GDPR

Cookie Policy

Version 1.1  •  Last updated: 5 November 2025

Scope & Legal Basis. This Cookie Policy explains how Sucto uses cookies, pixels and similar technologies on sucto.eu, in line with the UK/EU GDPR, the ePrivacy rules (as implemented in Portugal), and CNPD guidance. It complements our Privacy Policy and our GDPR (DSAR) page operated by Consentmo.

1) What cookies are

Cookies are small text files stored on your device by a website. They allow a site to remember information between pages/sessions. Similar technologies include pixels/tags and local/session storage.

Strictly necessary cookies are required to operate the site (e.g., basket/checkout). Analytics and marketing cookies are optional and require your prior consent.

2) Consent management (Consentmo CMP)

We use Consentmo as our Consent Management Platform to control all non-essential cookies.

  • On first visit, you will see a cookie banner with the options “Reject all”, “Accept selected” and “Manage preferences”.
  • Non-essential cookies (analytics/marketing) are only set after your explicit consent.
  • You can change or withdraw consent at any time using Privacy Preferences in the footer.
  • We keep consent logs (timestamp, categories, policy version) for 12 months.

Open Privacy Preferences   Withdraw non-essential consent

Pre-consent blocking: Microsoft Clarity (UX analytics), Meta Pixel (marketing/retargeting), Wetracked and similar scripts remain blocked until you grant consent in the corresponding category.

3) Cookie categories and legal bases

Cookie categories, purposes and legal bases
Category Purpose Legal basis Examples Typical duration
Essential Operate the site and checkout; security; session continuity; fraud prevention. GDPR Art. 6(1)(b) (contract) and legitimate interests (security). Shopify platform/session cookies. Session to 2 years
Analytics & Preferences Measure usage (pages, clicks), improve UX and performance; remember preferences (e.g., language). Consent (GDPR Art. 6(1)(a)). Microsoft Clarity; site preferences. Session to 13 months
Marketing Campaign performance, attribution and retargeting; personalised ads. Consent (GDPR Art. 6(1)(a)). Meta (Facebook) Pixel. Up to 13 months
Order-Operational Shipment and delivery tracking strictly needed to perform the contract. GDPR Art. 6(1)(b) (contract). Track123 order tracking. Session to 12 months

4) Examples of cookies we may use

The precise, up-to-date list is shown in the Consentmo Privacy Preferences panel and prevails over the examples below.

Essential (no consent required)
Name Provider Purpose Duration
_shopify_y, _shopify_s, secure_customer_sig, cart Shopify Session stability, secure authentication, basket/checkout continuity 1 day to 2 years
consentmo, consentmo_* Consentmo Store your consent choices and policy version 12 months
Analytics & Preferences (consent required)
Name Provider Purpose Duration
_clck, _clsk Microsoft Clarity Interaction analytics and session replay for UX improvements 1 day to 1 year
lang_pref Sucto Remember language and layout preferences Session
Marketing (consent required)
Name Provider Purpose Duration
_fbp, _fbc Meta Attribution and retargeting for advertising 3–13 months
Order-Operational
Name Provider Purpose Duration
t123_* Track123 Shipment status and tracking links after dispatch Session to 12 months

5) Third parties that may process data

Shopify (hosting/checkout), Consentmo (consent logs), Microsoft Clarity (UX analytics), Meta (ads/retargeting), Track123 (tracking) and Gorgias (support). Some providers may process data outside the EEA (e.g., US). We use EU Standard Contractual Clauses (SCC) and other safeguards as described in our Privacy Policy.

6) Managing or deleting cookies

  • Use Privacy Preferences (footer link) or the button above to change/withdraw consent.
  • Delete or block cookies via your browser settings.
  • Ad controls may be available on advertising platforms (e.g., Meta Ad Preferences).

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

7) Your data rights (GDPR)

Access, portability, rectification, erasure, restriction, objection and the right to withdraw consent can be exercised via our Consentmo DSAR portal:

Open GDPR / DSAR Portal

Alternatively, contact: support@sucto.eu (or your local DPO contact if appointed). You may lodge a complaint with your national data protection authority (in Portugal: CNPD).

8) Retention, updates and review

  • Consent logs retained for 12 months.
  • We review this policy at least annually and whenever we add/change cookies or providers.
  • Material changes will be announced on the site and, where appropriate, we will request renewed consent.

9) Banner text (reference)

Cookie notice. We use essential cookies to run the site and optional analytics and marketing cookies to improve your experience. You can Reject all, Accept selected or Manage preferences. Change your choices at any time in Privacy Preferences. See this Cookie Policy for details.

If there is any discrepancy between this page and the live list shown in the Consentmo Privacy Preferences panel, the Consentmo list prevails.