Cookie policy
In effect from: 2026-09-03
This policy explains what gets stored on your device when you visit m2cena.lv, why it happens and how long it stays there. We wrote it so that it can be read without a law degree.
The short, honest version. When you open our site, exactly one cookie is stored in your browser — the one without which the site does not work. We do not use Google Analytics. No third-party analytics platform runs here at all. We count visits on our own server and without a cookie — anonymously, with a shortened IP address and never tied to your account (section 4). We do use two advertising tools — the Meta Pixel and Google Ads conversion tracking — and they are loaded only if you agree in the banner: until you do, neither script is on the page, and neither company learns anything about your visit, not even that it happened (sections 4 and 5.4). Cookies that require your consent are not loaded until you have given it.
1. General information
SIA "m2cena", registration No. 40203754061, legal address: Rīga, Jelgavas iela 22 - 1, LV-1004, e-mail: info@m2cena.lv, phone: +371 28632825, +371 29151476, website: m2cena.lv (hereinafter — we), is committed to protecting the privacy of the site's visitors and to explaining clearly which technologies the site uses.
This policy applies to the whole of m2cena.lv. For more on the processing of personal data, please see our Privacy Policy.
2. What cookies are
Cookies are small text files that your browser stores on your computer, smartphone or tablet when you visit a website. They let the site remember that it is you — for example, that you are signed in or that you chose a particular language.
An important nuance: the law does not speak about "cookies" but, more broadly, about storing or reading any information on your device. The same rules therefore apply to other technologies too, such as the browser's session storage (sessionStorage) and tracking pixels. This policy discloses those as well — and does not call them cookies when they are not cookies.
3. Purpose and legal basis
Cookies on our site serve two purposes:
- to make the site work at all — so that you can sign in, reach the payment step safely and read the site in the language you chose;
- to remember the choices you made yourself.
The legal framework in Latvia is Section 7.¹ of the Informācijas sabiedrības pakalpojumu likums (Law on Information Society Services), "Informācijas uzglabāšana galiekārtā" — "Storage of information on terminal equipment" — which transposes Article 5(3) of Directive 2002/58/EC. What consent must look like is governed by the General Data Protection Regulation (GDPR).
Two rules follow from this, and we observe both:
Necessary cookies do not require consent. The law provides an exemption for cookies that are strictly necessary to deliver a service you yourself requested. Without them the site cannot do what you expect of it — keep you signed in, or protect a form against forged requests. These cookies do not follow you across other websites and are not used for advertising.
For everything else, consent is the only basis. For analytics and marketing cookies we cannot rely on "legitimate interests" — outside the exemptions, consent is the only lawful basis for using them. That is why they are not loaded until you have actively pressed a consent button.
4. Types of cookies on our site
Necessary cookies keep the site working and secure. No consent is requested (see section 3). They cannot be switched off without breaking the site.
The sign-in cookie lets you stay signed in after closing the browser. It is created only if you choose it yourself by ticking the "Remember me" box on the sign-in form. The box is never pre-ticked.
Analytics cookies — we do not use any. There is no Google Analytics and no third-party analytics platform on our site, and no analytics script runs in your browser. The only foreign scripts the site loads at all are the two advertising tags described below, and only once you have allowed them.
Counting visits — anonymous, and no consent is required for it. To know how many people use the site and which pages, we record every page we deliver on our own server. The consent requirement described in section 3 does not reach this counting: nothing is stored on or read from your device, the IP address is shortened, and the record on its own does not point to a particular person.
Your account is never part of it. Even while you are signed in, the record of a page view carries no account — not with consent, not without. There is nothing to switch on here, because there is nothing being tied together.
The measurement runs entirely on our own server and does not touch your device. When a page is delivered we record the page address, the time, a shortened IP address (the last part is discarded, so it does not identify a specific connection) and the browser description. Sessions are recognised from the shortened IP address and the browser description, not from an identifier stored on your device. The data stays with us, is used only to see how many people use the site and which pages they use, and is deleted automatically after 12 months (Privacy Policy, section 6).
Marketing cookies — the Meta Pixel and Google Ads, and only with your consent. We advertise on Facebook and Instagram through Meta, and on Google through Google Ads. Both platforms need to know whether the advertising brings anyone in, and both learn it from a script on our pages. Neither reports your name, your e-mail address or anything about the property you were looking at.
