Cookies & local storage
Buronia uses two kinds of browser storage: strictly necessary cookies that keep you signed in and remember your language — these do not need consent under ePrivacy Art. 5(3) — and optional Google Analytics cookies that load only after you tick Analytics in our consent banner and click Accept. We do not set any advertising or cross-site-tracking cookies.
Effective 2026-05-11.
Change your choice
Click Cookie settings to reopen the consent banner and switch Analytics on or off at any time. The choice is stored in your browser only; clearing site data resets it.
Strictly necessary cookies
These cookies are required for the service to work and do not need consent under the ePrivacy Directive Art. 5(3) exemption.
| Name | Purpose | Type | Lifetime | Set on |
|---|---|---|---|---|
formera_country |
Remember which country site you chose so navigation works without a host change. | First-party, SameSite=Lax | 365 days | First page load |
formera_user_id |
Keep you signed in across pages and sessions. | First-party, httpOnly, SameSite=Lax | 30 days | Email-link sign-in |
_csrf |
Protect form submissions from cross-site request forgery. | First-party, httpOnly, SameSite=Strict | Session | First page load |
buronia_analytics_consent |
Record your consent choice (1 = analytics on, 0 = analytics off) so the server-side gate knows whether to emit the Google Analytics script tag on the next request. Without this cookie we treat you as "not yet consented" and GA is not loaded. |
First-party, SameSite=Lax | 365 days | When you click Accept / Essential only / Save choices in the banner |
Optional analytics cookies (Google Analytics 4)
If — and only if — you tick Analytics in the consent banner and click Accept, we load Google Analytics 4. GA4 sets the following cookies:
| Name | Purpose | Type | Lifetime | Set on |
|---|---|---|---|---|
_ga |
Distinguish unique browsers (pseudonymous Client ID). | First-party (set by Google's gtag.js for buronia.com) |
2 years | After Accept |
_ga_<ID> |
GA4 session-state cookie tied to our property ID. | First-party | 2 years | After Accept |
GA is configured with anonymize_ip (Google truncates
the IP before storage) and cookie_domain: buronia.com.
No form answers, no personal-info fields, and no benefit-eligibility
data is sent to Google — only the page URL, referrer, and
the standard GA4 web-stream signals. Declining means none of
these cookies are set and no requests are made to
googletagmanager.com or
google-analytics.com.
Browser local storage
We write one key to localStorage:
buronia.cookieConsent.v1. It mirrors your consent
choice so the banner does not re-appear on every page load. We
do not use sessionStorage at all. The
address-autocomplete widget is a stateless API call to Google
Places and stores nothing in your browser.
Third-party cookies set by other vendors
The Google Places address-suggestion request — fired only when you type into an address field — can cause Google to set its own cookies for that request. See Sub-processors for the full list of third parties and what they receive. You can block third-party cookies in your browser and the rest of the site continues to work; only the inline address suggestions will degrade to plain typing.
How to clear cookies
Your browser's settings let you delete site cookies. Clearing
formera_user_id signs you out; clearing
buronia_analytics_consent will cause the consent
banner to reappear on your next visit; clearing the others
simply forgets your preferences.
Consent — legal bases
- Strictly necessary cookies — loaded without consent under ePrivacy Art. 5(3) exemption (strictly necessary for the requested service).
- Analytics cookies — loaded only after explicit opt-in consent (ePrivacy Art. 5(3), GDPR Art. 6(1)(a) and Art. 7, TTDSG §25 in Germany). The banner offers a Reject all button with the same visual weight as Accept all, in line with CJEU C-621/22 and the joint CNIL/BfDI guidance.
- Authentication cookies after sign-in — performance of contract under GDPR Art. 6(1)(b).
We also honour the Sec-GPC: 1 Global Privacy
Control browser signal: if your browser sends it, we record
buronia_analytics_consent=0 automatically and
Google Analytics is never loaded, with or without the banner.