Cookie Notice

Open cookie settings

1. Data Controller

The controller of personal data processing through this website is KONČAR - Electrical Industry Inc. for Manufacturing and Services (hereinafter "Company" or KONČAR Inc.).

PIN: 45050126417

Address: Fallerovo šetalište 22, 10000 Zagreb

Data Protection Officer: sluzbenikzazastitu@koncar.hr

2. What are cookies and how is personal data collected on websites?

Cookies are small files that a web browser stores on a computer, mobile device or other device used by a user to visit a website. They are stored based on the "instruction" of that website for its further needs. These needs/purposes can be different and depend on the function of the cookie, so for example, cookies can collect information about the language selected by a visitor for displaying content on multilingual websites, record the sequence of pages visited in order to allow users to navigate back through the website in the same order, and they can also be used to ensure basic functionality of the site, analyze website usage and enable marketing activities.

There are several types of cookies according to their function:

  • Technical/necessary/essential cookies - necessary for the functionality of the website itself as well as its fundamental purposes of functioning, such as the session identifier of the user's current visit to the website.
  • Functional cookies - enable the website to provide improved functionality and personalization, such as remembering the language in which the content of the website's pages is displayed
  • Analytics cookies - collect information about how users visit a website and its pages.
  • Marketing cookies - used for marketing purposes, and collect information about the habits and behavior of users on the website for the purpose of publishing advertisements, re-advertising, etc.

In general, it is important to note that, in addition to cookies, personal data about the user may also be collected through other similar technologies (tracking tools), or through services that are embedded in the website. External tools and embedded content on our website are listed below in the document with details on their use and type of tool.

3. How do we use cookies?

The following categories of cookies are used on this website:

Necessary cookies

Necessary (technical) cookies are necessary for the proper functioning of the website and enable the use of its core functionalities. In accordance with regulations in the field of electronic communications, user consent is not required for their use.

Name Purpose First/third party and recipient Duration Data
cookie_preferences Saves the user's selection of cookie categories. Home page: KONČAR / koncar.hr 6 months Selected categories and version of consent settings
SESS* / SSESS* Maintains a logged-in user or administrator session. Front page:Drupal /KONČAR Up to approx. 23 days Identifier of the logged session. Not recorded in anonymous visit.
_GRECAPTCHA Assessment of risk and protection of forms from automated misuse. Third party: Google reCAPTCHA via recaptcha.net Up to 6 months IP address, device and browser information, interactions with site and safety signals.
UVEPGNZX Technical session maintenance / HTTP Cookie Persistence on the load balancer, i.e. ensuring that user requests during the session direct to the corresponding backend web server. First party - the cookie is set by the NSX Advanced Load Balancer which is a part of koncar.hr infrastructure; it does not include functionality for transmitting personal data to third parties. Session - not configured as persistent and has no defined timeout; valid during a browser session A random encrypted and protected identifier is transmitted which uses the load balancer for determining the backend server to which the request should be directed.
ARRAffinity Functionality of the MES Configurator: routing successive requests from the same user to the same application and data server instance Third party (domains koncar-mes.littlecode.com and koncar-mes-api.littlecode.com); Microsoft Azure / Provider of the MES Configurator Session Encoded server instance identifier
ARRAffinitySameSite Same as ARRAffinity, in a cross-domain context (the configurator is embedded in the website) Third party (domains koncar-mes.littlecode.com and koncar-mes-api.littlecode.com); Microsoft Azure / Provider of the MES Configurator Session Encoded server instance identifier; attributes SameSite=None, Secure and HttpOnly
MES Configurator – necessary cookies for authentication

The cookies in the table below are not applicable to all visitors to the Company's websites. They are only applicable to employees of KONČAR Group companies who sign in to the website using the Microsoft Entra ID (Microsoft 365) login functionality. Accordingly, these cookies are not active for visitors who do not use the sign-in option.

Name Purpose First/third party and recipient Duration Data
AADSSO, esctx (and variants), ESTSAUTH, ESTSAUTHLIGHT, SignInStateCookie, stsservicecookie, x-ms-gateway-slice Enabling secure user login via Microsoft Entra ID, maintenance of login session (SSO), logout from connected services, protection against CSRF attacks and routing of authentication requests. ESTSAUTH contains user session data for single sign-on (SSO), ESTSAUTHLIGHT session state data, SignInStateCookie data required for logging out of connected services, and esctx serves to protect against CSRF attacks. Third party; Microsoft Ireland Operations Ltd. (Microsoft Entra ID/ login.microsoftonline.com) session Technical session identifiers, information about authentication state and security tokens
CCState Authentication session state storage between Microsoft Entra ID and Microsoft service for additional authentication (Backup Authentication Service) Third party; Microsoft Ireland Operations Ltd. about 10 days Information about authentication status and login security procedures
buid, fpc Tracking information about browser for service security, protective mechanisms, telemetry and requirements management and traffic throttling. Microsoft states that buid follows information related to browser for telemetry and protection mechanisms, while fpc serves to track requests and throttling. Third party; Microsoft Ireland Operations Ltd. 30 days Browser identifier and technical data required for security, stability and protection against service misuse
ESTSAUTHPERSISTENT Storage of user’s permanent login ("Stay signed in") and enabling single sign-on (SSO) between Microsoft services over a longer period. Microsoft states that the cookie contains information about the user's session used to enable SSO functionality. Third party; Microsoft Ireland Operations Ltd. 90 days Persistent session security identifier and data required to maintain user authentication (login).
AADSSOTILES, ESTSSSOTILES, brcap, wlidperf Management of the single sign-on (SSO) experience, display of account selection options during sign-in, and browser-related technical and performance functions. Microsoft states that the AADSSOTILES and ESTSSSOTILES cookies manage SSO behavior and the display of account selection options during sign-in, brcap checks the browser possibilities, and wlidperf is used for measuring performance. Third party; Microsoft Ireland Operations Ltd. about 6 months Technical data related to the browser, account selection during sign-in, and the performance of the authentication process.

Functional cookies

Functional cookies are used based on user consent and enable additional functionalities of built-in services.

Name Purpose First/third party and recipient Duration Data
_calendly_session Maintaining a session of the built-in appointment booking system Third party; Calendly LLC 21 days Session-related data associated with the Calendly booking interface. It does not contain the information that users provide when completing a booking form.
cf_bm Protecting the Calendly service from automated traffic Third party; Cloudflare, as Calendly's infrastructure provider 30 minutes of continuous inactivity Encrypted data related to the calculation of Cloudflare's traffic security assessment and timestamp data. The cookie is not linked to a user ID within the Calendly application.
_cfuvid Differentiation of users for protection and traffic management More at: Cloudflare Cookies Cloudflare Fundamentals docs Third party; Cloudflare, as Calendly's infrastructure provider Session A unique technical visitor identifier that Cloudflare uses to distinguish users within its traffic management rules. The cookie does not contain an IP address.

Analytics and marketing cookies

Analytics cookies are used based on user consent and to create website usage statistics.

Google Analytics 4
Name Purpose First/third party and recipient Duration Data
_ga Distinguishes individual website visitors and enables measurement of website traffic and user behavior First-party cookie; data is received by Google Ireland Limited (Google) 2 years Unique user and session identifier, user interactions with the website, data related to user sessions (e.g., page views, session duration, engagement), approximate geolocation data, browser and device information
_ga_PH7QDM2SBS Stores information required to maintain the session state for the Google Analytics 4 tag, including the session status and session count. First-party cookie; data is received by Google Ireland Limited (Google) 2 years Session identifier and status, as well as data related to tracked visits and events

Marketing cookies are used based on user consent and to collect information about user habits and behavior on websites for the purpose of publishing advertisements, measuring the effectiveness of marketing campaigns, and remarketing activities.

Google Ads
Name Purpose First/third party and recipient Duration Data
_gcl_au Cookies that help determine interactions with ads (e.g., how many times users click on ads and take further action on the page). More at: https://policies.google.com/technologies/cookies?hl=en First-party cookie; data is received by Google Ireland Limited (Google) 90 days Unique user and session identifiers, user interactions with the website, data relating to user sessions (e.g., page views, session duration, and engagement), approximate geolocation data, and browser and device information

External tools and embedded content on the website

In addition to cookies, the following external services are also loaded on the website, after the user has provided the relevant consent (where applicable):

  • Google Maps
  • Calendly
  • VOBco stock overview

MES configurators are loaded when their dedicated pages are opened.

Depending on the selected service, the processing will include the IP address, browser and device data, visited pages, user interactions, and data voluntarily submitted by the user through the respective service.

Similar technologies and network requests (web beacons)

External tools may transmit data through network requests, even without setting cookies, including so-called web beacons or pixels. Depending on the tool used, such requests generally serve analytics, marketing, service performance monitoring, technical error reporting, or recording users’ consent preferences.

Google Analytics is used for analytics and Google Ads for marketing. External tools and embedded content use New Relic to monitor the operation of the VOBco share price display, Airbrake for technical diagnostics, and OneTrust for consent management. The purposes and the data processed by these tools are specified in the table below.

Calendly and the VOBco, together with the tools loaded as part of them, are not loaded before functional cookies are accepted. Accepting functional cookies enables the operation of functionalities associated with third-party external services; however, it does not automatically constitute consent to the analytics or marketing technologies used by those services.

Name Purpose Type First/third party and recipient When loading Data
Google Tag Manager GTM-MZJ5JVKF Tag management system for the website. It is used to load and manage tools deployed on the website, and transmit the user's consent choices to those tools. Analytics / Marketing system (depending on the type of tag), Tag Management System, TMS, which serves for loading and managing other monitoring technologies Google Ireland Limited When the user accepts analytics or marketing cookies / Manages tags
Google Analytics 4 G-PH7QDM2SBS Measurement of website traffic and user behavior (visits, page views, traffic sources, events, conversions, etc.) to analyze and improve website content and user experience. Analytics tool – analytics technology for monitoring user's behavior (web analytics tool) Google Ireland Limited When the user accepts analytics cookies Data on number of users, session statistics, estimated location (e.g. country), browser and device data, data about interactions with the website, unique user and session identifier
Google Ads AW-17095752144 Measuring campaign success (conversion tracking) and display of remarketing ads to users who have visited the website. Code AW-17095752144 stands for Google Ads Conversion Tracking identifier used to measure ad effectiveness and tracking conversion on the website. It is an external tool connected to the Google Ads system and marketing cookies _gcl_*, including _gcl_au. Marketing and conversion tracking technology Google Ireland Limited When the user accepts marketing cookies Data related to the progress and effectiveness of campaigns
Google Maps Location display with contact forms Functional Google LLC Loading after consent is given IP address, browser, page visited and map interactions
Calendly Display and use of appointment reservation Functional Calendly and its infrastructure providers Loading after consent is given Request specifications, interactions and data entered by the user in the reservation
VOBco stock display Stock data display Functional VOBco / is.vobco.hr Loading after consent is given Technical data of the request and the visited page
msal.* (local browser storage) User login to the MES Configurator and and maintenance of the authenticated session (login). Technical (necessary) Microsoft Entra ID / Provider of the MES Configurator Loaded upon login. Lasts until the user logs out. Authentication tokens, identifier and basic user account information
Microsoft Entra ID External authentication service User authentication on Microsoft login page Technical (necessary) Third party: Microsoft, domain login.microsoftonline.com From session up to 6 months Login session and browser data
grecaptcha (browser local storage) Security assessment and protection of forms against bots, spam, and automated abuse through Google reCAPTCHA. Technical (necessary) Storage on the koncar.hr domain; service provider: Google reCAPTCHA. Local storage is loaded when accessing web pages containing forms protected by reCAPTCHA, and the record remains until it is removed by the service provider, browser, or user. A technical security record used by reCAPTCHA for risk assessment.
rc::a (browser local storage) Security assessment and distinguishing genuine users from automated requests to protect forms through Google reCAPTCHA. Technical (necessary) Third party: Google reCAPTCHA; storage on the www.recaptcha.net domain. Local storage is loaded when accessing web pages containing forms protected by reCAPTCHA, and the record remains until it is removed by the service provider, browser, or user. A technical security record used by reCAPTCHA for risk assessment.
New Relic (supporting the VOBco stock market data display) Monitoring the display’s loading speed and operation and recording technical errors. Analytics – diagnostics and performance monitoring of the embedded service VOBco/New Relic: domains js-agent.newrelic.com and bam.nr-data.net. When the VOBco display is loaded, after functional cookies have been accepted. URL of the loaded page, browser and device information, loading times, technical errors, and events within the display.
Airbrake Loading the configuration of a tool used for the technical diagnostics and error reporting of an external service. Analytics – technical diagnostics Airbrake; domain notifier-configs.airbrake.io. When external content is loaded, after functional cookies have been accepted. Technical information about the browser and the tool provided with the configuration request. When an error is reported, the page URL and error information may also be processed, depending on the external service settings.
OneTrust Displaying the external service’s cookie settings and recording the user’s consent choice Technical (necessary) OneTrust; domains cdn.cookielaw.org and privacyportal.onetrust.com. When external content is loaded, after functional cookies have been accepted. Consent preferences and technical information required to record them.

4. Consent withdrawal and rights of the data subject

You can withdraw or modify your consent for functional, analytics, and marketing cookies/tools at any time through the cookie settings available on the website.

Withdrawal of consent does not affect the lawfulness of processing that was based on consent before its withdrawal.

In general, individuals whose personal data are processed have, under the conditions prescribed by the General Data Protection Regulation (GDPR), the right to request access to their personal data, rectification or erasure of their personal data, restriction of processing, data portability, and to object. Data subjects also have the right to file a complaint with the competent data protection supervisory authority (in the Republic of Croatia, this is the Croatian Personal Data Protection Agency).

The processing of personal data carried out through the Company's websites does not include automated individual decision-making, which would produce legal effects in relation to the data subject or similarly significantly affect the data subject.

5. Data transfers to third countries

Some service providers whose cookies and similar technologies are used on this website will process personal data outside the EU and outside the European Economic Area (in the United States). This may apply in particular to service providers such as Google, Calendly and Cloudflare.

When personal data is transferred to third countries, the transfer is carried out in accordance with Chapter V of the General Data Protection Regulation (GDPR), using one or more mechanisms/protective measures:

  • the European Commission's decision on the adequacy of the level of data protection, including EU-US Data Privacy Framework for organizations certified under that framework (More at: https://www.dataprivacyframework.gov/)
  • standard contractual clauses adopted by the European Commission (available on the European Commission website)
  • additional technical and organizational protection measures (as applicable)

Data is transferred only to the extent necessary to provide the required functionalities, analytics, scheduling of meetings, security and protection of the website.

Furthermore, for certain services, Google states that for users located in the European Union, Switzerland, and the United Kingdom, it does not store individual IP addresses and that IP address data are used solely to derive approximate location information before being discarded.