The Meta Pixel is a script from Meta Platforms Ireland Limited that reports the page you opened, together with cookies it sets on your device, so that Meta can attribute the visit to a particular advertisement and later show our advertising to a similar audience. Besides page views it reports three moments: that an account was created, that a checkout was opened, and that a payment went through — the last two with the amount, because without it the advertising cannot be judged against what it earned.
Google Ads conversion tracking is the same idea at Google Ireland Limited, and it reports the same three moments, so that Google can tell which advertisement led to a registration or a payment and stop spending on the ones that lead to neither. It is not Google Analytics: no analytics property is configured, and no analytics script runs on our site (see above in this section).
Both are loaded only after you agree in the banner. Until then neither script is on the page, none of the cookies listed in section 5.4 exists, and neither company is told that your visit happened at all. If you withdraw the consent, we reload the page without them — an injected script cannot be unloaded any other way — and the cookies they already left can be removed in your browser (section 7). What this means for your personal data, including that it reaches Meta and Google and may leave the EU, is in the Privacy Policy.
Your appearance and view choices are not stored in cookies at all — they live in the browser's session storage and disappear with the session (see section 5.3).
5. List of cookies used on the site
5.1. Necessary cookies (no consent requested)
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
_web_session |
Maintains your session: remembers that you are signed in and carries the security token (CSRF) that protects against requests forged in your name. For signed-in users the session closes after 30 minutes of inactivity | Session — deleted when you close the browser | None |
cookie_consent |
Stores your choice from the cookie banner, so that we do not ask again and so that we honour your refusal. Created only when you make a choice in the banner yourself (see section 6) — until you do, it does not exist | 6 months | None |
5.2. Sign-in cookie (only if you choose it)
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
remember_user_token |
Lets you stay signed in after closing the browser. Created only if you tick "Remember me" on the sign-in form | 2 weeks from the moment you tick it; the period is not extended automatically. Signing out deletes the cookie immediately | None |
5.3. Session storage (sessionStorage) — this is not a cookie
These values are not cookies, but the law is technology-neutral: Section 7.¹ of the Informācijas sabiedrības pakalpojumu likums and Article 5(3) of Directive 2002/58/EC speak about storing any information on your device, and therefore cover browser storage too. That is why we disclose them here just like cookies. Each of them is stored only when you press the corresponding control yourself, contains no identifier of any kind, and disappears with the session.
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
theme |
Remembers whether you chose the light or the dark appearance. Stored only when you press the appearance toggle yourself | Session — deleted when you close the tab or the browser | None |
txn-view |
Remembers whether you view the transactions list as cards or as a table. Stored only when you press the view toggle yourself. Appears only for signed-in users in the transactions section | Session | None |
txn-panel-open |
Remembers whether the transactions filter panel was left open or closed. Stored only when you press the "Filters" button yourself. Appears only for signed-in users in the transactions section | Session | None |
5.4. Marketing cookies (only after your consent)
Placed once you agree in the banner. Until then they do not exist.
| Name | Purpose | Retention period | Third-party access |
|---|---|---|---|
_fbp |
Identifies your browser to Meta, so that a visit can be attributed to one of our advertisements and our advertising can be shown to a similar audience | 3 months | Meta Platforms Ireland Limited |
_fbc |
Stores the advertisement click identifier (fbclid) from the link you arrived by, so that Meta can match the visit to the exact advertisement |
3 months | Meta Platforms Ireland Limited |
_gcl_au |
Lets Google Ads join a later registration or payment to the advertisement that brought you here | 3 months | Google Ireland Limited |
_gcl_aw |
Stores the advertisement click identifier (gclid) from the link you arrived by. Created only if you actually arrived through a Google advertisement |
3 months | Google Ireland Limited |
Alongside the cookies, each tag sends its platform a request containing the page address, the time and your IP address. Those transfers are part of what your consent covers — they do not happen before you allow them.
