Cookie Policy

Cookie Policy - ExValu

Jump to: What are cookies Our cookies Third parties Fonts Managing cookies Impact of blocking Your rights Germany-specific Contact

Quick summary

Essential cookies keep the website working - always active, no consent required
Analytics cookies (Google Analytics) require your explicit consent before activation
No marketing or retargeting cookies are currently deployed on this website
We use Bunny Fonts (EU-hosted, Netherlands) - not Google Fonts - to eliminate third-party font IP transfers
You can withdraw consent and manage cookies at any time via our cookie banner or browser settings
We are in the process of migrating from our current consent banner to a Cookiebot-managed banner to fully align with the March 2025 Hanover ruling on equal-prominence reject options

Section 1

What Are Cookies

Cookies are small text files stored on your device (computer, smartphone, or tablet) when you visit a website. They allow the website to remember your actions and preferences over a period of time, so you do not have to re-enter them each time you visit.

This policy uses "cookies" as an umbrella term covering cookies, local storage, session storage, and similar tracking technologies. We describe each technology actually in use on this website specifically. We do not describe hypothetical or future technologies.

Cookie duration

Session cookies are deleted automatically when you close your browser. Persistent cookies remain on your device until they expire or you delete them. All cookies used by ExValu have defined expiration dates. We do not set indefinite cookies.

Legal framework in Germany

Cookie use on this website is governed by TDDDG §25 (Germany's implementation of the EU ePrivacy Directive) and GDPR Article 6. Under TDDDG §25, non-essential cookies require explicit, prior consent before being set or read. No non-essential cookies are activated before you give consent.

The German Consent Management Ordinance (EinwV), effective April 1, 2025, provides for centralised consent management services. ExValu currently operates a standard cookie banner compliant with TDDDG and GDPR and is migrating to a Cookiebot-based consent management platform (see Section 3). We will monitor developments in certified consent management services and update our approach as the landscape evolves.

Section 2

Cookies We Use

ExValu uses cookies in two categories. We only describe cookies actually deployed on this website. We do not list speculative or future cookies.

🔒

Strictly Essential Cookies

Always active - no consent required - cannot be disabled

Art. 6(1)(f) GDPR - Legitimate Interest

These cookies are necessary for the website to function. Without them, forms, calendar booking, and security protections will not work. They do not track your behaviour for marketing purposes and are not shared with third parties for advertising.

Cookie name	Provider	Purpose	Duration
ghsess / PHPSESSID	GoHighLevel	Maintains your session as you navigate forms and booking flows	Session
__cf_bm	Cloudflare	Bot management and DDoS protection	30 minutes
cookieconsent_status	ExValu	Stores your cookie consent preferences so we do not ask again	12 months
csrf_token	ExValu / GHL	Prevents Cross-Site Request Forgery (CSRF) attacks	Session
form_progress	ExValu / GHL	Saves progress in multi-step forms to prevent data loss	24 hours

Cannot be disabled: Disabling essential cookies will prevent forms, booking, and security protections from functioning. These cookies do not require consent under TDDDG §25(2) as they are strictly necessary for the explicitly requested digital service.

These cookies help us understand how visitors use the ExValu website so we can improve it. They are set by Google Analytics. They are not activated unless and until you give explicit consent via the cookie banner. Legitimate interest cannot be used as the lawful basis for Google Analytics because Google reserves the right to use the data for its own purposes.

Cookie name	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique visitors using an anonymised ID	2 years
_ga_[ID]	Google Analytics	Maintains session state for the Analytics property	2 years
_gid	Google Analytics	Distinguishes unique visitors within a 24-hour window	24 hours
_gat	Google Analytics	Throttles request rate to Google Analytics servers	1 minute

What we track with analytics

Pages visited and time spent on each page
How you arrived at the website (search engine, direct, referral)
Device type (desktop, mobile, tablet) and browser type
Geographic location at country and city level only
Interactions such as button clicks and form starts

What we do NOT track

Your name or email address (unless you submit a form separately)
Precise location, street address, or GPS coordinates
Cross-site browsing behaviour beyond exvalu.com
Any special category personal data

GA4 and IP addresses: ExValu uses Google Analytics 4 (GA4), which does not log or store full IP addresses. Session data is aggregated by Google server-side and approximate geographic location is derived at country/city level only. Data retention is set to 14 months. Google Analytics is only activated after your explicit consent.

