Cookie Policy
EXREA S.r.l. — www.exrea.it
Information on the use of cookies and other tracking tools, provided pursuant to Article 122 of Italian Legislative Decree 196/2003 and the Guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) no. 231 of 10 June 2021.
This is an English translation of the Italian cookie policy. In the event of any discrepancy, the Italian version prevails.
Last updated: 02/10/2026
1. Data controller
EXREA S.r.l. — Via Tomasi di Lampedusa 149, Pistoia, Italy — Tax code and VAT number 02136720477 — [email protected]
This cookie policy forms an integral part of the Privacy Notice, to which you are referred for purposes, legal bases, recipients, transfers outside the EU and data subject rights.
2. What cookies and other tracking tools are
Cookies are small text files that the websites you visit store on your device, where they remain to be sent back to the website on subsequent visits.
Alongside cookies there are other tools that do not store anything on the device but still send information to remote servers: requests to external resources, measurement pixels, technical identifiers calculated by the browser. These are also covered by the law, and this policy declares them just like cookies.
3. Coding criteria adopted
The Garante’s Guidelines require the policy to state the criteria by which trackers have been classified.
The criteria applied by EXREA S.r.l. are as follows:
Criterion 1 — Who sets the tracker. First-party trackers, set by the exrea.it domain, are distinguished from third-party trackers, set by domains belonging to other parties. The website’s technical and statistics cookies are first-party. With marketing consent, Google also sets third-party cookies on its own domains, listed in § 5.2.
Criterion 2 — Purpose pursued.
| Category | Definition adopted |
|---|---|
| Technical (on the banner: “Functional”) | Strictly necessary to deliver the service or to carry out an explicit request from the user, pursuant to Article 122 of the Code. This includes trackers that record the choices made on the banner |
| Statistics | Used to measure how the website is used. They are exempt from consent only if all of the following apply: IP address masking, use limited to a single website, production of aggregate statistics only, and a ban on the third party combining the data or passing it to others. The tools used by EXREA S.r.l. do not meet these conditions and therefore require consent. |
| Marketing and profiling | Used to build interest profiles, measure the effectiveness of advertising campaigns or show promotional messages again. They always require consent. |
The banner also shows a “Preferences” category: as of the date of this policy, the website does not use any trackers in this category.
Criterion 3 — Legal basis. For everything that is not technical, the legal basis is the data subject’s consent. Legitimate interest cannot be relied on for setting cookies or other tracking tools: the Garante expressly rules this out in its 2021 Guidelines.
Criterion 4 — Duration. The duration of each tracker is stated as the value set on the website, distinguishing session cookies, deleted when the browser is closed, from persistent ones. Some browsers may reduce the actual duration of cookies compared with the value set.
Criterion 5 — What leaves the browser. A tracker may not store any cookie and still send data to a third party. The criterion used to decide whether to declare it is what leaves the user’s browser, not what is written to their device. This is why § 6 also lists tools that use no cookies.
4. Technical cookies
They do not require consent. They are set even if the user refuses, because they are needed to remember the choices made on the banner and to prove the consent given.
| Cookie | Party | Purpose | Duration | Type |
|---|---|---|---|---|
| cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing | EXREA (Complianz software) | Record the choice made for each category | 365 days | first-party |
| cmplz_banner-status | EXREA (Complianz software) | Records that the banner has been dealt with, so it is not shown on every page | 365 days | first-party |
| cmplz_policy_id | EXREA (Complianz software) | Version of the accepted cookie policy; if the policy changes, the banner is shown again | 365 days | first-party |
| cmplz_saved_categories, cmplz_saved_services, cmplz_consented_services | EXREA (Complianz software) | List of accepted categories and services | 365 days | first-party |
| cmplz_id | EXREA (Complianz software) | Identifier of the consent record kept in the website database, as proof of the consent given | 365 days | first-party |
| wp_consent_functional, wp_consent_preferences, wp_consent_statistics, wp_consent_statistics-anonymous, wp_consent_marketing | EXREA (WP Consent API) | Pass the user’s choice on to the other components of the website so that they respect it | 30 days | first-party |
Keeping proof of consent is an obligation of the Controller (Art. 7(1) GDPR): this is why these trackers are present even when the user refuses. The recorded choices remain in the website database, hosted in Italy, and are not disclosed to third parties.
5. Cookies subject to consent
They are only set if the user gives consent to the corresponding category. If the user refuses, none of them is stored on the device.
5.1 Statistics
| Cookie | Party | Purpose | Duration | Type |
|---|---|---|---|---|
| _ga | Google Ireland Ltd. | Pseudonymous user identifier, used by Google Analytics 4 to distinguish visits | 2 years | first-party |
| _ga_CLP6EQS86E | Google Ireland Ltd. | Keeps the session state for the website’s Analytics property | 2 years | first-party |
Google Analytics 4 is only activated with consent to the “Statistics” category and is used to understand how the website is used. Data is collected in pseudonymous form and sent to the service’s European regional endpoint. Retention is set to 2 months for event data and 14 months for user data.
