Serenity Cookie Policy

1. Cookie Policy

This Cookie Policy explains what cookies are, which types of cookies we use on the website www.serenity.hr (the “Site”), the purposes for which we use them, how long they are retained, and how you can manage your settings and withdraw consent.

This Policy forms an integral part of our Privacy Policy available at https://serenity.hr/en/privacy-policy and should be read together with it.

1.1. Who is the controller

The controller of personal data in connection with the use of cookies on the Site is:

• Serenity d.o.o.
• Kliški put 11, 21210 Solin, Republic of Croatia
• VAT ID (OIB): 51521935414
• Email: privacy@serenity.hr
• Website: www.serenity.hr

Serenity is a digital platform that gives users fast and anonymous access to verified psychologists and psychotherapists.

For any questions regarding cookies, personal data protection, or the exercise of your rights, you can contact us at privacy@serenity.hr.

1.2. What are cookies

Cookies are small text files that are stored on your device (computer, tablet, mobile phone) through your web browser when you visit a website. They allow the Site to recognise your device on return visits, remember your settings, and collect information about how the Site is used.

In addition to cookies in the narrow sense, we also use similar technologies such as pixel tags (e.g. Facebook Pixel), browser local storage, and third-party SDKs. In this Policy we collectively refer to all of these technologies as “cookies”.

We classify cookies by:

• duration: into session cookies, which are deleted when the browser is closed, and persistent cookies, which remain on the device until they expire or until you delete them;
• source: into first-party cookies, set by Serenity, and third-party cookies, set by our service providers (e.g. Google, Meta, Tawk.to, Better Stack).

1.3. Types of cookies we use

We use four categories of cookies on the Site. On your first visit, a pop-up (cookie banner) will be shown where you can accept or reject individual categories of cookies, except for the necessary ones, which are always active.

Necessary cookies — required for the basic functioning of the Site and cannot be disabled. They are set in particular when you sign in to your account and enable secure login, maintaining a signed-in session, security, and remembering your cookie choices. Necessary cookies also include technologies required to protect forms from abuse (Google reCAPTCHA) and to securely process payments (Stripe).

Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) or necessity for providing a service you have expressly requested (Art. 6(1)(b) GDPR). No consent is required for these cookies.

Functional cookies — enable additional features such as chat support (Tawk.to). Without them, those parts of the Site will not work properly.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 100 of the Electronic Communications Act).

Analytical cookies — anonymously record use of the Site and errors (Google Analytics, Better Stack) so we can improve the product, measure traffic, and understand how users interact with parts of the Site.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 100 of the Electronic Communications Act). Regardless of consent, limited technical data (server logs and performance metrics / Web Vitals) may be processed continuously for security, error detection, and reliable operation of the Site on the basis of our legitimate interest (Art. 6(1)(f) GDPR); this data does not contain information by which we directly identify you.

Marketing cookies — used for advertising and conversion tracking (e.g. Facebook Pixel) so we can show you more relevant content on the Site and other platforms and measure the effectiveness of advertising campaigns.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 100 of the Electronic Communications Act).

1.4. List of cookies and service providers

Below is an overview of the main cookies and technologies we use. You can check the exact list and retention periods at any time via the cookie settings on the Site.

Login session cookie (Serenity)

• Category: Necessary
• Purpose: Maintaining the user's signed-in session and security
• Duration: Session

Cookie consent (Serenity)

• Category: Necessary
• Purpose: Remembering your choice in the cookie banner
• Duration: Up to 12 months

Google reCAPTCHA (Google Ireland Ltd.)

• Category: Necessary
• Purpose: Protecting registration and login forms from abuse and automated attacks
• Duration: Up to 6 months

Stripe (Stripe Payments Europe, Ltd.)

• Category: Necessary
• Purpose: Secure payment processing and fraud prevention at checkout
• Duration: Up to 12 months

Tawk.to

• Category: Functional
• Purpose: Real-time chat support
• Duration: Up to 12 months

Google Analytics (Google Ireland Ltd.)

• Category: Analytical
• Purpose: Measuring traffic and user behaviour on the Site
• Duration: Up to 14 months

Better Stack — operational telemetry

• Category: Necessary
• Purpose: Server logs and performance metrics (Web Vitals) for security and reliable operation of the Site
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Duration: Does not set cookies on your device

Better Stack — error tracking

• Category: Analytical
• Purpose: Tracking browser errors to improve the Site
• Legal basis: your consent
• Duration: Does not set cookies on your device

Facebook Pixel (Meta Platforms Ireland Ltd.)

• Category: Marketing
• Purpose: Advertising and conversion measurement
• Duration: Up to 13 months

1.5. Data recipients and transfers outside the EEA

Some of the cookies and similar technologies we use are set by third parties (Google Ireland Ltd., Meta Platforms Ireland Ltd., Tawk.to, Better Stack, Stripe Payments Europe, Ltd.), which in that case act as separate controllers or processors in accordance with their own privacy policies.

Some of these providers may transfer data outside the European Economic Area (EEA), in particular to the United States. Such transfers take place on the basis of appropriate safeguards under Art. 46 GDPR, primarily the European Commission's standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.

Links to the providers' privacy policies:

• Google: https://policies.google.com/privacy
• Meta: https://www.facebook.com/policy.php
• Tawk.to: https://www.tawk.to/privacy-policy/
• Better Stack: https://betterstack.com/privacy
• Stripe: https://stripe.com/privacy

1.6. How to manage cookies

On your first visit to the Site, a pop-up will be shown where you can accept all cookies, reject all optional cookies, or select individual categories. You can change your settings or withdraw consent at any time via the “Cookie settings” link in the footer of the Site.

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can also control cookies through your web browser settings — block, restrict, or delete existing cookies:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/onemogucavanje-kolacica
• Microsoft Edge: https://support.microsoft.com/microsoft-edge
• Safari: https://support.apple.com/hr-hr/guide/safari/sfri11471/mac

Please note that blocking certain cookies may affect the functionality of the Site.

1.7. Your rights

In connection with the processing of personal data through cookies, you have all the rights under the General Data Protection Regulation (GDPR), including:

• the right of access to data;
• the right to rectification;
• the right to erasure (the “right to be forgotten”);
• the right to restriction of processing;
• the right to data portability;
• the right to object;
• the right to withdraw consent at any time;
• the right to lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr.

To exercise your rights, contact us at privacy@serenity.hr. You can find more information about the processing of your data in the Privacy Policy at https://serenity.hr/en/privacy-policy.

1.8. Changes to the Cookie Policy

We may update this Cookie Policy from time to time to keep it aligned with changes in technology, regulations, or business practices. The current version is always published on this page, and the date of the last update is stated at the top.

In the event of significant changes that affect your consents, we will request your consent again through the cookie banner.

1.9. Contact

For any questions regarding this Cookie Policy or the processing of your personal data, contact us at:

• Serenity d.o.o.
• Kliški put 11, 21210 Solin
• Email: privacy@serenity.hr
• Website: www.serenity.hr