Opt-out: Decline analytics via our cookie banner at any time. Alternatively: Google Analytics Opt-out Add-on.

Section 3

Third-Party Services on This Website

Some services embedded in the ExValu website involve third-party data processing. The following describes all third-party services currently active or planned, and their cookie or data implications.

⚙

GoHighLevel (GHL)

Essential

Our website and form platform. Sets essential session cookies (ghsess / PHPSESSID) for form functionality and calendar booking. Data processed in USA / EU data centres. GDPR-compliant. DPA in place. Privacy policy

☕

Cloudflare

Essential

Content delivery network and DDoS protection. Sets the __cf_bm cookie for bot management (30 minutes, session-level). No personal data retained beyond the session. EU data centres available. Privacy policy

📈

Google Analytics (GA4)

Analytics - consent required

Website usage analytics. Only activated after your explicit consent. GA4 does not store full IP addresses; session data is aggregated server-side. Data retained for 14 months. Transfers to USA covered by EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses. Privacy policy | Opt-out

🏮

Cookiebot (Cybot A/S)

Consent management - transitioning

EU-based consent management platform (hosted in Denmark) being deployed to replace the current GHL native cookie banner. Cookiebot will provide a compliant TDDDG §25 banner with an explicit one-click "Reject All" option at equal prominence to "Accept All", satisfying the March 2025 Hanover Administrative Court ruling. DPA in place with Cybot A/S. Once live, Cookiebot will set a strictly essential consent-storage cookie to remember your preferences.

🎬

Synthesia (avatar videos)

No cookies

AI avatar videos on the website are hosted and delivered via GoHighLevel's native video player. Synthesia does not set cookies on ExValu visitors. No personal data about website visitors is transmitted to Synthesia. Synthesia is UK-based and benefits from the UK adequacy decision under GDPR Article 45.

▶

YouTube (video embeds)

Media - consent required

Selected pages embed YouTube videos using the privacy-enhanced no-cookie mode (youtube-nocookie.com). Videos are not loaded until you give consent via our cookie banner. Once loaded, YouTube may set cookies and transmit your IP address to Google. Transfers to USA covered by EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses. Privacy policy

Section 4

Fonts - Why We Use Bunny Fonts, Not Google Fonts

This deserves its own section because it is a compliance decision with a specific legal reason.

Many websites use Google Fonts, a free font service. However, embedding Google Fonts causes your browser to connect to Google's servers on every page load, transmitting your IP address to Google in the USA. A Munich Regional Court ruled in January 2022 that this constitutes a GDPR violation, because the IP transmission to Google serves no necessary purpose when fonts can be hosted locally, and therefore has no valid lawful basis. The court threatened continued violations with fines of up to €250,000 per occurrence.

ExValu uses Bunny Fonts, hosted by bunny.net in the Netherlands (EU). Bunny Fonts does not log or retain IP addresses, processes no personal data about website visitors, and requires no consent. Your browser loads fonts from an EU server with no data transmitted to Google or any US entity.

No consent required for fonts. Font loading on ExValu does not involve any cookie, tracking technology, or personal data transfer requiring consent under TDDDG §25 or GDPR. This is a deliberate privacy-first infrastructure decision.

Section 5

Managing Your Cookie Preferences

🏷 Cookie Banner (recommended)

On your first visit, a banner presents your options. You can currently choose "Accept all" or "Accept essential" (which declines all non-essential cookies). Your preferences are saved for 12 months.

