Last Revised: 2026-08-18 00:59

COOKIE POLICY & TRACKING TECHNOLOGIES

1. Introduction & Scope

1.1. Purpose: This document ("Cookie Policy & Tracking Technologies" / DOC-006) sets forth the principles, technical mechanisms, and legal bases under which the sole proprietorship Prootzos Online (hereinafter the "Provider") collects, stores, and processes data via cookies, pixels, local storage, and related tracking technologies during user navigation on the official website [https://prootzos.com](https://prootzos.com) and within the digital environment of the Client Area.

1.2. Regulatory Framework: This Policy fully complies with:

  • Directive 2002/58/EC (ePrivacy Directive), as amended by Directive 2009/136/EC and transposed into Greek national law via Law 3471/2006.
  • General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek implementing Law 4624/2019.
  • Directive (EU) 2022/2555 (NIS2) on measures for a high common level of cybersecurity.
  • Guidelines of the European Data Protection Board (EDPB) and the Hellenic Data Protection Authority (HDPA).

1.3. Company Identity & Data Controller (Single Source of Truth):

  • Trade Name: Prootzos Online
  • Operating Model: Remote-First Internet & Hosting Service Provider
  • Tax Seat & Postal Address: Karkavitsa 46, 27131, Pyrgos Ilia, Greece (Strictly tax/postal seat — no physical retail store or walk-in customer support exists)
  • Legal Identifiers: VAT ID: EL 047648274 | Tax Office: Pyrgos Ilia
  • Legal Representative: Prountzos Nikos
  • Contact: E-Mail: contact@prootzos.com | Phone: +30 2621 121 373 | Website: [https://prootzos.com](https://prootzos.com)

2. Definitions & Technological Terminology

For the purposes of this Policy, the definitions established in the Common Definitions Registry (DOC-002) apply, alongside the following specialized technical terms:

  • Cookies: Small text data files stored on a visitor's terminal device during browsing, enabling the retrieval of session state and preference parameters.
  • Session Cookies: Temporary cookies automatically deleted upon the termination of the browsing session and the closure of the web browser.
  • Persistent Cookies: Cookies that remain stored on the terminal device for a predetermined retention period or until manually deleted by the user.
  • First-Party Cookies: Cookies placed directly by the prootzos.com website or the Client Area environment.
  • Third-Party Cookies: Cookies installed by external service providers (such as Google LLC) via integrated tools.
  • Consent Management Platform (CMP): The technical preference management system (Cookie Banner) that records, stores, and demonstrates user consent.
  • Google Tag Manager (GTM) with Consent Mode v2: The tag management system dynamically regulating tracker execution strictly based on the visitor's explicit consent signals.

3. Principle of Prior Consent (Prior Consent / Opt-In)

3.1. Mandatory Prior Consent: With the sole exception of Strictly Necessary Cookies (Article 5.1), no cookie, pixel tag, analytics tracking script, or advertising tracker is stored or executed on the terminal device prior to the affirmative, explicit, active, and informed consent action (Opt-in) executed by the user via the CMP.

3.2. Prohibition of Pre-ticked Boxes: Upon initial access, all non-essential categories are disabled by default. Continued scrolling, remaining on the webpage, or closing the prompt without explicit selection does not constitute consent.

3.3. Parity of Choices & Granular Opt-in: The visitor is provided with the capability of either immediate full acceptance ("Accept All") or immediate full refusal ("Reject All") of all non-essential trackers with equivalent visual emphasis and single-click execution, or selective granular consent per distinct category (Granular Opt-in) via the "Customize Settings / Preferences" interface.

3.4. Prohibition of Cookie Walls: Access to public website information and the operational functions of the Client Area is never conditioned upon accepting analytics or marketing cookies.

4. Technical Architecture: Google Tag Manager & Consent Mode v2

4.1. Default Denial State: Google Tag Manager integration operates under the Google Consent Mode v2 (Client-Side) architecture. Prior to recording user consent via the CMP, all consent parameters are set globally to a denied state (denied):

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

Technical Note: The baseline implementation strictly pertains to Client-Side tag management. Provisioning and maintaining Server-Side Tagging containers is not included in Core Managed Services and is provided solely under Professional Services (Article 7.4).

4.2. Dynamic Signal Update: Only upon affirmative consent for specific categories does the CMP execute an update command (gtag consent update), activating strictly the tags associated with the authorized categories.

4.3. Prevention of Unauthorized Data Transmission: In the absence of consent for analytics or marketing cookies, no Client IDs, persistent device identifiers, or personal data are transmitted to external third-party endpoints.

5. Categorization & Detailed Tracking Technologies Registry

5.1. Strictly Necessary & Functional Cookies: Purely technical cookies required for website operation, platform security, session management, and transaction processing within the Client Area. Exempt from consent requirements pursuant to Article 5(3) of Greek Law 3471/2006. Infrastructure Note: The recording of connection metadata (IP logs, network connections) at the Linux OS/Web Stack layer occurs independently of cookies for perimeter security (DOC-012) and Immediate Abuse Quarantine enforcement (DOC-003).

5.2. Analytics & Performance Cookies: Used for aggregating anonymous traffic metrics and optimizing usability. Activated strictly upon affirmative opt-in consent.

5.3. Marketing & Targeting Cookies: Used for evaluating advertising campaign efficacy and conversion attribution modeling. Activated strictly upon affirmative opt-in consent.

