Order

Draft for legal review

Cookie policy

Version 2026-10-v2Polish version (binding)

The Service works without consent to cookies other than necessary ones. Analytics and advertising are switched on only after consent (Art. 399 of the Polish Electronic Communications Law).

This English version is a translation provided for convenience. The Polish version is binding and prevails in case of any discrepancy.
This is a working draft. The content must be reviewed by a lawyer, and the fields highlighted in yellow must be completed before sales start.

1. What cookies are

Cookies are small files stored in the browser. localStorage, sessionStorage and tracking pixels work similarly; this policy covers all of them.
Necessary cookies are used without consent because they serve to provide the service the user asks for. Others require consent, which can be withdrawn at any time with the Cookie settings button in the footer, as easily as it was given.
The decision is remembered for 12 months. After that, or after a change to the list of tools, we ask again.
We record every decision (consent, refusal, change) in the consent register: the decision identifier from your browser, the banner version, the chosen categories, the date and time and a hash of the IP address (the address cannot be recovered from it). The entry is kept for 12 months after the decision expires, i.e. 24 months.

2. Categories

  • Necessary (always on): logging in, quoting and ordering, security, protection against spam and fraud, remembering the cookie decision and the chosen language. The Service does not work without them.
  • Analytics (off by default): we count visits and check which pages and quote steps work and which do not (Google Analytics).
  • Marketing (off by default): we measure whether an ad led to a quote or order and may show our ads on Google (Google Ads). Data may also reach Google in the USA.
Google tags are loaded only after consent to the category concerned, in Google Consent Mode v2 (without consent all signals are “denied”).

3. List of files

Necessary:
  • hp_buyer, hp_shop, hp_admin (HexoParts, on encrypted pages with the __Host- prefix): session after logging in to the customer, partner or operator panel, not accessible to page scripts; 14 days, 12 hours in the operator panel, or until logout.
  • hp_consent (HexoParts, localStorage): record of the cookie decision and its identifier in the consent register; 12 months.
  • hp_lang (HexoParts, localStorage): chosen language; until the site data is cleared in the browser.
  • hp_draft (HexoParts, sessionStorage): carrying a quote made without an account over to the panel; until the tab is closed.
  • _GRECAPTCHA (Google): protecting forms against spam (reCAPTCHA); 6 months.
  • During online payment on the Stripe page, the operator may store its own fraud-prevention files (e.g. __stripe_mid, __stripe_sid; 1 year / 30 minutes).
Analytics (only with consent):
  • _ga, _ga_<identifier> (Google): visit statistics; 2 years.
Marketing (only with consent):
  • _gcl_au (Google): ad conversion measurement; 90 days.
  • IDE, ar_debug (Google): remarketing and ad measurement; up to 13 months.
We check the list with a scan of the site before every change of tools.

4. How to change your choice

You can change your choice at any time with the Cookie settings button in the footer: the banner appears again, and until new consent analytics and advertising do not work. Cookies stored earlier can be deleted in the browser settings.
You can also block and delete cookies in the browser settings; blocking necessary cookies will make logging in and ordering impossible.

5. More information

The controller is HexoParts; for Google tools also Google Ireland Limited under its own policy. Details, rights and transfers outside the EEA: Privacy policy. This Cookie policy applies from [publication date].
You can print this document or save it as a PDF in your browser.