored server-side in Payload CMS. Server-side storage is not itself a cookie and is addressed in the Privacy Policy.

The direct OpenAI API is used server-side to generate Plastiša responses. The OpenAI API does not necessarily place an OpenAI cookie in the user’s browser because the communication may be routed through the PLASTOPEX server. Any browser identifier used to maintain a Plastiša session is a PLASTOPEX function and is described above.

6. Google reCAPTCHA

Google reCAPTCHA is used to protect forms against:

• bots;
• spam;
• automated messages;
• abuse;
• malicious requests.

reCAPTCHA may process:

• IP address;
• browser and device information;
• interaction patterns;
• security signals;
• Google identifiers required for risk assessment.

It may set technical Google identifiers.

Where reCAPTCHA is limited to protecting a form expressly requested by the user, it is treated as a necessary security technology.

Where the implementation creates identifiers that are not necessary for form protection, the additional processing must be controlled through the relevant consent.

7. Google Maps

Google Maps should not load automatically before your action or the relevant consent. A button or placeholder may be displayed first.

When you choose to show the map, your device connects to Google Maps.

Google may then process:

• IP address;
• browser and device information;
• approximate or precise location;
• Google account information where you are signed in;
• interaction with the map.

Opening directions or the map takes you to Google’s platform, where Google’s own terms apply.

8. Google Tag Manager

Google Tag Manager may be used to manage other tags.

It does not by itself define a separate processing purpose, but it may technically deploy:

• Google Analytics;
• Meta Pixel;
• LinkedIn Insight Tag;
• other analytics or marketing scripts.

The consent system must prevent every non-essential tag from setting cookies or collecting personal data before the user’s choice; a tag loaded in consent mode with storage denied is not considered fired in that sense.

Merely displaying a cookie banner without actually blocking tags is not sufficient.

9. Google Analytics 4

Google Analytics is used for aggregate website measurement. The tag loads in consent mode with storage denied by default; actual measurement and cookie setting begin only after your analytics consent. If you expressly refuse analytics, the tag is additionally switched off and sends nothing.

Typical identifiers may include:

• an identifier used to distinguish devices or visitors, normally up to two years;
• an identifier used for a specific analytics configuration, normally up to two years;
• a short-term visit identifier, where used, normally up to 24 hours.

Possible purposes include:

• distinguishing devices or visitors;
• measuring visits;
• analysing page use;
• assessing content performance;
• identifying technical problems.

Where available, the implementation should use:

• limited retention;
• data minimisation;
• appropriate consent settings;
• storage denied before consent, with the tag switched off where analytics is expressly refused.

10. Google Search Console

Google Search Console provides aggregate information about website visibility in Google search results.

Search Console itself does not normally place cookies on visitors to the PLASTOPEX website.

Other Google technologies may use cookies under the conditions described in this Policy.

11. YouTube and other video content

Where YouTube videos are embedded, they may use Google or YouTube identifiers and process:

• IP address;
• device information;
• playback information;
• account information where you are signed in;
• interaction with the content.

Video content should load only after the appropriate functional or marketing consent.

Privacy-enhanced mode and a placeholder should be used where available.

12. Facebook, Instagram, WhatsApp and Meta Pixel

The website may contain ordinary links to Facebook, Instagram and WhatsApp.

The presence of an ordinary link does not necessarily mean that Meta places a cookie on the PLASTOPEX website. When you follow the link, you move to a Meta platform, which processes information under its own terms.

Where an Instagram embed or Meta Pixel is used, it must remain blocked until the relevant consent is provided.

Typical marketing identifiers may last approximately three months, depending on the particular Meta configuration.

Possible purposes include:

• campaign measurement;
• visit attribution;
• aggregated audience creation;
• delivery of more relevant advertising.

13. LinkedIn

The website may contain ordinary links to LinkedIn.

Where LinkedIn Insight Tag is enabled, it must remain blocked until marketing consent is provided.

LinkedIn may use identifiers for:

• storing LinkedIn choices;
• analytics synchronisation;
• campaign matching;
• browser identification;
• aggregated audience creation.

Retention depends on the particular identifier and LinkedIn configuration.

14. Google reviews and external links

The website may display public Google reviews or links to a Google Business profile.

When you choose to view or write a review, you move to Google’s platform.

The same principle applies to links to WhatsApp, Facebook, Instagram, LinkedIn and other external services.

15. Changing your choice

You may change your choice at any time:

• open “Cookie settings”;
• enable or disable the relevant categories;
• save the new choice.

Withdrawing consent should be as easy as giving it.

After withdrawal:

• new non-essential tags will no longer operate;
• cookies under our control will be deleted where technically possible;
• certain third-party cookies may need to be removed through your browser.

16. Browser controls

Most browsers allow you to:

• view stored cookies;
• delete selected or all cookies;
• block third-party cookies;
• block all cookies;
• delete cookies automatically when the browser closes.

Blocking strictly necessary technologies may prevent the correct operation of:

• contact forms;
• product configurators;
• language selection;
• the Plastiša session;
• cookie settings;
• other basic functions.

17. Do Not Track and Global Privacy Control

Certain browsers send Do Not Track or Global Privacy Control signals.

There is no uniform implementation standard across all providers.

The primary privacy control on the PLASTOPEX website is the cookie settings panel.

Where the technical implementation reliably supports Global Privacy Control, the signal should be treated as a rejection of non-essential marketing technologies.

18. Consent records

We may retain a technical record of:

• banner version;
• selected categories;
• date and time;
• anonymous or pseudonymous identifier;
• applicable Cookie Policy version.

The record is retained to demonstrate the user’s choice, normally for up to 12 months.

A new choice may be requested after expiry or a material technology change.

19. Current cookie list

Individual cookie names and durations may change when a provider updates its technology.

The current list of active services, categories, domains and durations should be displayed in the “Cookie settings” panel.

The live panel takes priority over general examples in this Policy where a technical change occurred after the Policy’s last update.

20. Changes to this policy

We may update this Policy where:

• a service is added or removed;
• a purpose changes;
• a provider changes its technology;
• the consent system changes;
• applicable law or regulatory practice changes.

The date at the beginning identifies the current version.

21. Contact

Cookie and privacy-preference questions may be sent to:

info@plastopex.com
PLASTOPEX DOO
Pere Jovanovića - Komirićanca 50
14253 Osečina
Republic of Serbia
Telephone: +381 69 723 200