Cookie Policy
This is an English translation provided for convenience. If it differs from the Slovenian version, the Slovenian version prevails.
1. What cookies are
Cookies are small text files that a website stores in your browser. On your next visit the browser sends them back, so that the site knows, for example, what you have in your basket and whether you are signed in.
In addition to cookies, we also use browser storage (local storage and session storage). This data, too, remains on your device, so in this document we treat it in the same way as cookies.
2. In brief
- We always use strictly necessary cookies. Without them there is no basket, no sign-in and no secure payment. No consent is required for these (Electronic Communications Act (ZEKom-2), Article 225, paragraph 2).
- We use cookies for measuring visits only if you consent to this in the banner.
- Google Ads is loaded only if you consent to this in the banner, under the “Marketing Cookies” category (section 6). Without this consent, nothing connects to Google Ads. We do not use Google Analytics, Meta Pixel or other advertising networks.
- A YouTube video is loaded only when you start it yourself (section 8).
3. The banner and your choice
On your first visit we ask you what you allow: Accept All, Essential Only or Customize (by category).
Your choice is saved in your browser's local storage and is valid for 12 months; after that we ask you again. The choice is tied to the browser and the device. Because we have added Google Ads, everyone who made their choice before that has been asked again.
How to change or withdraw your choice
- In the page footer, click Cookie Settings and change your choice, or
- in your browser settings, delete the cookies and storage for this website.
Once you withdraw your consent to the measuring of visits, we no longer collect anything. If you
withdraw it in the banner, we delete the visitor_session and analytics_erasure_id cookies and the
list of products you have viewed in this browser in the last 12 months; from the records of these
visits we remove the hashed IP address, the browser data and the page address. If you delete the
cookies only in your browser, we can no longer find this data, so it is deleted when the retention
period expires (25 months, see the Privacy Policy, section 2.8).
When you withdraw your consent to marketing cookies, we inform Google that consent is no longer
given and delete the Google Ads cookies on our domain (_gcl_…) and its browser storage entry (_gcl_ls). We cannot ourselves delete data
that Google has already received.
4. Strictly necessary cookies
| Name | Set by | Purpose | Duration |
|---|---|---|---|
zeleznina_session |
the shop | maintains your session: your sign-in, the selected language and the data you enter as a guest during a purchase | up to 120 minutes of inactivity |
remember_web_… |
the shop | keeps you signed in after you close the browser; set only if, when signing in with your e-mail address and password, you tick “Remember me” | until you sign out, at most 400 days |
XSRF-TOKEN |
the shop | protection against forged requests (CSRF); set on pages opened via a link in our e-mail message and when signing in with a Google account | 120 minutes |
i18n_locale |
the shop | remembers the language you have selected; set only when you change the language | 12 months |
guest_cart_id |
the shop | links the basket to you when you shop without a user account | 30 days |
wpv |
the shop | allows the shop to be viewed during maintenance work; set only for persons who open a special preview link | 30 days |
__stripe_mid |
Stripe | fraud prevention for card payments; set by Stripe's payment module at the payment step | up to 1 year |
__stripe_sid |
Stripe | as above, for an individual visit | 30 minutes |
__cf_bm |
Cloudflare (on the domain challenges.cloudflare.com) | distinguishing between humans and bots during the Cloudflare Turnstile check (section 8) | 30 minutes of inactivity |
The browser sends cookies set by the shop only over an encrypted connection (Secure, except
i18n_locale), with the SameSite=Lax restriction; the session cookie, remember_web_…,
visitor_session and analytics_erasure_id are inaccessible to scripts in the browser (HttpOnly).
5. Cookies for measuring visits — only with your consent
They are set only if you consent to the “Analytics Cookies” category in the banner.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
visitor_session |
the shop | a random session identifier with which we count visits and product views; we link it to an order only if you place an order in the same session | 30 minutes |
analytics_erasure_id |
the shop | a random identifier with which, when you withdraw consent in the banner, we find and delete the visit measurement data from this browser; we do not use it for anything else | 12 months from the last consent |
In doing so we collect: both identifiers, a hashed value of the truncated IP address (for IPv4 only the first two numbers; we do not store IPv6 addresses), browser data (user agent), the address of the page on which you gave consent, and which products you viewed.