5.4. Detailed Cookie Matrix

Cookie / Technology Name Provider Category Processing Purpose Retention Period Type / Mechanism
prootzos_consent Prootzos Online (First-Party) Strictly Necessary Storing user consent preferences recorded via the CMP. 12 Months (or until revoked / policy update) Persistent Cookie
**WHMCSUID / WHMCSPW** Prootzos Online (First-Party) Strictly Necessary Maintaining authenticated user session state in the Client Area. Session Session Cookie
WHMCS_token Prootzos Online (First-Party) Strictly Necessary Preventing Cross-Site Request Forgery (CSRF) transaction attacks. Session Session Cookie
Language Prootzos Online (First-Party) Strictly Necessary Storing user UI language preference (GR / EN). 12 Months Persistent Cookie
_ga Google LLC (Third-Party) Analytics / Performance Distinguishing unique visitors and aggregating GA4 metrics. 2 Years Persistent (Subject to Opt-in)
_ga_* Google LLC (Third-Party) Analytics / Performance Maintaining session state in Google Analytics 4. 2 Years Persistent (Subject to Opt-in)
_gcl_au Google LLC (Third-Party) Marketing / Targeting Tracking Google Ads conversion attribution modeling. 90 Days Persistent (Subject to Opt-in)

6. Managing, Modifying & Revoking Consent

6.1. CMP Re-opening: The user retains the right to modify consent preferences or fully revoke previously granted consent at any time, with prospective effect:

  • Via the permanent Privacy Widget located in the lower-left corner of the website.
  • Via the "Cookie Settings" link situated in the footer of every page on [https://prootzos.com](https://prootzos.com).

6.2. Browser-Level Management: The user may delete or block cookies via individual browser settings (Chrome, Firefox, Safari, Edge). Self-Service & Support Boundaries: Local browser configuration is strictly a self-service customer action and is not covered by the Provider's technical support channels. Globally disabling necessary cookies may disable authenticated access to the Client Area.

7. Limitation of Liability, Hosted Customer Sites & Scope Creep Protection

7.1. Exclusive Scope of Application: This Policy (DOC-006) applies strictly and exclusively to digital systems and websites directly engineered and maintained by the Provider (main website and Client Area).

7.2. Hosted Customer Responsibilities (Shared Hosting, Managed VPS, Managed Dedicated):

  • Any Customer maintaining a hosting account via the Controller and publishing websites or web applications operates as an independent Data Controller.
  • The Customer bears full and exclusive legal and technical responsibility for drafting an independent Cookie Policy, implementing a lawful CMP/Opt-in mechanism, and complying with GDPR and ePrivacy requirements.
  • vHost Options & Custom Directives: In Shared Hosting environments, HTTP header configuration is executed strictly at the application code level (as the Options tab in the Controller is locked). In Managed VPS and Managed Dedicated environments, configuring custom HTTP response headers (e.g., Set-Cookie, CORS, security headers) or server-side analytics directives via the Options tab is executed under the sole technical responsibility of the Customer. Web server crashes resulting from syntax errors are remediated strictly as a Billable Professional Service (DOC-009) pursuant to DOC-012.

7.3. Professional Services for CMP Integration & Debugging:

  • Implementing CMP mechanisms, configuring GTM / Consent Mode v2, or debugging client-side JavaScript/plugins on Customer websites is excluded from Core Managed Services.
  • Any such technical assistance is provided on-demand as Professional Services (DOC-009), subject to a minimum one (1) hour billing unit under the prevailing rate card.

7.4. Server-Side Tracking Infrastructure: Where dedicated infrastructure is required for Server-Side Tracking (e.g., Managed VM deployment for Server-Side GTM containers / Node.js instances), provisioning is handled via the Client Area and is subject to a Non-Refundable Setup Fee and Prorated Billing rules pursuant to the Billing Policy (DOC-011).

8. Data Protection, International Transfers & Security

8.1. GDPR Alignment & Client Area Automations: Where tracking data constitutes personal data, processing is governed by the Privacy Policy (DOC-005). Identification data and consent logs within the Client Area align with automated data retention and anonymization workflows (WHMCS Data Retention Automation) pursuant to DOC-005 and DOC-010, ensuring no identifiers persist following lawful account deletion.

8.2. Transmission Security & NIS2 Incident Protocol: Data transmissions are secured using TLS 1.3 (HTTPS) encryption pursuant to DOC-012. Any unauthorized script tampering, integrity violation, or malicious injection (Tag Hijacking in GTM) is classified as a Security Incident, triggering NIS2 notification timelines (Early Warning within 24 hours / Full Notification within 72 hours) pursuant to DOC-012.

8.3. Cross-Border Data Transfers: Enabling third-party cookies (such as Google LLC) upon consent involves data transfers to the United States. These transfers are executed lawfully under the EU-U.S. Data Privacy Framework adequacy decision and approved Standard Contractual Clauses (SCCs).

9. Governance & Lifecycle Framework

9.1. Change Management (Governance): Any modification to this Policy is governed by the Master Constitution framework (DOC-001):

  • Major Changes (vX.0): Regulatory shifts or new tracker categories entail 30 days prior notice via the Client Area and CMP re-prompting for renewed consent.
  • Minor Changes (v1.X): Immediate publication with metadata header updates.

9.2. Prevailing Language: This document represents the official English translation (DOC-006-EN). In the event of any linguistic, structural, or interpretative discrepancies between language versions, the Greek Master Version (DOC-006-GR) strictly prevails and is legally binding.

10. Contact & Support (Remote-First Protocol)

For any inquiry or exercise of data subject rights concerning tracking technologies, communication is conducted exclusively through the Provider's digital channels:

  • E-Mail (DPO / Privacy Inquiries): contact@prootzos.com
  • Client Area: Electronic Support Ticket submission to the "GDPR & Data Protection" department.
  • Telephone Support Line: +30 2621 121 373 (Business days during operational support hours)
Subscribe to Our Newsletter

Enter your email to receive the latest updates.

By submitting this form: You agree to the processing of the submitted personal data in accordance with Prootzos Online Privacy Policys.