Cookie Policy
Effective from 2026-11-10 · Version 2026-11-10.2
This Cookie Policy applies to care.markbass.it, operated by Markbass S.p.A., and describes the cookies and other tracking technologies used for the operation of the shop, visitor analytics and advertising activities.
This notice supplements the Privacy Policy available on care.markbass.it, which provides further information on the processing of personal data.
1. Data controller and contact details
The Data Controller is Markbass S.p.A., with its registered office at Via Po 52, 66020 San Giovanni Teatino (CH), Italy, VAT number IT01927720696, Italian tax code 01445460684.
For information on the processing of personal data and to exercise your rights, you may write to privacy@markbass.it or to the registered office address. The Data Controller’s certified email address (PEC) is parsek@emailcertificatapec.it.
The Data Protection Officer (DPO) is lawyer Flavia Ciccotelli, who can be contacted at flavia.ciccotelli@we-advise.it.
2. Cookies and other tracking technologies
Cookies are small text files that websites visited by users store on their devices and may read during browsing or on subsequent visits. For example, they may maintain a login session, remember the items in a shopping cart or record how a website is used.
Tracking technologies may also include pixels, scripts, identifiers and similar technologies that collect information about interactions with the website or access information on the device.
Cookies may be set by the website visited or by third-party domains. The list of technologies identifies their providers and domains. Cookies may also be session cookies, which expire at the end of the browser session, or persistent cookies, which remain stored until their scheduled expiry or deletion.
3. Purposes and consent
Cookies and technologies strictly necessary for the transmission of a communication or the provision of a service expressly requested by the user do not require consent, pursuant to Art. 122 of Italian Legislative Decree 196/2003. Where necessary for the function requested, this category includes technologies for authentication, the shopping cart, security and storing cookie preferences.
Technologies used for statistical purposes that do not qualify for the technical exemption, or for advertising or profiling, require the user’s prior consent. Art. 6, paragraph 1, letter a), of Regulation (EU) 2016/679 (GDPR) applies to personal data processed on the basis of consent.
Simply browsing, scrolling through pages or accepting the Terms and Conditions of Sale does not constitute consent to the use of optional tracking technologies. Refusing these technologies does not prevent the use of shop functions that do not require them.
4. Services currently configured
The shop uses first-party WordPress, WooCommerce, WPML and Markbass Care technologies for the functions requested by visitors. Cloudflare Turnstile protects forms against spam and automated abuse. Security requests may process IP address and browser/device signals; this service is not enabled by an analytics or marketing choice.
Google Tag Manager and Meta Pixel are not currently enabled on CARE. New optional services require an updated inventory and fresh consent for the changed configuration. Available payment methods are displayed at checkout.
Google Analytics 4 measures visits to the public catalogue only after consent to Statistics. Google signals, ad personalisation and automatic form interaction measurement are disabled. Analytics is not loaded on cart, checkout, account, warranty registration or returns pages.
Cloudflare Turnstile privacy information
5. Technology inventory
The Google Analytics 4 cookies listed below are optional and require Statistics consent. The other entries are necessary technologies, used only when the corresponding function is requested. Not every entry is present on every visit. Durations are measured from creation or renewal.
| Names / storage | Purpose / provider / activation | Duration |
|---|---|---|
| wordpress_logged_in_*, wordpress_sec_* | First-party sign-in and authentication; set when signing in. WordPress / Markbass S.p.A. | Browser session; 14 days when Remember me is selected. Server-side sign-in validity without Remember me is normally 2 days. |
| wordpress_test_cookie | Cookie support test for sign-in; first party, WordPress. | Browser session. |
| wp-settings-*, wp-settings-time-* | Requested administration preferences; first party, WordPress. | 1 year. |
| wp_woocommerce_session_* | Shopping cart session; first party, WooCommerce / Markbass S.p.A. | 2 days. |
| woocommerce_cart_hash, woocommerce_items_in_cart | Cart contents and updates; first party, WooCommerce. | Browser session. |
| wp-wpml_current_language | Selected language for content and AJAX requests; first party, WPML. | 1 day. |
| mbs_serial, mbs_articolo, mbs_product_name, mbs_production_date | Device explicitly selected to check spare-part compatibility; first party, Markbass Care. | 30 days, renewed when a device is selected; removable using Remove selected device. |
| mbs_warranty_session | Secure session for the requested public registration/account form; first party, Markbass Care. | 1 day. |
| pfr_session_1 | Restricted guest access to an order or return after email verification; first party, Paco Woo Returns / Markbass S.p.A. | 2 hours. |
| care_cookie_consent | Cookie choice, configuration version and random receipt identifier; first party, Markbass S.p.A. | 6 calendar months; renewed only when saving a new choice. Configuration changes may require a fresh choice. |
| asenha_password_protection | Temporary site protection access, only while pre-launch protection is enabled; first party, Markbass S.p.A. | Browser session. |
