1. Who we are
This Cookie Policy concerns the biis. studio and marketing website operated by Trippbo OÜ, Estonian private limited company (osaühing), registration number 17187333, VAT number EE102924068, Järvevana tee 9, 11314 Tallinn, Estonia. Contact: [email protected].
It explains cookies and similar storage and access technologies used in the website, including administrator authentication and any optional integrations that are enabled.
2. What cookies and similar technologies do
Cookies are small pieces of information a website may place on your device. Session cookies typically expire at the end of a browsing session; persistent cookies remain for a configured duration or until removed. First-party cookies are set in the context of our website, while third-party technologies may be associated with other providers.
Local storage, session storage and other device access mechanisms may be subject to similar electronic-privacy rules. Whether prior consent is required depends on the technology's actual purpose and applicable law.
3. Necessary administrator session cookie
The website's restricted content-management system uses a first-party cookie named biis_admin_session. It is used to authenticate authorised administrators and maintain the security of the admin session; ordinary visitors do not need an administrator account.
The cookie is configured to be HTTP-only, SameSite=Lax, Secure in production, and to have a maximum age of seven days. The underlying session can be revoked sooner. This cookie is necessary for the requested administrator login function and is not used for advertising.
The precise expiration and other deployed settings should be checked in the live browser and production environment.
4. Other essential technical processing
The website uses security and anti-abuse controls for public inquiry forms. These can include rate limiting, origin checks and backend technical records. A server-side security control does not necessarily create a browser cookie.
Necessary technologies may be used without consent only where the applicable exemption is satisfied, such as when the storage or access is strictly necessary to deliver a service explicitly requested by the visitor.
5. Cloudflare Turnstile
Where enabled in the deployed configuration, Cloudflare Turnstile provides anti-abuse verification for inquiry forms. Its script is loaded on the relevant form and a verification token is sent to the website, which communicates with Cloudflare for verification.
Cloudflare may process technical information and use device-access technologies according to the deployed integration. The actual storage identifiers, duration and whether any particular use qualifies for a consent exemption must be assessed against the live implementation and applicable law. See Cloudflare's relevant privacy disclosures for its independent processing.
6. Email notifications and other services
Where enabled, Resend is used to send internal notifications about enquiries after the enquiry is saved. This server-side email activity does not, by itself, establish that a Resend browser cookie is used.
Other website hosting, content and media services may process technical information, but they should not be described as setting visitor cookies unless such cookies are actually deployed.
7. Aggregate analytics
The website includes an optional first-party aggregate website measurement feature. It is disabled by default in the repository's example production configuration and can be activated only through the relevant production settings.
When activated, it records daily counts by broad public-page group and event type. The aggregate analytics table does not record a user or session identifier, browser cookie, IP address, user-agent string, email, message or personal visit history. Network requests can nevertheless appear in infrastructure logs.
The aggregate measurement feature does not set an analytics cookie in its implementation. Cookie-free measurement is not automatically exempt from every transparency or data protection obligation; the actual processing and any electronic-privacy requirements must be assessed before activation.
8. Advertising and optional tracking
The reviewed website code does not implement an advertising or behavioural remarketing cookie system. If optional analytics, advertising, social media embeds or other non-essential device-access technologies are added later, we will identify their purposes, providers and storage periods and obtain valid prior consent where the law requires it.
We do not treat continued browsing, silence or preselected options as consent.
9. Individual technology details
The browser technology specifically identified in the current website code is:
- Name: biis_admin_session
- Provider: biis. / Trippbo OÜ
- Scope: restricted administrator login
- Purpose: maintain authorised authentication
- Maximum age: seven days, unless revoked sooner
- Category: strictly necessary for the admin service
- Consent: not required where the strictly necessary exemption applies
Additional cookies or similar technologies may be used by an enabled third-party integration. These must be identified and disclosed from the live production inventory before optional device-access processing is activated.
10. Your choices
Where optional technologies requiring consent are deployed, you must be able to make an informed choice and refuse them before activation. Consent must be freely given, specific, informed and unambiguous. Optional processing cannot rely on silence or an unticked or preselected choice.
Where consent applies, you must also be able to withdraw it as easily as it was given. Any applicable consent settings control should explain the relevant categories and allow preferences to be changed. If no consent-requiring optional technologies are deployed, a non-essential cookie banner is not required merely for the administrator authentication cookie.
11. Browser controls
Most browsers allow you to inspect, block or delete stored cookies and other site data. Disabling the administrator session cookie will prevent the restricted CMS login from functioning normally. Other requested features may also depend on essential storage.
Browser settings supplement, rather than replace, any consent-management controls required of us by law.
12. Personal data and international processing
Some cookies, device-access technologies and technical requests may involve personal data. Such processing must have an appropriate GDPR lawful basis as well as satisfy any distinct electronic-privacy rules.
Providers operating outside the EEA may require a valid international transfer mechanism under GDPR Chapter V. See our Privacy Policy for controller details, relevant recipient categories, retention criteria and your legal rights.
13. Changes and contact
This Policy may change when the website's deployed technologies, providers or legal obligations change. Where new optional device-access technologies require consent, they must not be activated until the necessary information and consent are in place.
For questions or privacy requests contact Trippbo OÜ at [email protected], Järvevana tee 9, 11314 Tallinn, Estonia. The effective date appears on the approved version of this page.