Cookie policy
In effect from: 2026-07-20
This policy explains what gets stored on your device when you visit m2cena.lv, why it happens and how long it stays there. We wrote it so that it can be read without a law degree.
The short, honest version. When you open our site, exactly one cookie is stored in your browser — the one without which the site does not work. We do not use Google Analytics. There is not a single advertising or third-party analytics script on our site. No other company reads data from your browser while you are with us. We count visits only if you switch that on yourself — on our own server and without a cookie (section 4). Cookies that require your consent are not loaded until you have given it.
1. General information
SIA "m2cena", registration No. 40203754061, legal address: Rīga, Viestura prospekts 12 - 21, LV-1034, e-mail: info@m2cena.lv, phone: +371 28632825, +371 29151476, website: m2cena.lv (hereinafter — we), is committed to protecting the privacy of the site's visitors and to explaining clearly which technologies the site uses.
This policy applies to the whole of m2cena.lv. For more on the processing of personal data, please see our Privacy Policy.
2. What cookies are
Cookies are small text files that your browser stores on your computer, smartphone or tablet when you visit a website. They let the site remember that it is you — for example, that you are signed in or that you chose a particular language.
An important nuance: the law does not speak about "cookies" but, more broadly, about storing or reading any information on your device. The same rules therefore apply to other technologies too, such as the browser's session storage (sessionStorage) and tracking pixels. This policy discloses those as well — and does not call them cookies when they are not cookies.
3. Purpose and legal basis
Cookies on our site serve two purposes:
- to make the site work at all — so that you can sign in, reach the payment step safely and read the site in the language you chose;
- to remember the choices you made yourself.
The legal framework in Latvia is Section 7.¹ of the Informācijas sabiedrības pakalpojumu likums (Law on Information Society Services), "Informācijas uzglabāšana galiekārtā" — "Storage of information on terminal equipment" — which transposes Article 5(3) of Directive 2002/58/EC. What consent must look like is governed by the General Data Protection Regulation (GDPR).
Two rules follow from this, and we observe both:
Necessary cookies do not require consent. The law provides an exemption for cookies that are strictly necessary to deliver a service you yourself requested. Without them the site cannot do what you expect of it — keep you signed in, or protect a form against forged requests. These cookies do not follow you across other websites and are not used for advertising.
For everything else, consent is the only basis. For analytics and marketing cookies we cannot rely on "legitimate interests" — outside the exemptions, consent is the only lawful basis for using them. That is why they are not loaded until you have actively pressed a consent button.
4. Types of cookies on our site
Necessary cookies keep the site working and secure. No consent is requested (see section 3). They cannot be switched off without breaking the site.
The sign-in cookie lets you stay signed in after closing the browser. It is created only if you choose it yourself by ticking the "Remember me" box on the sign-in form. The box is never pre-ticked.
Analytics cookies — we do not use any. There is no Google Analytics, no advertising network and no third-party analytics platform on our site, and no analytics script runs in your browser.
Analytics — only with your consent. We do measure how the site is used, but only after you switch Analytics on in the cookie banner. Until you do, nothing is recorded; if you switch it back off, recording stops.
The measurement runs entirely on our own server and does not touch your device. When a page is delivered we record the page address, the time, a shortened IP address (the last part is discarded, so it does not identify a specific connection), the browser description and — if you are signed in — your account. Sessions are recognised from the shortened IP address and the browser description, not from an identifier stored on your device. The data stays with us, is used only to see how many people use the site and which pages they use, and is deleted automatically after 12 months (Privacy Policy, section 6).
Marketing cookies — none are currently in use. If we introduce them in future (for example the Meta Pixel, to understand whether our advertising works at all), they will be loaded only after your explicit consent in the cookie banner. This list will be extended before they start operating — not afterwards.
Your appearance and view choices are not stored in cookies at all — they live in the browser's session storage and disappear with the session (see section 5.3).
5. List of cookies used on the site
5.1. Necessary cookies (no consent requested)
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
_web_session |
Maintains your session: remembers that you are signed in and carries the security token (CSRF) that protects against requests forged in your name. For signed-in users the session closes after 30 minutes of inactivity | Session — deleted when you close the browser | None |
cookie_consent |
Stores your choice from the cookie banner, so that we do not ask again and so that we honour your refusal. Created only when you make a choice in the banner yourself — while there is no banner (see section 6), it is not created | 6 months | None |
5.2. Sign-in cookie (only if you choose it)
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
remember_user_token |
Lets you stay signed in after closing the browser. Created only if you tick "Remember me" on the sign-in form | 2 weeks from the moment you tick it; the period is not extended automatically. Signing out deletes the cookie immediately | None |
5.3. Session storage (sessionStorage) — this is not a cookie
These values are not cookies, but the law is technology-neutral: Section 7.¹ of the Informācijas sabiedrības pakalpojumu likums and Article 5(3) of Directive 2002/58/EC speak about storing any information on your device, and therefore cover browser storage too. That is why we disclose them here just like cookies. Each of them is stored only when you press the corresponding control yourself, contains no identifier of any kind, and disappears with the session.