| wc_cart_hash_* (localStorage), wc_fragments_*, wc_cart_created (sessionStorage) | Cart fragment cache and synchronisation between tabs; first-party browser storage, WooCommerce. | Session storage ends when the tab/session closes. The cart hash in local storage remains until updated or deleted; it does not contain the product list. Cached fragments are refreshed after 24 hours. |
| Cloudflare Turnstile security requests (challenges.cloudflare.com) | Anti-spam verification when a protected form is used; Cloudflare. No advertising identifier is used by this integration. | Challenge token: 5 minutes, single use. Turnstile pre-clearance cookies are not configured by this integration. |
| care_accessibility_v1 (localStorage) | First-party local storage. Remembers contrast, text size, spacing, links, focus and motion only when the visitor requests these preferences. Markbass S.p.A.; no account identifier or advertising profile. | Six months. Removed on reset, or when an expired preference is next read. |
| _ga | Google Analytics 4 distinguishes visitors for statistics. First-party cookie; provider: Google Ireland Limited. Activated only after consent to Statistics. | Up to 2 years from the most recent visit. Removed when consent is withdrawn. |
| _ga_<ID> | Google Analytics 4 maintains session state for statistics. First-party cookie; provider: Google Ireland Limited. Activated only after consent to Statistics. | Up to 2 years from the most recent visit. Removed when consent is withdrawn. |
The consent register records the random identifier, purposes selected, notice/configuration version, language and server date/time for 365 days. It does not store an IP address or WordPress account ID. WooCommerce source-attribution tracking is disabled; any legacy optional cookies recognised by CARE are removed when optional consent is absent or withdrawn.
6. Managing preferences
On the first visit, only necessary cookies and technologies are active. The banner provides the following controls:
- Accept all: authorises all optional tracking technologies described in this notice.
- Reject non-essential cookies: keeps only necessary cookies and technologies active.
- Customise: opens the panel for choosing which optional purposes and services to authorise; opening the panel does not constitute consent.
In the panel, the Necessary category remains active, while the Statistics and Marketing categories are initially disabled. You may consult details of the technologies and third parties and select your preferences. Save preferences confirms your choice, including when all optional categories remain disabled.
Accept all and Reject non-essential cookies are presented with equivalent prominence and ease of use. If no choice is made, only necessary technologies remain active. Optional tracking technologies, including the associated data requests, are not activated before consent and remain disabled after refusal or withdrawal.
The Manage cookies control in the website footer allows you to reopen the panel at any time to change your preferences or withdraw consent. Withdrawal stops subsequent activation and data collection for the optional purposes concerned.
The banner and preferences panel provide access to the website’s Cookie Policy and Privacy Policy.
You may also manage or delete cookies through your browser settings. Deleting cookies may result in the loss of saved preferences or require you to log in to your account again; blocking necessary technologies may limit the operation of the shopping cart and other functions requested.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Deleting cookies from the browser alone does not necessarily amount to withdrawing preferences stored by the website or third-party services.
7. Recipients and transfers
Markbass S.p.A. and its authorised personnel manage first-party shop data and cookie preferences. Infrastructure and IT providers may process data on its behalf under the applicable contractual arrangements. Cloudflare receives the security information needed for Turnstile under its published Turnstile Privacy Addendum. Cloudflare operates internationally; processing can involve infrastructure outside the EEA.
Google Analytics 4 receives statistics data only after consent to Statistics. Google Tag Manager and Meta Pixel remain disabled. Information about the applicable recipients, processing locations and safeguards, including a copy of the relevant transfer arrangements where applicable, can be requested from privacy@markbass.it or the DPO at flavia.ciccotelli@we-advise.it. The Privacy Policy also describes recipients involved in contractual and legal activities.
8. Data subjects’ rights
Subject to the conditions laid down in the GDPR, data subjects may request access to their personal data, rectification, erasure, restriction of processing and data portability, as well as object to processing where provided for and withdraw consent given.
Requests may be sent to privacy@markbass.it or to the DPO using the contact details above. The Data Controller responds without undue delay and, as a rule, within one month of receipt; in the cases provided for by Art. 12 of the GDPR, this period may be extended by two months, informing the data subject within the first month.
You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority. Further information is available in the Privacy Policy on care.markbass.it.
9. Updates
We update this Cookie Policy to reflect the services, tracking technologies and configurations used on the website. Where a change requires it, we will request fresh consent before activating the relevant optional processing activities.