In short: without your consent only strictly necessary cookies run — cart, session, language and currency. Analytics (Google Analytics 4) and advertising tools (Meta, Google Ads) start only once you accept them, and you can withdraw your consent at any time.
What are cookies?
Cookies are small text files saved on your device by your web browser while you use a website.
Which cookies do we use?
Strictly necessary (always active — the shop does not work without them):
ps_cart_id— cart identifier, valid for 30 days,larica_session— signed-in customer session, valid for 7 days, not accessible to scripts (httpOnly),NEXT_LOCALE— selected site language,larica-wishlist— your wishlist,larica_consent_v1— your choice from the cookie banner, valid for 12 months.
We store your banner choice in two places at once: in your browser local storage and in a cookie of the same name, larica_consent_v1. The cookie is needed because local storage is visible to the browser only, while your refusal must also be respected by our server — without it the server would have no way of knowing what it must not do. It holds nothing but what you agreed to.
Analytics (only with your consent):
_ga— Google Analytics 4, distinguishes users, valid for 2 years,_ga_<ID>— Google Analytics 4, keeps session state, valid for 2 years,larica_cid— our fallback statistical identifier, used only when Google scripts are blocked in your browser, valid for 90 days,larica_sid— a marker of the current visit for that same fallback measurement, valid for 30 minutes.
Until you give consent, none of these files is created and your browser sends no request to Google at all.
Marketing (only with your consent):
_fbp— browser identifier for Meta (Facebook, Instagram), valid for 90 days,_fbc— identifier of a click on a Meta ad; created only if you reached us from such an ad, valid for 90 days,larica_gclid— identifier of a click on a Google ad; created only if you reached us from a Google ad, valid for 90 days.
They let us recognise that a visit followed a particular advertisement, and show you ads matched to the products you viewed. Without marketing consent none of them is created.
Server-side measurement
Some events are reported to Meta and Google directly from our server rather than from your browser. We do this because a report sent from the browser is often blocked by extensions and privacy settings, which leaves us unable to tell which ads actually work. This covers viewing a product, adding it to the cart, starting checkout, placing an order, creating an account and subscribing to the newsletter.
This path is subject to exactly the same consent as cookies: without marketing consent we send nothing to Meta, and without analytics consent, nothing to Google. Our server checks this by reading your decision from the larica_consent_v1 cookie.
We send: the address of the page viewed, the event name, the order value and currency, identifiers of the products viewed, your IP address and information about your browser. If you have given us your details (an order, registration, newsletter), we also attach an irreversible hash of your e-mail address, phone number, first name, surname, city and postal code — computed with SHA-256, from which the original value cannot be recovered. The recipient can only compare it with a hash it already holds. We never send the plain values themselves.
Consent — what exactly
The cookie banner offers three categories:
- Necessary — login, cart, session. Always active, because the shop does not work without them.
- Analytics — traffic statistics (Google Analytics 4).
- Marketing — personalised advertising (Meta, Google Ads) and campaign measurement, including on the server side.
The legal basis for analytics and marketing is your consent (Article 6(1)(a) GDPR and Article 173 of the Polish Telecommunications Act). Strictly necessary cookies rely on our legitimate interest (Article 6(1)(f) GDPR) in delivering a working shop.
The shop runs Consent Mode v2 with denial by default: before you click, every consent signal is set to “denied”, the Google Tag Manager container does not load at all and no request leaves for Google servers. Refusing takes one click — exactly like accepting.
Who receives the data?
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — the provider of Google Analytics 4, Google Tag Manager and Google Ads.
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland — the provider of Facebook and Instagram advertising tools, including server-side conversion measurement.
Both recipients may transfer data to their parent companies in the United States, that is outside the European Economic Area. Such transfers are covered by the standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR); both companies are additionally certified under the EU–US Data Privacy Framework.
We never sell your data.
How to withdraw consent
You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
- In the banner — the “Cookie settings” link in the footer opens a panel with switches; a refusal is saved immediately and from that moment we send nothing, neither from the browser nor from the server.
- In your browser — clear the site data for larica.com (cookies and site data). This removes the stored decision together with the Google and Meta cookies, and on your next visit the banner asks again, so you can choose “Necessary only”.
- By blocking cookies — your browser settings let you block cookies for our domain. Note that this also blocks the strictly necessary ones, so the cart and your sign-in will stop being remembered.
- By writing to us — [email protected]. On request we will confirm the withdrawal and the deletion of the data.
More in our Privacy Policy.