The data remains on our server; we do not use any external measurement tool and we do not pass the data on to third parties. We keep it for 25 months, after which we delete it automatically. Purpose: to see which products and pages interest visitors, and to improve the shop accordingly.
6. Marketing cookies (Google Ads) — only with your consent
They are set only if you consent to the “Marketing Cookies” category in the banner.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_gcl_au |
Google (on our domain) | the link between a visit and a later purchase, for measuring the effectiveness of ads | 90 days |
_gcl_aw and other _gcl_… |
Google (on our domain) | a record of the click on our ad, so that the purchase is attributed to that ad; set only if you arrive via an ad | 90 days |
We do not display ads on our site. Google Ads tells us which of our ads on Google lead to a purchase: in doing so, Google receives your IP address, technical data about the browser and the pages visited, and, on a purchase, the order number and amount. We do not send it your name, e-mail address or postal address. With this consent you also allow Google to use the data about your visit to show our ads (personalised advertising). In doing so, Google may also use cookies on its own domains (e.g. google.com, doubleclick.net). Google is an independent controller of this data; Google's privacy policy applies. More details in the Privacy Policy, section 2.11.
7. Browser storage
| What | Where | Purpose | Duration |
|---|---|---|---|
cookie_consent |
local storage | record of your choice in the banner | 12 months |
_gcl_ls |
local storage (Google) | Google's technical data for measuring ad performance; set only if you have consented to marketing cookies | 90 days |
checkout_address_data, checkout_address_expiry |
session storage | the address entered at checkout, so that you do not have to enter it again when you return | until the tab is closed, at most 24 hours; deleted when you sign out |
checkout_order_id, checkout_payment_intent, checkout_stripe_public_key |
session storage | link the order to the card payment when the payment redirects you to your bank for confirmation and back | until the payment is completed or the tab is closed |
google_pending_purchase |
session storage | the order number and amount, so that the purchase is reported to Google Ads after the payment is confirmed; set only if you have consented to marketing cookies | until the payment is confirmed or the tab is closed |
auth_signed_in_as |
session storage | your user account number, so that the shop removes the previous user's data when the account is switched | until the tab is closed |
8. Third-party content
- Stripe. At the payment step, Stripe's payment module (js.stripe.com) is loaded, which sends Stripe your IP address and technical data about your device and browsing for fraud prevention. Stripe's privacy and cookie policy applies to this data.
- Cloudflare Turnstile. On sign-in, registration, forgotten password and password reset, the
contact form, newsletter sign-up, the return request and the data deletion request (and when
placing an order, where this protection is enabled), Cloudflare's check is loaded, which
distinguishes a human from an automated program. In doing so, Cloudflare receives your IP address
and technical data about the browser and may set the
__cf_bmcookie on its own domain. - YouTube (Google). A product description may contain a YouTube video. Until you click the “Play video” button, nothing is loaded from YouTube. When you click it, the video is loaded in privacy-enhanced mode (youtube-nocookie.com); Google then receives your IP address and technical data about the browser, and YouTube may store cookies or similar data on your device.
The links to social networks and maps in the page footer are ordinary links; until you click them, nothing connects to the social networks or to Google.
9. Managing cookies in your browser
You can view, delete or block cookies in your browser (Chrome, Firefox, Safari, Edge: in the privacy settings). If you block all cookies, purchasing and signing in will not work.
10. Legal basis and your rights
Storing data on your device and accessing it are permitted only with your consent, except where this is strictly necessary for a service you have explicitly requested (Electronic Communications Act, ZEKom-2, Article 225). We therefore do not ask for consent for strictly necessary cookies.
The legal basis for cookies for measuring visits and marketing cookies (Google Ads) is your consent, which you may withdraw at any time (Articles 6(1)(a) and 7(3) of the General Data Protection Regulation (GDPR)).
How we process personal data and what rights you have is described in the Privacy Policy. For questions, write to spletna-trgovina@zeleznina.si. Supervision of compliance with the rules on cookies is carried out by the Information Commissioner.
Effective from 27 October 2026.