Cookie Notice
Version 2026-10-13, effective 2026-10-13
Veolia cookie notice
Last updated: 13/10/2026
This cookie notice (the “Cookie Notice”) provides you with the information you need to understand how we collect, use and share your information when you visit our website www.circpack.eu (the “Website”) or use our platform application app.circpack.eu (the “Platform”). In this notice, “this website” or “our website” refers to both, unless a section states that it applies only to the Website or only to the Platform.
“Cookie Consent tool” means the Didomi cookie banner on the Website and the analytics setting in the Platform under Settings › Privacy (“Manage My Cookies”).
“Cookies” means the cookies referred to in Sections 2 and 3 below.
"We/us" means Veolia Environmental Services Belux SA, Boulevard Poincaré 78-79, 1060 Brussels, Belgium, and the company referred to in Section 1, as the case may be, acting as publisher (the “Publisher”).
"Third party" means someone who is not you or us.
“User” means visitors or users of the website or platform application.
"GDPR" refers to the General Data Protection Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
This Cookie Notice can be updated at any time in the event of changes in the applicable regulations.
Our Privacy Policy (“Privacy Notice”) can be consulted here https://app.circpack.eu/legal/privacy and will give you more details on the main following information:
a) What data is processed by Veolia and for what purposes
b) Security and data transfers outside the European Union
c) What are your rights under GDPR and how to exercise them.
The legal notice of the Website can be consulted here https://www.circpack.veolia.com/legal-notice.
The terms of use of the Platform (“Terms of Use”) can be consulted here: https://app.circpack.eu/legal/terms.
1. Who are we and how do we manage our website?
We administrate our website and platform application directly.
The type of cookies we use and their respective purposes are detailed below.
2. What are cookies?
Cookies or tracking technologies are tiny text files that are read or stored on your computer, tablet or mobile phone when you visit a website. The cookies mean that the website will remember you and how you've used the site every time you come back.
3. What cookies do we use?
3.1 - Strictly necessary cookies - always ON
Strictly necessary cookies are solely intended to allow or facilitate access to the website and platform application (app.circpack.eu). These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies are not subject to the prior authorisation of the User because they are strictly necessary to provide the service you have requested.
3.2 - Analytics on the Platform - always OFF until consent
With your consent, we measure how the Platform is used so that we can improve it, offer support, and tailor reminders and suggestions to the way you use it (for example, suggesting a tool you have shown interest in). This covers:
-
page views by signed-in users;
-
a fixed list of feature-usage events (for example “calculation completed”), counted per user;
-
page-speed measurements.
Analytics do not capture everything you click, do not record your sessions and do not collect page content or packaging data. They are not shared with advertisers or used for third-party advertising. Product analytics are processed by PostHog on EU servers (Frankfurt).
The Platform does not use marketing, advertising or social-media cookies. These are used on the Website only, as described in sections 3.3 and 3.4.
3.3 - Marketing cookies (Website only) - always OFF until consent
Marketing cookies make it possible to :
-
measure the performance of the Website
-
detect browsing problems
-
organise content
-
collect and communicate information in an anonymous way, to understand how Users who have consented to it interact with their website (sections and contents visited, path on the site) in order to establish statistics on visits and to detect potential errors.
These cookies also make it possible to identify which information on the website may be of most interest to the User, in order to adapt the website to the User, and the relevance of the messages that may be sent to the User.
The data generated by these cookies concern:
-
your visits to the Website;
-
your IP address in order to determine the city where the connection originates
.
3.4 - Preferences and social-media cookies (Website only) - always OFF until consent
Preference cookies allow our website to give you access to personalised content or targeting advertising depending on your consent.
The Publisher can also use certain services offered by third party websites to enable Users to share the content of the website on their social networks. These are in particular the share button (LinkedIn, Twitter, YouTube) and videos published on the Website (YouTube).
The aforementioned social network cookies are managed by the publisher of the social network website. The User is advised to read the aforementioned social networks’ cookies management policy on the relevant websites:
If you consent, these third-parties are able to collect your browsing data and use the data collected via their cookies for purposes they have determined in accordance with their own privacy policy.