5.2 Marketing and profiling
| Cookie | Party | Purpose | Duration | Type |
|---|---|---|---|---|
| _gcl_au | Google Ireland Ltd. | Attribution of advertising conversions, used by Google Ads | 3 months | first-party |
| test_cookie | Google Ireland Ltd. (doubleclick.net domain) | Checks whether the browser accepts cookies, for Google Ads to work | 15 minutes | third-party |
Google Ads is only activated with consent to the “Marketing” category. It makes it possible to measure the effectiveness of campaigns, attribute conversions and show promotional messages again to users who have already visited the website (remarketing).
Google may set further third-party cookies on its own domains, depending on the settings of the user’s browser and any Google account. For the up-to-date list, please refer to Google’s policy indicated in § 8.
This category also includes:
- enhanced conversions: only with marketing consent, when the contact form is submitted the email address entered is sent to Google in pseudonymised form by hashing (§ 4.6 of the Privacy Notice);
- audiences from Google Analytics: if the user has consented to both statistics and marketing, Google Analytics data may be used to build audiences for remarketing on Google Ads.
6. Other tools that send data without setting cookies
In application of Criterion 5, the following processing is declared.
| Tool | Party | What it involves | Consent |
|---|---|---|---|
| Google tag library (googletagmanager.com) | Google Ireland Ltd. | Each time a page loads, the browser downloads from Google the library that manages Analytics and Google Ads. The request involves sending the IP address and technical browser information. Until the user gives consent, the library does not activate any measurement tool and does not set cookies | No measurement without consent; the file request itself always takes place |
| Conversational assistant | Cloudflare, Inc. · Anthropic PBC | Activated at the user’s initiative. It does not set cookies and only sends the text of the messages. The processing is described in § 4.3 of the Privacy Notice | Voluntary activation by the user |
| Software libraries for the demo experiences (unpkg, jsDelivr, cdnjs) | The respective content delivery network operators | On the exrea.io and exrea-production.it domains, the three-dimensional experiences may load software components from third-party content delivery networks. The request involves sending the IP address and technical browser information; no cookies are set | Necessary for the experiences opened by the user to work |
| Cloudflare Turnstile (challenges.cloudflare.com) | Cloudflare, Inc. | Invisibly checks that the website’s forms are not submitted by automated programs. It involves sending the IP address and technical browser and device information; it does not set profiling cookies. The processing is described in § 4.1 of the Privacy Notice and in the Turnstile Privacy Addendum | Not required: technical tool necessary for the security of the forms |
On www.exrea.it, fonts and page software components are hosted on the website’s own server: displaying them does not involve requests to third-party servers.
The WhatsApp link on the website is a simple link: it does not load external resources, does not set trackers and does not send any data until the user decides to use it. The resulting processing is described in § 4.4 of the Privacy Notice.
7. How to give, change or withdraw consent
On your first visit, the website shows a banner that lets you accept, refuse or select individual categories of trackers. Until you make a choice, no statistics or marketing tool is activated. Closing the banner without choosing is equivalent to not giving consent.
Each category only activates the tools that belong to it: consenting to statistics only does not activate Google Ads, and consenting to marketing only does not activate Google Analytics.
Consent can be withdrawn or changed at any time, as easily as it was given, through the “Manage consent” button on every page of the website.
After withdrawal, the tools in the withdrawn category are no longer activated and the related cookies are no longer read or used. Cookies already stored may remain on the device until they expire: you can remove them by deleting them in your browser settings. Cookies set on third-party domains, such as Google’s, cannot be deleted by the website and must be removed from the browser or through the tools provided by the third party.
Withdrawal does not affect the lawfulness of processing carried out before it.
Managing cookies from browser settings
You can also block or delete cookies from your browser settings. Deleting cookies from the browser also deletes those that record your choices: on your next visit the banner will appear again. Blocking all cookies may also affect some features of the website.
Instructions for the main browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari) can be found on their respective help pages.
8. Third parties and transfers outside the European Union
The third parties listed in the tables process data as processors or independent controllers, according to their respective terms. Please read their privacy policies to find out about the purposes of the processing they carry out:
- Google — Privacy policy and page on how Google uses information from sites that use its services
- Cloudflare — Privacy policy
- Anthropic — Privacy policy
- Meta Platforms Ireland Ltd. (WhatsApp) — Privacy policy
The banner is managed with the Complianz software, installed on the website: users’ choices are recorded in the website database and are not sent to the software’s producer.
Some of this processing may involve transferring data to third countries, in particular the United States. Transfers are based on the Standard Contractual Clauses adopted by the European Commission and, where applicable, the providers’ participation in the EU-US Data Privacy Framework. Details are in § 7 of the Privacy Notice.
9. Data subject rights
Data subjects may at any time exercise the rights provided for in Articles 15 to 22 GDPR — access, rectification, erasure, restriction, portability, objection and withdrawal of consent — by writing to [email protected].
They also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Details of the rights and how to exercise them are in § 11 of the Privacy Notice.
10. Updates
The trackers on a website change over time as the tools used change. The Controller periodically checks the configuration, including by analysing the requests actually sent by the browser, and updates this policy accordingly, as shown by the date of last update at the top.
