Cookie policy

Scope and responsible entity

This policy describes cookies and similar technologies on the public Nostium website. Nostium B.V., Bogert 1, 5612 LX Eindhoven, the Netherlands, is responsible for storage, access and any processing on its own public website. Accounts, booking environments, customer websites or other Nostium domains may have their own current inventory or consent notice. Questions can be sent to dataprotection@nostium.com.

Cookies and similar technologies

A cookie is a small text file stored on your device by a website. The same rules may apply to local or session storage, pixels, tags, scripts, SDKs and other technologies that store or access information on a device. Session technologies expire with the session; persistent technologies remain until their expiry date or deletion.

Necessary technologies on this website

Necessary technologies support session security, form protection and remembering your privacy choice. They are used solely for communication or to provide a website function you expressly requested. They do not require consent. The current inventory below identifies each technology’s purpose, storage, access and maximum retention.

Preferences and functionality

Technologies that merely improve convenience but are not strictly necessary for a requested function are not activated without valid consent. No separate optional preference suppliers are currently active on this public website. Necessary language, session or security settings fall within the necessary category when required for the requested function.

Analytics technologies

Nostium uses Google Tag Manager, Google Analytics 4 and Microsoft Clarity only after you enable Analytics. Google Analytics measures information including visitors, sessions, device category, approximate region, visited routes and acquisition source. Clarity measures interactions such as clicks and scrolling and creates heatmaps and session recordings; input fields and sensitive content are masked. Nostium uses strict opt-in: before consent these services do not load and no cookieless measurement requests are sent. The current inventory lists storage and retention periods.

Marketing and tracking

After your express consent to Marketing, Nostium uses Tracklution to measure campaign attribution and conversions and send consented events server-to-server to advertising platforms configured by Nostium. Advertising-related Microsoft Clarity storage also remains off without this consent. Tracklution does not start without marketing consent: Nostium does not use advanced cookieless measurement, probabilistic identification or fingerprinting to circumvent a refusal. New advertising platforms, purposes or technologies are added to the inventory and policy version first.

External links and embedded content

An ordinary link to an external platform does not place a cookie on this website; that platform’s policy applies after you follow the link. Embedded videos, maps, widgets or social content that are not necessary may only load after the required consent. We update the inventory before such content can activate cookies, pixels or similar technologies.

Bookings through connected organisations

A booking flow may be provided on a Nostium domain or embedded in the website of a connected organisation. Other strictly necessary technologies may apply there for accounts, bookings, payments or fraud prevention. The relevant environment or organisation must identify the active technologies, responsible entity and available choices.

Consent in the Netherlands, EU and Germany

Optional categories are off by default and requested by purpose. Scrolling, continuing, pre-ticked options or doing nothing do not count as consent; accept and reject are available on the same layer. This follows the GDPR, European ePrivacy rules and Article 11.7a of the Dutch Telecommunications Act. In Germany, Nostium also follows Section 25 TDDDG: storage or access without consent is allowed only to transmit communications or when strictly necessary for a digital service expressly requested by the user.

Withdrawal and changes

You can change or withdraw consent at any time just as easily through the permanent Cookie settings control. On withdrawal, we send the refusal to loaded suppliers, remove accessible optional first-party identifiers and reload the page without the withdrawn scripts. You can additionally remove cookies on third-party domains through your browser. The change applies immediately to future use and does not affect the lawfulness of earlier processing. When a purpose, supplier or technology changes materially, we increase the policy version and ask you to choose again.

Retention and browser settings

Your privacy choice is retained for up to six months in a host-only first-party cookie that expires automatically in the browser. The cookie uses Secure and SameSite=Lax and has no Domain attribute; when cookies are blocked, the choice applies only in session storage for the current browser tab. Other periods are listed in the current inventory. You can also inspect, block or remove cookies and session storage through your browser. Blocking strictly necessary technologies may prevent secure forms, accounts or booking functions from working correctly.

Personal data and legal bases

Cookie IDs, online identifiers and IP addresses may be personal data. Depending on the context, necessary processing relies on performance of a contract, a legal obligation or a legitimate interest in security and availability. Optional analytics or marketing processing that requires consent relies on your consent. The privacy statement explains purposes, recipients and rights in more detail.

Suppliers, Cherry B.V. and transfers

The current inventory identifies each technology’s supplier and access. Nostium intends to use Google Ireland Limited, Microsoft Ireland Operations Limited and Tracklution Oy for optional measurement. Tracklution primarily processes at AWS in Stockholm; Google, Microsoft, their subprocessors and configured advertising platforms may also process data from or outside the EEA. Nostium activates a supplier only after the required processing terms and, where needed, an adequacy decision, Standard Contractual Clauses, transfer assessment and supplementary safeguards have been checked and recorded. Necessary technical or aggregated insights may also be shared with processors or parent company Cherry B.V. for security, support, compliance and internal operations.

Your rights, complaints and changes

Where a technology processes personal data, you may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent. Send requests to dataprotection@nostium.com; Nostium normally responds within one month and will notify you in time if the GDPR permits an extension. You may also complain to the Dutch Data Protection Authority or the authority in your country of residence or work. This version replaces the earlier local storage of your choice with an automatically expiring host-only cookie and therefore asks you to choose again. Last updated: 25 August 2026.