This notice explains the cookies and similar technologies used on the NERMO website and portals. It restates and expands Section 13 of the Privacy Policy, which governs the processing of any associated personal data.
1. Our approach: strictly necessary, one preference cookie, and consent-based analytics/advertising on the website
NERMO uses strictly necessary cookies, plus a single optional theme-preference cookie:
- Session and authentication cookies — set by the NERMO portals and by our self-hosted identity provider to sign you in and keep you signed in.
- Security protections — forms and authenticated requests are protected against forgery by same-origin checks; no separate security-token cookie is set.
- Anti-abuse token on the application forms — the public “Request Access” and “Apply as Vendor” forms use an anti-bot challenge (Cloudflare Turnstile), which may set a functional token solely to distinguish humans from automated abuse.
- Theme preference — a single first-party cookie that remembers the light/dark theme you choose, so the website and the portals render with the same theme. It is set only when you pick a theme and stores nothing but that choice.
On the public website (nermo.io) only, and only with your consent, we additionally use:
- Analytics cookies — Google Analytics measurement cookies (
_ga,_ga_*), host-scoped to nermo.io, used to understand how the website is used. Off until you grant the Analytics purpose in the consent banner. - Advertising cookies — Google advertising cookies (
_gcl_au), used to measure our ad campaigns and support remarketing. Off until you separately grant the Advertising purpose.
The portals use no analytics or advertising cookies — they set strictly necessary and theme-preference cookies only. Nothing consent-based is loaded anywhere before you opt in: until a purpose is granted, no request is made to Google at all. We do not sell browsing data, and analytics/advertising cookies never reach the portals, the API, or the MCP endpoint (all such cookies are host-scoped to the website).
Consent is collected through the website’s consent banner: each purpose is a separate toggle, rejecting is as easy as accepting, and a stored choice can be changed at any time via “Cookie preferences” (site footer and application forms). A consent choice is stored for 12 months, after which we ask again; if the purposes or recipients described in this notice materially change, we ask again before the stored choice is reused.
2. Cookie table
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
| Portal session cookies | NERMO portals | Keep you signed in to the Client/Vendor Portal | Strictly necessary (first-party) | Session |
| Identity-provider session cookies | NERMO’s self-hosted identity provider | Single sign-on session with our EU-hosted identity service | Strictly necessary (first-party) | Session |
| — (none set) | NERMO portals / website | Cross-site request forgery is prevented without a token cookie: state-changing requests are same-origin checked (Origin header) and the session cookie is SameSite=Lax | Strictly necessary (first-party) | — |
nermo_theme | NERMO website and portals | Remembers your light/dark theme choice across NERMO surfaces | Functional preference (first-party) | 12 months |
| Turnstile anti-abuse token | Cloudflare Turnstile (application forms only) | Distinguishes human applicants from automated abuse | Strictly necessary (anti-abuse) | Short-lived |
nermo_consent | NERMO website | Stores your consent choices per purpose, the notice version shown, and the decision time | Strictly necessary (first-party; consent state) | 12 months |
_ga | Google Analytics (website only, host-scoped to nermo.io) | Distinguishes visitors for analytics measurement | Analytics (consent-based) | 12 months |
_ga_* | Google Analytics (website only, host-scoped) | Keeps per-property session state for analytics measurement | Analytics (consent-based) | 12 months |
_gcl_au | Google (website only, host-scoped) | Ad-campaign conversion linking | Advertising (consent-based) | 3 months |
3. Managing cookies
You can block or delete cookies in your browser settings. Blocking the strictly necessary cookies will prevent sign-in and form submission from working; blocking the theme-preference cookie only means your theme choice will not follow you across NERMO surfaces. Analytics and advertising cookies can additionally be granted, refused, or withdrawn at any time via “Cookie preferences” in the site footer; withdrawal stops collection immediately and deletes the associated Google cookies.