To change your preferences at any time: click "Cookie Settings" in the footer of any page. Your previous choices are cleared and the banner reappears.

Transitioning to Cookiebot: The current GHL native banner offers "Accept essential" as the reject path. To fully align with the March 2025 Hanover Administrative Court ruling on equal-prominence "Reject All" buttons, we are deploying Cookiebot (see Section 3). Until that migration completes, clicking "Accept essential" functions as rejection of all non-essential cookies, and no analytics or marketing cookies are set.

🌐 Browser Settings

You can manage cookies directly in your browser. Blocking all cookies will disable essential site functionality including forms and booking.

Chrome: Settings - Privacy and Security - Cookies
Firefox: Settings - Privacy & Security - Cookies and Site Data
Safari: Preferences - Privacy - Manage Website Data
Edge: Settings - Cookies and site permissions
iOS Safari: Settings - Safari - Block All Cookies
Chrome Mobile: Settings - Site settings - Cookies

🚫 Analytics Opt-Out

To opt out of Google Analytics specifically (even if you have consented via our banner):

Google Analytics Opt-out Browser Add-on
Enable Do Not Track in your browser (we honour DNT signals for analytics)

🖊 Email Request

To withdraw consent or request manual removal of tracking for your contact, email:

[email protected]
Subject: "Withdraw Cookie Consent"

We will manually disable analytics tracking. Existing anonymised data already collected is retained per the 14-month Google Analytics setting unless you also request full data erasure under GDPR Article 17.

Section 6

Impact of Blocking Cookies

Feature	Block all cookies	Block third-party only	Decline analytics only
General page browsing	Works	Works	Works
Multi-step forms	Will not work	Works	Works
Calendar booking	Will not work	Works	Works
Cookie preference memory	Resets every visit	Saved	Saved
Google Analytics	Disabled	Disabled	Disabled
Security (Cloudflare)	Reduced protection	Active	Active

Recommendation: Accept essential cookies and decline analytics if you prefer not to be tracked. Forms, booking, and all core site functionality work without analytics consent.

Section 7

Your Cookie Rights Under GDPR and TDDDG

Right to withdraw consent (GDPR Article 7(3))

You can withdraw consent for analytics cookies at any time - via the cookie banner, browser settings, or by emailing us. Withdrawal does not affect the lawfulness of processing before you withdrew consent. Analytics cookies will stop being set immediately on withdrawal.

Right to object (GDPR Article 21)

You can object to processing based on legitimate interest (applicable to essential cookies) at any time by emailing [email protected]. Note that objecting to essential cookies will prevent the website from functioning correctly, as those cookies are necessary for the service you have requested.

Right to erasure (GDPR Article 17)

You can request deletion of personal data collected via cookies. For Google Analytics, data is automatically deleted after 14 months. To request earlier deletion, email [email protected] with "Erasure Request - Cookie Data" in the subject line. We will respond within 30 days.

No automated decision-making

ExValu does not use cookies for any automated decision-making with legal or similarly significant effects. Cookie data does not affect your ability to use our services, book a call, or receive a proposal.

Right to complain

If you believe ExValu has mishandled cookie consent, you can lodge a complaint with the relevant supervisory authority. For Germany, ExValu's competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany - lda.bayern.de, [email protected]. For the UK: Information Commissioner's Office at ico.org.uk/make-a-complaint. Residents of other EU/EEA member states may also complain to their national data protection authority.

Section 8

Germany-Specific Cookie Requirements

TDDDG §25 - the German cookie consent rule

Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) is Germany's implementation of the EU ePrivacy Directive. It requires explicit, prior consent before storing or reading any non-essential cookie or tracking technology on a user's device. This applies to any company offering goods or services in Germany, regardless of where the company is located.

