Marine-CRM Cookie Policy
Version: 1.7
Last updated: 25 August 2026
1. Who we are and what this Policy covers
This Cookie Policy explains how CIRCLESEA OÜ, an Estonian private limited company, registry code 17563486, VAT number EE103012063, with its public legal address at Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia (Marine-CRM, we, us, or our), uses cookies and similar storage technologies on:
- https://marine-crm.com (the Website); and
- the Marine-CRM business software platform (the Service).
This Policy should be read together with our Privacy Policy.
2. What cookies and similar technologies are
A cookie is a small text file stored on or read from a browser or device. Similar technologies may include browser storage or device-bound tokens that perform a comparable function.
Some of these technologies can involve personal data, such as an online identifier, IP address, device or browser information, or the association of a security token with a user account. They do not necessarily identify a person by name.
3. Our current configuration
Marine-CRM uses strictly necessary first-party cookies or equivalent storage to remember privacy choices, provide a service requested by the user, maintain a secure authenticated session, protect requests against forgery, and support account security.
The public Website also uses Google Analytics 4 (GA4) for audience measurement after the visitor gives analytics consent. We use Google's basic consent mode: Google Analytics tags are completely blocked before consent and remain blocked after rejection. No analytics cookie, consent-status ping, page-view event or other measurement request is sent to Google before consent. Refusing or withdrawing consent does not disable the Website, forms or Service.
We do not use Google Analytics for advertising, cross-site tracking, behavioural profiling or marketing audiences. Google Signals, User-ID, user-provided data, ads personalisation, advertising features and sharing for Google's own products are disabled. We do not use Meta Pixel, Hotjar, advertising pixels or social-media tracking cookies.
The Snov.io newsletter service operates separately from the Website and is not used to place Website tracking cookies. Newsletter open and click tracking is disabled.
Public forms use first-party request-integrity protection, a honeypot, and rate limiting; they do not use an external CAPTCHA. If we later introduce a CAPTCHA or another anti-abuse provider, we will first assess its storage, data collection, recipients, security, and international transfers, update the relevant notices, and obtain prior consent where required.
We do not embed YouTube, Google Maps, live-chat tools, or other third-party widgets. Fonts and icons are self-hosted. Social-media icons are ordinary external links and do not load social tracking scripts. We may later use an external font, icon, embed, or widget only after assessing the provider, data flow, storage, security, and international transfers, updating the relevant notices, and obtaining prior consent where required.
We will not add a new content-delivery network, web-application firewall, Cloudflare service, or similar infrastructure provider until the applicable privacy, security, contract, and international-transfer review is complete.
4. Technologies we use
The exact technical identifier may differ between deployment environments or change when the Service is securely updated. The purpose, provider, storage type, and maximum duration are described below.
| Functional identifier | Purpose | Provider and type | Duration |
|---|---|---|---|
| Privacy / analytics-consent preference | Remembers whether Analytics was accepted or rejected so the Website can respect the choice | Marine-CRM first-party cookie or equivalent browser storage; strictly necessary for recording and applying the privacy choice | Up to 12 months after the choice, unless changed, withdrawn or deleted earlier |
| Authenticated session identifier | Recognises an authenticated user, applies the correct account and permissions, and keeps the user securely signed in while actively using the Service | Marine-CRM first-party session cookie or equivalent secure session storage | The server-side session expires after 60 minutes of inactivity and may end earlier on logout, password or MFA change, manual revocation, suspicious activity, or another security reset |
| Request-integrity / CSRF identifier | Protects forms and authenticated requests from cross-site request forgery and related misuse | Marine-CRM first-party session cookie or equivalent secure token | For the active session or a shorter period; it may be rotated and does not outlive the related session |
| Trusted-device identifier | If the user voluntarily selects Remember this device, recognises a previously MFA-verified device so that an MFA challenge is not required for every new session | Marine-CRM first-party, persistent, revocable, device-bound token | No more than 30 days after verification; removed or invalidated earlier following token deletion, password or MFA change, manual session revocation, a new or unrecognised device, suspicious login, or another material security event |
_ga | Distinguishes a browser for consented Website audience measurement | Google Analytics first-party analytics cookie; data is processed by Google Ireland Limited and its authorised sub-processors | Configured for no more than 13 months and set only after Analytics is accepted |
_ga_* | Persists GA4 session state for the relevant measurement container | Google Analytics first-party analytics cookie; data is processed by Google Ireland Limited and its authorised sub-processors | Configured for no more than 13 months and set only after Analytics is accepted |
The trusted-device identifier does not keep an ordinary login session continuously active for 30 days. A new authenticated session is still subject to the 60-minute inactivity timeout and other security controls.
Public Website forms may use the request-integrity technology described above. Public pages do not use an authenticated-session or trusted-device identifier unless the relevant function requires it. Google Analytics must not receive names, email addresses, form content, Customer Data, professional-contact records or other direct identifiers through URLs, event names or event parameters.
5. Analytics consent and controls
Under applicable electronic-communications rules, consent is not required for storage or access that is strictly necessary to provide an information-society service expressly requested by the user. Google Analytics is not treated as strictly necessary and therefore remains disabled until the visitor chooses it.
Where a strictly necessary identifier also involves personal data, we process that data as described in our Privacy Policy, including where necessary to perform the customer service contract or for our legitimate interests in providing, protecting, and preventing misuse of the Service.
The first consent layer provides equally prominent Accept and Reject choices. Analytics is off by default, the Website does not use a cookie wall, and rejection does not disable the Website, forms or Service. A persistent Cookie Settings link allows the choice to be changed or withdrawn at any time. Withdrawal blocks future GA4 requests and removes the analytics cookies that the Website can control. Browser settings may also be used to delete them.
If we later introduce advertising, profiling or another non-essential technology, it will remain disabled until we complete the required assessment, update the relevant notices and obtain prior consent where required. A prior Analytics choice is not consent to a new purpose or provider.
We may retain evidence of an analytics-cookie choice for three years for compliance purposes. That evidence is limited to the consent choice, wording and version, timestamp, and necessary consent identifier; it does not contain a history of pages visited.
6. Your browser and device controls
You can block or delete cookies and browser storage through your browser or device settings. Doing so may:
- sign you out of Marine-CRM;
- prevent login, secure forms, or other essential Service functions from working correctly; or
- remove the trusted-device status and require MFA again.
Logging out ends the active login session. Removing a trusted-device identifier does not delete the user account or its data; it only removes that device's remembered MFA status.
7. Security and technical safeguards
Strictly necessary identifiers are designed to contain random or pseudonymous values rather than passwords, MFA secrets, or reusable one-time codes. We apply security attributes and controls appropriate to the technology, including encrypted HTTPS transport, Secure, HttpOnly, and SameSite settings where applicable, server-side expiry, revocation, rotation, and risk-based invalidation.
No system is completely secure. Users must protect their account and device, must not share credentials or sessions, and should log out on a shared or untrusted device.
8. Changes to this Policy
We may update this Policy if the Website, Service, law, or technologies we use change. The current version and last-updated date will be published on the Website.
We will not treat a policy update or continued Website use as consent where applicable law requires an affirmative choice.
9. Contact
Questions about cookies, similar technologies, or personal data may be sent to:
CIRCLESEA OÜ
Registry code: 17563486
VAT number: EE103012063
Address: Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia
Privacy: privacy@marine-crm.com
Legal: legal@marine-crm.com