COOKIE POLICY

Last updated: 5 August 2026

This Cookie Policy explains how [LEGAL BUSINESS NAME], trading as KOLLATERAL (“Kollateral”, “we”, “us”, “our”), uses cookies and similar technologies when you visit [STORE URL].

Read this Policy together with the Kollateral Privacy Policy:

1. WHAT COOKIES ARE

Cookies are small text files stored on a browser or device when a website is visited.

We may also use similar technologies, including pixels, tags, local storage, software development kits, server-side event connections and other identifiers. References to “cookies” in this Policy include these technologies where appropriate.

2. DATA CONTROLLER

KOLLATERAL

Legal business name: [LEGAL BUSINESS NAME]

Registered address: [REGISTERED BUSINESS ADDRESS]

VAT / tax ID: [VAT / TAX ID]

Privacy email: [PRIVACY / SUPPORT EMAIL]

Some third-party providers may also act as independent controllers for their own purposes, as explained in their privacy documentation.

3. WHY WE USE COOKIES

Depending on your choices and the store configuration, cookies may be used to:

operate the storefront, cart and checkout;
maintain security and prevent fraud;
remember consent and privacy preferences;
measure store performance and usage;
understand interactions with products and pages;
attribute visits, orders and conversions;
measure advertising campaigns;
personalize marketing and advertising;
support email-marketing forms and campaign measurement.

4. COOKIE CATEGORIES

A. Strictly necessary cookies

These cookies are required for essential store services, including:

page navigation;
cart and checkout functionality;
payment and transaction security;
fraud prevention;
technical operation and load balancing;
privacy and consent-preference storage;
protection against malicious activity.

They cannot normally be disabled through the cookie banner because the requested service cannot function correctly without them.

B. Preference and functionality cookies

These cookies remember choices that improve functionality and convenience, such as region, language or display preferences.

Where required by law, they are used only after consent.

C. Analytics cookies

These cookies help us understand store traffic, performance and visitor interactions.

They may collect:

pages and products viewed;
session and device information;
referring source;
approximate location;
interactions with store features;
checkout and purchase events.

Where required by law, analytics cookies are used only after consent.

D. Marketing and advertising cookies

These cookies and similar technologies may be used to:

measure advertising performance;
attribute visits and purchases;
manage advertising frequency;
build or measure audiences;
personalize advertising;
connect browser activity with advertising-platform data.

Where required by law, marketing and advertising technologies are used only after consent.

5. PROVIDERS WE MAY USE

Subject to the final configuration and your consent choices, Kollateral may use the following providers.

Shopify

Shopify hosts and operates the ecommerce platform, storefront, cart, checkout, security and customer-privacy controls.

Shopify may set strictly necessary, functional, analytics or other cookies depending on the services and privacy settings enabled.

Klaviyo

Klaviyo may be used for:

newsletter and email-marketing subscriptions;
embedded or pop-up sign-up forms;
campaign measurement;
onsite behaviour tracking;
customer segmentation and marketing automation.

Non-essential Klaviyo onsite tracking should be activated only in accordance with applicable consent requirements.

Google

Google technologies may include:

Google Analytics 4;
Google advertising and conversion measurement;
consent-related measurement features.

These technologies may collect or receive device, browser, session, event, attribution and conversion information where enabled and lawfully configured.

TikTok

TikTok technologies may include:

TikTok Pixel;
TikTok Events API;
advertising attribution and measurement;
audience and campaign tools.

These technologies may receive browser, device, event, order and conversion information where enabled and lawfully configured.

WeTracked.io

WeTracked.io may be used for server-side attribution, conversion measurement and delivery of events to advertising platforms.

Server-side tracking does not remove applicable consent requirements. Kollateral will configure server-side events to respect consent choices and seek to avoid duplicate reporting through overlapping browser-side and server-side integrations.

Payment, security and delivery providers

Payment, fraud-prevention, security and delivery providers may use technologies necessary to process transactions, protect the store and provide requested services.

6. SERVER-SIDE TRACKING

Some events may be processed or transmitted through server-side systems rather than directly from the browser.

Depending on the configuration, these events may include:

page or product interactions;
cart and checkout events;
completed purchase events;
order value and currency;
advertising identifiers;
hashed or pseudonymized contact identifiers;
consent and attribution information.

Server-side processing is not a way to bypass user preferences. Where consent is required, the relevant marketing or analytics event should not be used for that purpose without the required consent.

7. CONSENT MANAGEMENT

Kollateral plans to use Shopify’s customer-privacy and cookie-banner controls to collect and record preferences.

Where applicable, the banner should allow users to:

accept all optional cookies;
reject optional cookies;
manage preferences by category;
change or withdraw consent later.

Rejecting optional cookies should not prevent essential storefront, cart and checkout functions.

8. HOW TO CHANGE YOUR CHOICES

You may change or withdraw cookie choices through the cookie-preference control available on the store.

You may also delete or block cookies through browser settings. Blocking strictly necessary cookies may prevent parts of the store, cart or checkout from working correctly.

Withdrawing consent does not affect processing carried out lawfully before withdrawal.

9. EMAIL-MARKETING COOKIES

Klaviyo forms and onsite features may use cookies or similar identifiers to:

display or suppress sign-up forms;
remember form interactions;
associate browsing events with a subscriber profile where lawfully permitted;
measure campaign and website engagement.

Subscribing to email marketing is separate from accepting analytics or advertising cookies. Marketing messages will be sent only where an appropriate legal basis exists.

10. PAYMENT AND CHECKOUT TECHNOLOGIES

Shopify and payment providers may use strictly necessary cookies or similar technologies to:

operate checkout;
authenticate or secure transactions;
prevent fraud;
remember checkout progress;
process the selected payment method.

Payment options may include Shopify Payments, PayPal and any other provider actually displayed at checkout.

11. INTERNATIONAL DATA TRANSFERS

Some providers may process data outside the European Economic Area, including in the United States or other countries.

Where required, transfers will rely on an applicable legal mechanism, such as an adequacy decision, Standard Contractual Clauses or another lawful safeguard.

Further information is provided in the Kollateral Privacy Policy.

12. RETENTION

Cookie duration varies by purpose, provider and configuration.

Cookies may be:

session cookies, deleted when the browser session ends; or
persistent cookies, retained until expiry, deletion or withdrawal of consent.

Consent records may be retained for the period reasonably necessary to demonstrate and manage privacy choices.

13. CURRENT COOKIE INVENTORY

The exact names, providers, purposes and expiry periods depend on the final Shopify theme, installed applications, markets, payment methods and tracking configuration.

Before accepting live orders, Kollateral must perform a technical scan of the production store and verify the final inventory against the services actually active.

The final inventory should identify:

cookie or technology name;
provider;
purpose;
category;
duration;
whether it is first-party or third-party.

Services that are not active at launch must not be represented as active in the published inventory.

14. THIRD-PARTY INFORMATION

Third-party providers maintain their own privacy and cookie information. Their practices may change independently of Kollateral.

The final store configuration should link to relevant provider information where appropriate.

15. DO NOT TRACK AND SIMILAR SIGNALS

Browser “Do Not Track” signals are not implemented consistently across the industry.

Where required by applicable law or supported by the configured platform, Kollateral will respond to recognized consent and privacy-preference signals.

16. CHANGES TO THIS POLICY

We may update this Cookie Policy to reflect changes to the store, installed services, tracking configuration or legal requirements.

The current version and last-updated date will be published on this page.

17. CONTACT

Questions about cookies or privacy choices may be sent to: