Cookie Policy

This policy explains how SIA NordF, trading as Nordfunded, uses cookies, local storage, session storage, scripts, pixels and similar device technologies on nordfunded.com. It should be read with the Privacy Policy and Affiliate Program Agreement.

1. Controller and contact information

SIA NordF, registration number 50203736551, registered at Vesetas iela 24-45, Riga, LV-1013, Latvia, decides which first-party technologies are used on nordfunded.com. Contact [email protected] for privacy questions and [email protected] for technical support.

2. What this policy covers

Cookie is used broadly in this policy. It includes browser cookies, local storage, session storage, analytics scripts, tracking pixels and similar access to or storage on a visitor's device. Server logs that do not access or store information on the visitor's device are described in the Privacy Policy rather than this inventory.

3. Consent categories

• Necessary - stores the privacy choice and supports a function specifically requested by the visitor. It cannot be disabled through the preference centre.
• Functional - remembers optional newsletter and interface choices. It is off by default.
• Analytics - allows Google Analytics and Microsoft Clarity to measure visits, events, heatmaps and session replay. It is off by default.
• Affiliate tracking - stores and measures a referral source for commission attribution. It is off by default.

Closing the banner, scrolling, clicking elsewhere, inactivity or continued browsing is not treated as consent. Optional switches are not preselected. A visitor can reject every optional category from the first banner layer.

4. Cookie and storage inventory

The table lists first-party technologies confirmed in the public website source and provider cookies expected under the current consent configuration. Microsoft advertising storage is denied, so Microsoft advertising identifiers are not expected from the Clarity integration. The deployment audit must confirm the observed browser behaviour.

5. Analytics controls

Google Analytics and Microsoft Clarity are removed from the initial page HTML. Their scripts are injected only after analytics consent is recorded. The current Google Analytics configuration limits the two GA4 first-party cookies to 90 days and denies advertising storage, advertising user data and advertising personalisation.

Nordfunded passes Microsoft Clarity Consent API V2 signals with analytics storage granted and advertising storage denied. When analytics consent is withdrawn, Nordfunded sends denied signals, asks Clarity to erase its cookies, removes the injected scripts, deletes known first-party Google Analytics and Clarity cookies where technically possible and reloads the page.

6. Affiliate attribution

An affiliate link may contain a parameter such as ?ref=CODE. If the visitor consents to affiliate tracking and no valid referral cookie exists, Nordfunded stores the first valid code in the nf_ref cookie for up to 30 days. The trader platform may read that code during registration or a challenge purchase.

• The first valid referral code is not normally replaced during its 30-day period.
• Rejecting affiliate tracking does not block registration, checkout or use of the service.
• Attribution may be lost when cookies are rejected, deleted or unavailable, or when another device or browser is used.
• Nordfunded does not use browser fingerprinting or promise cross-device affiliate attribution in the public website code.
• The click endpoint receives the affiliate code and source network address, hashes the address and deduplicates repeated clicks for the same code and source during a limited period.
• Affiliate conversion records may include the referral source, qualifying purchase, commission amount and conversion status.

7. Security and fraud technology

The public website source reviewed for this version does not create a persistent browser fingerprint for fraud detection. Ordinary hosting, security and request logs may record network, device and request information without placing a nonessential browser identifier. Any future device fingerprinting, bot-detection software or cross-site fraud technology must be assessed separately and added to this inventory before use.

Necessary security storage must be limited to what is objectively required for login, checkout, fraud prevention or another function requested by the user. A technology is not classified as necessary merely because it is commercially useful for analytics or attribution.

8. Providers and international transfers

Where a provider processes personal data outside the European Economic Area, Nordfunded uses the transfer mechanism documented in the applicable provider agreement, such as an adequacy decision or standard contractual clauses. Current transfer details and how to request relevant safeguards are described in the Privacy Policy or can be requested from the privacy contact.

• Google Privacy Policy
• Google Analytics cookie information
• Microsoft Privacy Statement
• Microsoft Clarity cookie information
• Microsoft Clarity Consent API V2

9. Accepting, rejecting and changing choices

• The first banner layer provides Reject all, Manage choices and Accept all.
• Reject all and Accept all require the same number of clicks and use buttons of equivalent visual prominence.
• Manage choices allows each optional category to be enabled or disabled separately.
• A permanent Cookie settings control appears in the footer on every public page.
• Withdrawing consent is designed to be as easy as granting it.
• Legal pages, challenge pricing, account creation and checkout are available without accepting optional technologies.

10. Consent record and policy evidence

The public website stores the current choice locally under nf_cookie_consent. The record includes the policy version, date and time, page language, accepted and rejected categories and whether the visitor selected Reject all, Accept all or Save choices. It is not attached to a Nordfunded account or sent to the server by the public website.

Because the record remains on the visitor's device, it can be lost when storage is cleared. Nordfunded retains source-control and deployment records for banner and policy versions. A separate consent-management or server-side evidence process may be required where central proof across devices or applications is necessary.

11. Retention

Cookie lifetime and retention of information collected through a cookie are different. Cookie lifetimes are listed in the inventory. Google Analytics account-level event retention must be verified in the production property. Microsoft currently documents 30-day retention for ordinary playback data and longer periods for certain aggregated, labelled or heatmap data. Affiliate conversion, payment and fraud records may be retained after the nf_ref cookie expires where needed for contract administration, disputes, legal obligations or legitimate fraud-prevention interests.

12. Language and accessibility

The current public website is presented in English, and the banner and policy use English. If Nordfunded publishes a Latvian or another local-language version or directs a local-language campaign to it, the corresponding cookie information and controls should be provided in that language. The consent buttons are keyboard accessible and the banner is marked as a dialog for assistive technology.

13. Technical testing

After each material deployment, Nordfunded should test the homepage, blog, registration, login, checkout, payment, affiliate, dashboard, trading, identity-verification, payout and support journeys using a new browser profile.

• Before a choice, only necessary storage and requests should operate.
• After Reject all, analytics, affiliate and optional functional technologies should remain inactive.
• After analytics-only consent, only necessary and analytics technologies should operate.
• After withdrawal, optional scripts should stop and removable first-party cookies should be cleared.
• After refresh and return visits, the saved choice should be respected.
• Mobile and desktop behaviour should match.

14. Rights and complaints

Depending on the processing and applicable law, users may have rights of access, correction, deletion, restriction, objection, portability and withdrawal of consent. Full details are in the Privacy Policy. A user may complain to the Latvian Data State Inspectorate or another competent supervisory authority.

15. Changes and version history

Nordfunded will update this policy and request a new choice where a provider, category or purpose changes materially and the existing consent does not cover the new use. Rejecting visitors will not be repeatedly prompted merely to pressure them into accepting optional technologies.