4. Cookies inventory
You can see our cookies inventory list here:
| Category | Name of the cookie / token | Domain | Purpose | Duration | Legal basis |
|---|---|---|---|---|---|
| Strictly necessary | sb-auth-auth-token (split into sb-auth-auth-token.0, .1 … when large) | app.circpack.eu | Holds the signed-in session (access and refresh token) via Supabase. HttpOnly, sent only to our servers, refreshed while the platform is used. | Up to 400 days from last visit; deleted at sign-out | Contract performance / Legitimate interest (security) |
| Strictly necessary | sb-auth-auth-token-code-verifier | app.circpack.eu | Secures an in-progress Google or Microsoft sign-in so only the browser that started it can complete it (PKCE). | Removed when the sign-in completes or fails | Legitimate interest |
| Strictly necessary | __Host-confirm-guard | app.circpack.eu | Binds an email sign-in link or code to the browser that opened it, preventing link replay. | 1 hour | Legitimate interest |
| Strictly necessary | __Host-confirm-retry-[id] | app.circpack.eu | Allows one retry after a failed email confirmation without re-sending the link. | 2 minutes | Legitimate interest |
| Strictly necessary | cp_not_in_trial | app.circpack.eu | Trial visitors only: tells the page to explain that a trial link belongs to a different trial. | 60 seconds | Legitimate interest |
| Strictly necessary | __cf_bm | auth.circpack.eu (our sign-in service, fronted by Cloudflare) | Cloudflare bot protection on the sign-in service. Set when the browser is sent there during Google or Microsoft sign-in. | 30 minutes | Legitimate interest |
| Strictly necessary (third party, triggered by the “Sign in with Google” button) | __Host-GAPS | accounts.google.com | Google’s own sign-in page, reached when the user clicks “Sign in with Google”. Set by Google on its domain to run the sign-in; we never set, read, or receive it. Governed by Google’s privacy policy. | 2 years (as set by Google) | Legitimate interest (Google, as its own controller) |
| Strictly necessary (third party, triggered by the “Sign in with Microsoft” button) | buid, fpc, esctx, esctx-[id], x-ms-gateway-slice, stsservicecookie | login.microsoftonline.com | Microsoft’s own sign-in page, reached when the user clicks “Sign in with Microsoft”. Set by Microsoft on its domain to run and secure the sign-in; we never set, read, or receive them. Governed by Microsoft’s privacy statement. | buid, fpc: 1 month; esctx-[id]: 25 minutes; others: session | Legitimate interest (Microsoft, as its own controller) |
| Strictly necessary (human check; any storage is set by Cloudflare inside its own frame) | Cloudflare Turnstile | challenges.cloudflare.com | Confirms the visitor is a person on the public trial sign-up page only. Cloudflare states the signals collected are strictly necessary for bot detection. | Per Cloudflare’s cookie policy | Legitimate interest |
| Strictly necessary (Veolia staff only) | circpack-preview, __prerender_bypass, __next_preview_data | app.circpack.eu | Lets Veolia content editors preview unpublished country reports. Never set for customers. | 15 minutes / until preview is closed | Legitimate interest |
| Strictly necessary (browser storage, not cookies) | epr-calculator-state, recyclability-state-v3, circpack-compare, circpack.ratToEpr.handoff.v1, circpack.stateOwner, epr-step2-no-eco-reminder-dismissed, circpack:oauth-inflight, circpack.signin.pending, circpack:admin-trials-show-archived | app.circpack.eu (local storage) | Keeps in-progress calculator and assessment work across page refreshes, records which account the work belongs to, and prevents double sign-in starts. Stays on the device; contains no tracking identifier. | Until the user clears browser data | Contract performance |
| Analytics | ph_[project key]_posthog (cookie) | .circpack.eu (readable by sub-domains) | Browser identifier so a fixed list of feature-usage events (e.g. “calculation completed”) can be counted per user. No autocapture, page content, packaging data, or session recording. Sent to PostHog’s EU servers (Frankfurt). Loaded only after the signed-in user accepts. | 12 months, renewed on activity | Consent (off by default; toggle in Settings › Privacy, “Manage My Cookies”) |
| Analytics | ph_[project key]_posthog, __ph_opt_in_out_[project key] (local storage); circpack.firstCalc.captured (session storage) | app.circpack.eu | Local copy of the same identifier, the opt-in marker, and a once-per-session guard for the “first calculation” event. All removed when analytics is switched off. | Until analytics is switched off or browser data cleared; session storage until the tab closes | Consent |
| Analytics | Vercel Web Analytics and Speed Insights (no cookie set) | va.vercel-scripts.com (script) | Page-view counts and page-speed measurement. Visit identified by a temporary request hash; nothing stored on the device. Loaded only with analytics consent. | No storage | Consent |
| Not a cookie | Sentry error monitoring | None (reports go via our own /monitoring route to Sentry EU, Frankfurt) | Technical error reports so faults can be fixed. Sets no cookie and stores nothing on the device; cookies, headers and query strings are stripped before forwarding. | Not applicable | Legitimate interest (Privacy Notice, not Cookie Notice) |
| Website (www.circpack.eu) | [To be completed by the web team] | circpack.eu and third-party domains | [Analytics, marketing and social-media cookies set on the Website (for example via Google Tag Manager, LinkedIn or YouTube), to be listed from the Didomi / Tag Manager configuration] | [To be completed] | Consent (strictly necessary cookies excepted) |
5. What is the maximum duration of cookies ?
5.1 Cookie retention periods
Cookies that require your consent are retained for a maximum of thirteen (13) months from the date of your consent. Strictly necessary cookies are kept only as long as needed for their purpose; for example, the sign-in cookie lasts up to 400 days from your last visit and is deleted when you sign out. The retention periods for each cookie are detailed above.
5.2 Retention Periods for information collected via cookies
When the cookie expires, the data collected through these cookies will then either be deleted or anonymised depending on the nature of the cookie.
The information collected through cookies is kept by the Publisher for a maximum of 25 months.
6. How can you control and delete cookies ?
6.1 Cookie Consent Tool
Except for strictly necessary cookies, all other cookies are placed only with your prior consent.
On the Website, you can accept or refuse non-essential cookies through the Didomi cookie banner shown on your first visit. On the Platform, analytics are off by default and are only switched on once you accept them as a signed-in user; you can change your choice at any time under Settings › Privacy (“Manage My Cookies”), and switching analytics off removes the related identifiers stored in your browser.
Your cookie preferences, whether consent or refusal, will be stored for six months on the Website, and in your browser on the Platform until you change them or clear your browser data. You may withdraw your consent or change your preferences at any time by clicking “Manage my cookies.”
6.2 Using Your Browser
To disable cookies through your browser, follow the instructions usually located within the “Help,” “Tools” or “Edit” menus in your browser. Please note that disabling a cookie or category of cookies does not delete the cookie from your browser. Below, you can find how to control cookies from most used browsers:
Safari:
https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
Microsoft:
Google chrome:
https://support.google.com/accounts/answer/61416?hl=en&co=GENIE.Platform%3DAndroid
Firefox: click on the link to Firefox – Mozilla – Support
Warning:
Your decision whether to accept or reject cookies is itself based on one or more cookies. If you delete the cookies integrated by our website, Veolia will no longer know what you have decided and the next time you visit one of our websites you will have to make your choice again. You will also have to repeat your choice if you use other browsers or other equipment such as a tablet or smartphone.
7. How can you get some additional information or exercise your rights ?
7.1 By contacting Veolia:
For cookies installed by our website originating from us, Veolia invites Users to contact dataprotection.be@veolia.com.
To exercise your rights on the data collected by us, you should contact the Data Privacy Compliance Officer dataprotection.be@veolia.com.
7.2 By contacting the issuers directly
For cookies installed by our website but originating from our Third Parties, Veolia invites Users to contact the issuers directly via their websites to obtain information about their cookies.
To exercise your rights on the data collected via third-party cookies or for any questions about their processing, you should contact the competent publisher directly.