Cookie Policy | Q-VALIS

1. About this Policy This Policy explains the cookies and similar browser technologies used by Q-VALIS, operated by IC GLOBALTEST OOD. It applies to the Q-VALIS website and services. For information about the processing of personal data, including the controller, purposes, legal bases, recipients and individual rights, see the Privacy Notice at /privacy. Privacy enquiries may be sent to privacy@q-valis.com. Cookies are small records stored by a browser and sent with relevant website requests. Browser sessionStorage holds information for a particular website and browser tab/session. These technologies can have different purposes; their classification depends on their actual use, not their name. Q-VALIS's professional/business-use model does not remove applicable cookie or privacy requirements. 2. Authentication cookie Q-VALIS uses qvalis_session to authenticate the signed-in person and maintain authorised account and service access. It contains an opaque session token, not the person's password. It is a first-party, host-only cookie with Path=/, HttpOnly and SameSite=Lax. Secure is set when the site is accessed over HTTPS. For a normal login, the cookie has no persistent Max-Age and is a browser-session cookie; the corresponding server session is valid for up to 12 hours. When the user chooses remembered login, the cookie and server session last up to 30 days. The current account-activation sign-in also creates a session lasting up to 30 days. Sessions may end earlier through logout, revocation or security action. Browser session-restoration settings can affect when session cookies are physically removed, but cannot extend server-side validity. Logout expires qvalis_session and removes the corresponding server session. Blocking this cookie prevents normal sign-in and protected account/Course access. 3. Temporary technical navigation and recovery storage The website framework conditionally uses these first-party sessionStorage keys: __vinext_hard_navigation_target__ — stores a navigation target to prevent repeated hard-navigation/reload loops. __vinext_rsc_initial_reload__ — stores the current route for one-time recovery when initial page-data loading fails. These values can contain a route or URL, including its query string. They support delivery and recovery of the page the visitor requests; they are not used for analytics, advertising or marketing. The framework removes them during normal initialisation or recovery handling. Otherwise they normally expire with the browser tab/session, subject to browser session-restoration behaviour. They do not have a separate fixed-day retention period. Blocking sessionStorage can prevent automatic navigation recovery; it does not authorise tracking or create marketing consent. 4. Course state and removal of the former learning cache Q-VALIS does not persist Course progress or module quiz results in localStorage or IndexedDB. Learning progress, partial module quiz results and module completion are associated with the learner's authorised Course lifecycle on the server. Temporary in-memory interface state is lost when the page is closed; saved server-side results are restored after authenticated access. Earlier staging versions used local learning-cache keys beginning qvalis-learning-v2: or gt-module-. The current website removes the former learning keys when loaded, without using their values as evidence of achievement. Removal depends on the browser allowing storage access; a browser that has not revisited the site may still contain old keys, which can also be removed through browser settings. The current Course player does not read or recreate that cache. Logout additionally requests browser storage clearing where supported. 5. Necessary technologies and consent The first-party technologies described in Sections 2 and 3 are used only for authentication, authorised access and technical delivery/recovery of the service requested by the user. Q-VALIS does not request optional-cookie consent for these necessary functions and does not display an Accept All / Reject All cookie banner for them. Q-VALIS does not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, Hotjar, Microsoft Clarity, advertising trackers, behavioural profiling or session replay in this launch architecture. It does not introduce optional persistent learning storage or email open/click tracking pixels. Marketing communication preferences are separate from cookie consent. Before enabling any future optional technology that requires consent, Q-VALIS will provide the relevant information and consent controls and will not enable that technology before any required consent is obtained. 6. External hosted payment pages The current Q-VALIS checkout does not embed Stripe.js or the PayPal JavaScript SDK. When the customer chooses the relevant payment method, Q-VALIS redirects the browser to a Stripe- or PayPal-hosted payment page. Those external provider pages may use their own cookies and similar technologies under the provider's own privacy/cookie information and controls. This Policy does not assert a fixed list of provider-side cookie names or durations. Returning from the payment page does not subscribe the customer to Q-VALIS marketing or enable optional Q-VALIS tracking. 7. Browser controls You can use browser settings to inspect, block or remove cookies and website storage. Removing authentication cookies signs you out; blocking necessary authentication or navigation storage can prevent protected access or recovery functions. Clearing browser storage does not itself erase server-side orders, learning progress, certificates or other records. Personal-data rights and applicable retention are explained in the Privacy Notice. 8. Changes Q-VALIS will update this Policy when the technologies or their purposes materially change. Each material revision has its own version and version date, with historical evidence preserved. Information and any required prior consent will be provided before optional consent-requiring technologies are introduced.