5.5. When you go to pay
Payments are processed by the payment platform makecommerce.lv, owned by Maksekeskus AS. When paying, you are redirected to the Maksekeskus AS environment — the payment platform's cookies are not placed on our site and the platform is not embedded in our pages. Cookies used by Maksekeskus AS in its own environment are covered by the Maksekeskus AS privacy policy.
5.6. Why the list of third parties is this short
This is not an assumption but a technical setting of our site: the browser is instructed to load scripts only from our own domain and from the two advertising platforms named in section 5.4, and foreign pages may not be embedded at all. Anything else — another tracker, another analytics platform, a widget that quietly phones home — cannot fire on our pages even by accident.
6. The cookie banner and consent
The banner asks about exactly what requires consent, and nothing else. The guidance of the Data State Inspectorate states that asking for "consent" to something the law does not require consent for is misleading. So the banner does not ask permission for the strictly necessary cookies (section 5.1), nor for the anonymous visit counting that runs without cookies (section 4). It asks one thing: whether to allow the two advertising tags and the cookies they set (section 5.4).
The banner explains what happens on the site and lets you choose what you allow. It works like this:
- Nothing is loaded in advance. Cookies that require consent are not created until you have made an active choice. Silence, ignoring the banner, scrolling or continuing to browse are not consent.
- Refusing is as easy as agreeing. The refuse and the agree buttons are equally visible — same size, same colour, on the same level. Refusal is not hidden away under "Settings".
- Nothing is pre-selected. Consent exists only once you press the agree button; opening the banner, or closing it, is not consent.
- One purpose, one question. Advertising is the only purpose left that requires asking, so the two buttons are the entire choice. Were we ever to add a second purpose, it would get its own separate control rather than being folded into this one.
- Refusing does not limit your use of the site. If you refuse, you can read the site, run analyses and make purchases exactly as before. The only difference is that we will not see the corresponding statistics.
In line with section 11, this policy will be extended before that happens — not afterwards.
7. Refusing cookies
You can refuse all cookies except the necessary ones — without those the site simply does not work (for example, you will not be able to stay signed in).
At present there is nothing to refuse: the site uses only necessary cookies and the choices you made yourself (see section 5). Once the cookie banner appears (see section 6), there will be two ways to refuse: in the banner itself, or at any later time by opening the cookie settings (see section 8). Either way, you can always block or delete cookies in your browser (see section 9) — that works today too.
8. Withdrawing consent
Consent can be withdrawn at any time, and it is as easy as it was to give. While no consent is required, there is nothing to withdraw — which is why the footer currently carries neither a consent button nor settings that would do nothing. As soon as the cookie banner appears (see section 6), the footer will carry a "Cookie settings" button on every page: opening it will show your current choice and let you change it or withdraw it entirely.
If you withdraw consent, we stop using the cookies concerned from that point on. Withdrawal does not affect the lawfulness of processing carried out while the consent was in force.
The sign-in cookie (section 5.2) needs no separate banner: it is enough to sign out, or not to tick "Remember me" next time.
9. Managing cookies in your browser
Regardless of the settings on our site, you are fully in control of your browser. Each browser has a "Privacy" or "Privacy settings" section where you can:
- view and delete cookies that are already stored;
- block cookies for specific sites or for all sites;
- have cookies deleted automatically when you close the browser.
Instructions are in the support pages of your browser: Google Chrome, Mozilla Firefox, Safari, Microsoft Edge.
The choices stored in session storage (section 5.3) do not need deleting separately — they disappear on their own when you close the tab or the browser. If you nevertheless want to remove them at once, you can do it in the same place: the browser function that clears site data ("Clear site data").
Please note: if you block all cookies, you will not be able to sign in or complete a purchase — that is not a restriction we impose but a technical prerequisite.
10. Your rights and complaints
If you believe we have infringed your rights, write to us first at info@m2cena.lv — that is usually the fastest route, and we do reply.
You also have the right to lodge a complaint with the supervisory authority — the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv), which supervises both the processing of personal data and the use of cookies in Latvia.
11. Changes to this policy and contacts
We may change this policy. Any changes will be published on this page together with the date of entry into force. If new cookies appear on the site, the list in this policy will be extended before they start operating.
If you have questions, write to info@m2cena.lv or call: +371 28632825, +371 29151476.
In case of any conflict, the Latvian version of these terms shall prevail.