ExValu complies with TDDDG §25 by: activating no non-essential cookies before consent; providing a clear consent banner on first visit; making withdrawal as easy as acceptance; and honouring browser Do Not Track signals for analytics cookies.

Consent Management Ordinance (EinwV) - April 2025

The EinwV, effective April 1, 2025, creates a framework for certified consent management services that allow users to set their cookie preferences once across participating websites. ExValu's standard cookie banner currently satisfies TDDDG §25 and GDPR consent requirements. The EinwV does not make adoption of certified services mandatory. ExValu will evaluate certified services as they become available and update this policy accordingly.

Hanover Administrative Court ruling - March 2025

The Hanover court ruled that cookie banners must provide a "reject all" button that is equally prominent and accessible as the "accept all" option. Designs that make rejection harder than acceptance are invalid.

Current compliance posture and transition plan: ExValu's current GHL native banner offers "Accept all" and "Accept essential" as equally prominent, single-click options. The "Accept essential" button functionally rejects all non-essential cookies and no analytics or marketing cookies are set when chosen. To provide fully explicit alignment with the Hanover ruling, including an explicit "Reject All" button labelled as such, ExValu is migrating to the Cookiebot consent management platform (see Section 3). Until migration is complete, ExValu takes the conservative position that "Accept essential" is equivalent to reject-all in practical effect and that no lawful-basis risk arises under TDDDG §25 because no non-essential cookies are set without explicit opt-in.

Google Fonts court ruling - Munich, January 2022

The Munich Regional Court ruled that embedding Google-hosted fonts on a website violates GDPR because it transmits visitor IP addresses to Google servers in the USA without a valid lawful basis. ExValu uses Bunny Fonts (EU-hosted) specifically to comply with this ruling. See Section 4 for full details.

Cookie Questions

For questions about this Cookie Policy, to withdraw consent, or to request data deletion:

ExValu - Karl zu Ortenburg
Gstaller Weg 36, 82166 Grafelfing, Federal Republic of Germany
[email protected] | +49 (0) 89 83 999 089

Subject line for cookie withdrawal: "Withdraw Cookie Consent - [Your Name]"
Subject line for erasure request: "Erasure Request - Cookie Data - [Your Name]"

Version history: v1.0 February 11, 2026 (initial, branded AIHub3). v2.0 April 1, 2026: Complete rebuild. Brand updated to ExValu. Google Fonts removed and replaced with documented Bunny Fonts section reflecting Munich court ruling. Speculative cookies removed (preference cookies, Facebook Pixel, Google Ads, Calendly not currently deployed). EinwV (April 2025 ordinance) and March 2025 Hanover "reject all" ruling added. Marketing cookie section updated to reflect none currently deployed. Mobile app section removed. Policy length reduced by removing speculative content. All AIHub3 contact details replaced with ExValu contacts. v2.1 April 20, 2026 (current): §7 supervisory authority corrected from BfDI (federal, applies to public bodies and telecoms) to BayLDA (Bayerisches Landesamt für Datenschutzaufsicht, Bavaria's state data protection authority) with full address and contact details - this is ExValu's competent supervisory authority as a Bavarian sole proprietor. "IP anonymisation enabled" language replaced with accurate description of GA4 behaviour (GA4 does not log full IP addresses; data is aggregated server-side) - the configurable IP anonymisation toggle was removed by Google mid-2023. Synthesia location corrected from EU to UK (adequacy decision). Cookiebot added to §3 Third-Party Services as the planned consent management platform (EU-hosted, Denmark, Cybot A/S, DPA in place). §5 Cookie Banner box and §8 Hanover ruling section updated to honestly describe the current GHL native banner (Accept all / Accept essential) and the documented transition plan to Cookiebot for full Hanover-ruling compliance with an explicit labelled "Reject All" button.

Legal review note: This policy has been prepared by ExValu and reviewed for consistency with GDPR, TDDDG, and current German court rulings. It has not been formally reviewed by a qualified German data protection lawyer. That review is pending.