1. Scope and responsible business
This review draft describes the local Altema prototype and its proposed GA4 integration. It is not an audit of the live domain. The responsible business is Alexandru-Cătălin Ciobanu PFA, CIF 51141462, Trade Register No. F2025001121004, registered at Str. Elena Farago, No. 9, Craiova, Romania.
Contact office@altema.ro, alexandrucatalin.ciobanu04@gmail.com or +40 761 615 598. Read the Privacy Policy for data-controller and rights information.
Cookies and similar browser storage can remember information between page visits. Static-file use stores only your consent preference; the loopback PHP test also uses the necessary form-security session described below. Real Google Analytics remains disabled, even after acceptance.
2. Active and proposed technologies
| Technology | Status and purpose | Provider / duration | Control |
|---|---|---|---|
| Consent preference | Active: localStorage entry altema.consent.v1, storing Analytics choice, version, timestamp and expiry. No form contents or visitor identifier. | Altema code on this browser. Proposed expiry: 180 days from the saved choice; no renewal on ordinary page visits. Expired records are not accepted. | Cookie Settings; browser site-data controls. If storage is blocked, page-memory fallback only. |
| Essential cookies | Static-file use sets no essential cookie. The loopback PHP form test uses altema_pilot_session for CSRF protection; consent preferences remain in localStorage. | Altema PHP endpoint. Session cookie lasts for the browser session; form token validity is 30 minutes. Verify server session cleanup before activation. | Necessary for the PHP form security flow, independent of optional Analytics. Manage site data in your browser. |
| Google Analytics 4 | Prepared, not active locally. Measurement ID G-2HDHLWMELQ. Proposed use: page views, pilot CTA clicks and server-confirmed enquiries, after Analytics consent only. | Google Analytics. Contracting entity, account retention and transfer details require confirmation. | Accept All or enable Analytics in Customize Preferences. Reject or switch off Analytics to stop future collection. |
_ga | Proposed Google cookie distinguishing browsers/users; never set by this prototype. | Google's documented default is 2 years. Proposed code override: 180 days maximum, without refresh on each visit. Actual lifetime may be shorter due to browser limits. | Consent required. Withdrawal attempts deletion on the current host and parent domains at path /. |
_ga_<container-id> | Proposed Google cookie maintaining session state. Expected stream suffix relates to the existing ID; exact cookie name must be verified after controlled activation. | Google's documented default is 2 years. Proposed 180-day cookie override must be verified in the target web stream; it is not proof of account-level retention. | Same Analytics controls. Verify exact domain/path and deletion during release testing. |
| Advertising / social widgets | No advertising tags or embedded social tracking. LinkedIn and X remain ordinary outbound links. | No active advertising provider or application cookie duration. | Choose whether to navigate to external services; their own policies apply there. |
| Other browser state | Form inputs, menus and demonstration tabs remain in page state. No form persistence, sessionStorage, IndexedDB or service worker is added. | Local page only. Browser autofill or page restoration is controlled independently by the browser. | Browser autofill and site-data settings. |
All images, SVGs, fonts, interface scripts and styles in the prototype are local or system resources. Browser caching is distinct from application-managed storage.
4. Production behavior proposed for approval
Google's tag is loaded once per page only after Analytics is accepted, the production flag is enabled, and the exact HTTPS hostname is approved in configuration. No Google script, denied-consent ping, or pre-consent event replay is used. Advertising consent remains denied.
The code prepares one manually controlled page view, request_pilot for pilot CTA clicks, and generate_lead only for a successful production server response. Validating the local demo form is not a lead event. Custom events do not contain form values or free-text URLs.
The original site source contains a Google Analytics tag and Google Fonts requests. Those unconditional external loads have not been copied into this prototype. This policy does not change the live site's consent behavior.
5. Further information
Review this policy when hosting, scripts, consent storage, analytics settings or contact processing changes. Official references: Google: GA4 cookies (opens in a new tab), Google: basic consent mode (opens in a new tab), and the Altema Privacy Policy.