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
theme |
Remembers whether you chose the light or the dark appearance. Stored only when you press the appearance toggle yourself | Session — deleted when you close the tab or the browser | None |
txn-view |
Remembers whether you view the transactions list as cards or as a table. Stored only when you press the view toggle yourself. Appears only for signed-in users in the transactions section | Session | None |
txn-panel-open |
Remembers whether the transactions filter panel was left open or closed. Stored only when you press the "Filters" button yourself. Appears only for signed-in users in the transactions section | Session | None |
5.4. Marketing cookies
Currently — none at all. This section will be filled in if and when any appear, and only after consent.
5.5. When you go to pay
Payments are processed by the payment platform makecommerce.lv, owned by Maksekeskus AS. When paying, you are redirected to the Maksekeskus AS environment — the payment platform's cookies are not placed on our site and the platform is not embedded in our pages. Cookies used by Maksekeskus AS in its own environment are covered by the Maksekeskus AS privacy policy.
5.6. Why there is no third party on the list
This is not an assumption but a technical setting of our site: the site is configured to load scripts only from its own domain and does not allow foreign pages to be embedded. In practice this means a third-party tracker cannot fire on our pages even by accident.
6. The cookie banner and consent
As long as the site uses only cookies that do not require consent (see sections 3 and 5), we do not show a consent pop-up. This is not an oversight but a deliberate choice: the guidance of the Data State Inspectorate states that a site carrying only cookies covered by the exemption need not display a pop-up notice — and asking for "consent" to something the law does not require consent for is misleading. A banner asking permission where no permission is needed would only get in your way.
If and when we introduce storage that does require consent (see section 4 on marketing), a cookie banner will appear. It will explain which cookies the site uses and let you choose what you allow. It will work like this:
- Nothing is loaded in advance. Cookies that require consent are not created until you have made an active choice. Silence, ignoring the banner, scrolling or continuing to browse are not consent.
- Refusing is as easy as agreeing. The refuse and the agree buttons are equally visible — same size, same colour, on the same level. Refusal is not hidden away under "Settings".
- No box is pre-ticked. Neither in the banner nor in the detailed settings.
- Choice by purpose. Each purpose has its own separate switch — consenting to one purpose does not mean consenting to another.
- Refusing does not limit your use of the site. If you refuse, you can read the site, run analyses and make purchases exactly as before. The only difference is that we will not see the corresponding statistics.
In line with section 11, this policy will be extended before that happens — not afterwards.
7. Refusing cookies
You can refuse all cookies except the necessary ones — without those the site simply does not work (for example, you will not be able to stay signed in).
At present there is nothing to refuse: the site uses only necessary cookies and the choices you made yourself (see section 5). Once the cookie banner appears (see section 6), there will be two ways to refuse: in the banner itself, or at any later time by opening the cookie settings (see section 8). Either way, you can always block or delete cookies in your browser (see section 9) — that works today too.
8. Withdrawing consent
Consent can be withdrawn at any time, and it is as easy as it was to give. While no consent is required, there is nothing to withdraw — which is why the footer currently carries neither a consent button nor settings that would do nothing. As soon as the cookie banner appears (see section 6), the footer will carry a "Cookie settings" button on every page: opening it will show your current choice and let you change it or withdraw it entirely.
If you withdraw consent, we stop using the cookies concerned from that point on. Withdrawal does not affect the lawfulness of processing carried out while the consent was in force.
The sign-in cookie (section 5.2) needs no separate banner: it is enough to sign out, or not to tick "Remember me" next time.
9. Managing cookies in your browser
Regardless of the settings on our site, you are fully in control of your browser. Each browser has a "Privacy" or "Privacy settings" section where you can:
- view and delete cookies that are already stored;
- block cookies for specific sites or for all sites;
- have cookies deleted automatically when you close the browser.
Instructions are in the support pages of your browser: Google Chrome, Mozilla Firefox, Safari, Microsoft Edge.
The choices stored in session storage (section 5.3) do not need deleting separately — they disappear on their own when you close the tab or the browser. If you nevertheless want to remove them at once, you can do it in the same place: the browser function that clears site data ("Clear site data").
Please note: if you block all cookies, you will not be able to sign in or complete a purchase — that is not a restriction we impose but a technical prerequisite.
10. Your rights and complaints
If you believe we have infringed your rights, write to us first at info@m2cena.lv — that is usually the fastest route, and we do reply.
You also have the right to lodge a complaint with the supervisory authority — the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv), which supervises both the processing of personal data and the use of cookies in Latvia.
11. Changes to this policy and contacts
We may change this policy. Any changes will be published on this page together with the date of entry into force. If new cookies appear on the site, the list in this policy will be extended before they start operating.
If you have questions, write to info@m2cena.lv or call: +371 28632825, +371 29151476.
In case of any conflict, the Latvian version of these terms shall prevail.