Cookie Policy

1. Introduction

This Cookie Policy explains how NexPath Oy ("we," "our," "us") uses cookies and similar technologies on our website and platform. By using NexPath, you consent to the use of cookies as described in this policy.

2. What Are Cookies?

Cookies are small text files stored on your device (computer, tablet, mobile) when you visit a website. They allow the website to recognize your device and remember information about your visit, such as preferences, login status, and language settings.

3. Types of Cookies We Use

3.1 Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be disabled. They enable core functionalities like:

• Authentication: JWT tokens stored in localStorage (not cookies) for secure login
• Security: CSRF protection tokens
• Session Management: Keeping you logged in during your session
• Payment Security: Stripe uses cookies for fraud detection and secure payment processing during checkout. These cookies are strictly necessary for payment functionality.

Legal Basis: Legitimate interest (essential for service provision)

3.2 Functional Cookies

These cookies enhance your experience by remembering your choices:

• Language Preference: Stores your selected language (EN, FI, etc.)
• Theme Preference: Remembers dark/light mode selection
• Accessibility Settings: Font size, contrast preferences

Legal Basis: Consent (you can disable via browser settings)

3.3 Analytics Cookies

These cookies help us understand how users interact with the platform:

• Usage Analytics: Page views, feature usage, time spent
• Performance Monitoring: Load times, error rates
• A/B Testing: Testing new features with user segments

Privacy-First Approach: Website analytics use Google Analytics through Google Tag Manager, a third-party service. They stay off until you accept analytics cookies in the cookie banner; if you decline, no analytics cookies are set.

Legal Basis: Consent (opt-in via cookie banner)

3.4 Marketing Cookies

We use one marketing item, and only if you accept marketing cookies in the cookie banner:

• nexpath.partnerReferral (kept in your browser's local storage for up to 180 days): remembers that you arrived through a link from one of our partners, so that we can credit that partner if your organisation signs up. It holds only the partner's code and the date of your first click, nothing about you.

We use no other marketing cookies: no advertising, retargeting, social media tracking or third-party behavioural profiling. Google's advertising signals stay switched off on our sites.

Legal Basis: Consent (opt-in via the cookie banner). You can withdraw it at any time in the cookie settings.

4. Third-Party Cookies

We minimize third-party cookies, but the following services may set cookies or similar identifiers:

Your account and assessment data are hosted on our own infrastructure in Helsinki, Finland (EU) — see our Trust Center for the full list of providers. Stripe is GDPR-compliant and processes payment data securely.

5. localStorage and sessionStorage

In addition to cookies, we use browser storage mechanisms:

• localStorage: Stores JWT authentication tokens, theme preference, language preference (persistent across sessions)
• sessionStorage: Temporary data (cleared when browser closes)

These are similar to cookies but are not transmitted to the server with every request. They are essential for the platform to function.

6. Managing Cookies

6.1 Cookie Consent Banner

On your first visit, you will see a cookie consent banner. You can:

• Accept All: Enable all cookies (necessary, functional, analytics)
• Reject Non-Essential: Only strictly necessary cookies
• Customize: Choose which cookie categories to enable

You can change your preferences anytime via the cookie settings link in the footer.

6.2 Browser Settings

You can also control cookies via your browser:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions

Note: Disabling necessary cookies may prevent the platform from functioning correctly.

6.3 Do Not Track (DNT)

We respect browser "Do Not Track" signals. When DNT is enabled, we will not set analytics cookies.

7. Cookie Lifespan

Cookies have different lifespans:

• Session Cookies: Deleted when you close the browser
• Persistent Cookies: Stored for a set period (e.g., 30 days for language preference, 1 year for analytics)

You can see cookie details via browser developer tools (Application → Cookies).

8. Updates to This Policy

We may update this Cookie Policy to reflect changes in technology or legal requirements. Updates will be posted on this page with a revised "Last updated" date.

9. Contact Us

For questions about our use of cookies, contact us at: