EXTENDED NOTICE

Cookie and Tracking Policy

of the J.Rose digital ecosystem

Controller Affreschi & Affreschi S.r.l. — J.Rose brand
Scope jrose.it, e-commerce, Membership App (native and web) and Message pages controlled by J.Rose
Version 1.2 — 24 July 2026
Effective From the date of publication in the environments concerned
Contacts privacy@jrose.it — affreschisrls@pec.it
QUICK READ — J.Rose always uses the indispensable technical tools. Analytics, advertising measurement and other non-essential trackers remain disabled until a positive choice is made. The Membership App does not use its own analytics; TagLink applies its own Cookie Policy on the domain managed by Sinfotech.

INDEX

1 Controller and contacts
2 Scope and digital environments
3 Definitions and classification criteria
4 Rules applied and legal basis
5 Categories of cookies and trackers
6 The jrose.it website and e-commerce
7 J.Rose Membership App (native and web)
8 Message in a JR Bottle
9 TagLink and other external environments
10 Inventory of services and durations
11 Managing, proving and withdrawing preferences
12 Transfers, recipients and suppliers
13 User rights
14 Updates and checks
15 Legal sources and links

1. Controller and contacts

The Controller of the processing described in this Policy is Affreschi & Affreschi S.r.l., with registered office at Zona P.I.P., Lotto 9 — 73027 Minervino di Lecce (LE), Italy; VAT no. and tax code IT04779110750; REA LE-317690; PEC affreschisrls@pec.it; privacy email privacy@jrose.it. J.Rose is a brand managed by Affreschi & Affreschi S.r.l.; in this document, “J.Rose” means the Controller.

For ordinary support you can use info@jrose.it. Requests relating to personal data, cookies or preferences must be addressed to privacy@jrose.it.

2. Scope and digital environments

The Policy concerns cookies and equivalent tools used in the digital environments controlled by J.Rose: the corporate website and e-commerce jrose.it; account and checkout; Message in a JR Bottle landing and digital pages hosted for J.Rose; the J.Rose Membership App, in the native versions for iOS and Android distributed through the Apple App Store and Google Play and in the web version accessible from the browser; any J.Rose subdomains and pages that expressly refer to this Policy.

The Policy supplements the general, Membership and Message privacy notices. In the event of a difference, the dedicated notice governs the purposes, data and roles of the relevant service, while this Policy governs access to the device, trackers and the collection of preferences.

Domains and applications independently managed by third parties, including tag.link, payment providers’ sites, Apple Wallet, Google Wallet, social network pages and other sites opened through an external link, are outside J.Rose’s technical control. In those environments the notices and consent systems of the respective operator apply.

3. Definitions and classification criteria

“Cookie” means a small file or identifier stored by the browser. “Trackers” also include local storage, session storage, pixels, tags, SDKs, identifiers, network requests and techniques that write or read information from the device or make it possible to recognise a session, a browser or a user.

J.Rose classifies each tool according to its actual function, not its commercial name. Only what is strictly necessary to transmit a communication or provide a function requested by the user is technical. A tool becomes analytics, experience or marketing when it measures, combines, personalises or communicates data beyond what is indispensable to the requested function.

Google Tag Manager is a tag container: it does not in itself constitute a purpose. Each hosted tag retains its own category and cannot be activated before the required consent. Google Consent Mode is a technical mechanism for transmitting preferences and does not replace consent or prior blocking.

4. Rules applied and legal basis

Strictly necessary tools are used without consent within the limits of Article 122 of Italian Legislative Decree 196/2003, because they are indispensable to the function expressly requested or to the transmission of the communication. The related processing of personal data is based, as the case may be, on performance of the service, legal obligation or legitimate interest in security; legitimate interest is not used to circumvent the consent required for unnecessary storage or reading on the device.

Non-exempt analytics, conversion measurement, advertising, remarketing, profiling and non-essential third-party content are activated only after freely given, specific, informed, unambiguous and demonstrable consent. Refusal does not prevent browsing, purchasing, Membership, Message or essential functions.

Preferences are initially set to refusal. Scrolling, inaction, continued browsing, closing without a clear description or use of the site do not amount to acceptance. Withdrawing or changing must be as simple as accepting.

5. Categories of cookies and trackers

Category Function Consent J.Rose examples
Necessary Session, security, authentication, cart, checkout, age, OTP, Message access, saving of choices Not required within the limits of strict necessity WordPress/WooCommerce; session cookies; Iubenda preference cookie; security; App authentication
Functionality Interactive or optional functions that support the service Required when the function is not strictly necessary; not required for communications that are merely indispensable to an expressly requested function Stores map, only if testing excludes unnecessary telemetry; any optional functions
Experience External content and components that enrich browsing Required before loading when the content is not indispensable Videos, social, maps or other embedded content that is not necessary
Measurement Browsing statistics, performance, campaigns and interactions Required, except for measurements genuinely equated to technical ones by law Google Analytics 4; non-essential WordPress statistics; any cartographic usage telemetry
Marketing Attribution, conversions, remarketing, advertising and profiling Always required Meta Pixel and any future advertising tags

6. The jrose.it website and e-commerce

The site uses tools that are necessary for display, protection, age verification, preference management, session, account, cart, checkout, orders, fraud prevention and interaction with the payment provider chosen. Payment modules or links to the provider are loaded when the user starts the requested function.

Google Analytics 4 and WordPress’s non-essential statistical tools are classified in the Measurement category and remain blocked until the relevant consent. Google Tag Manager cannot activate them in advance. Meta Pixel is classified as Marketing and remains blocked until Marketing consent, together with any browser or server-side conversion functions that use the same data.

Maps, videos, social content and other external elements are loaded in a deferred manner. When the content is not strictly necessary, a placeholder is shown and loading takes place only after the relevant choice or a conscious command accompanied by the required information.

The declaration of legal age and cookie consent remain two distinct operations. Confirming age does not authorise analytics, marketing or other trackers.

7. J.Rose Membership App (native and web)

The web version of the App uses a cookie or technical authentication identifier to maintain the session until logout, deletion of browser data or technical expiry; the native apps use equivalent technical identifiers stored on the device. The technical events indispensable to security, synchronisation, errors, authorised push notifications and the operation of Firebase services are also processed.

J.Rose does not activate in the App Google Analytics, Google Analytics for Firebase, Meta Pixel, behavioural profiling or commercial measurement of purchases. Firebase Crashlytics is not started automatically: diagnostic reports are sent only after optional consent to diagnostics, which can be withdrawn at any time from the App settings; without consent it remains disabled. The technical components are scanned before launch and after significant changes, on each distribution channel.

The Stores section uses Google Maps with manual navigation and does not require GPS or precise location. Before publication, J.Rose compares the App’s traffic without opening Stores and after opening the map: using HAR files for the web version and an interception proxy for the native apps. Loading without consent is permitted only if communications to Google Maps servers are limited to tiles, styles, fonts and data strictly necessary to draw the map requested by the user, without persistent identifiers or usage telemetry that is not indispensable.

If testing detects calls to telemetry or measurement domains, usage or performance events, persistent identifiers or other communications exceeding the requested display, the telemetry must be disabled. Until that is possible, the embedded map remains removed or blocked; J.Rose favours a manual list with an external link. Any retention of telemetry requires classification in the Measurement category, a preferences panel in the App and prior blocking until consent.

The App does not show a banner only after testing has confirmed, on each distribution channel, the exclusive presence of technical tools and the absence of unnecessary cartographic telemetry. It nonetheless always makes this Policy accessible from the App. The simplification ceases immediately if an unnecessary tracker is added or detected.

8. Message in a JR Bottle

The landing pages and the commercial or purchase pages controlled by J.Rose use the tools necessary for session, loading, payment, activation, security and recording of preferences. The private Digital Page uses exclusively the technical tools indispensable to validate the scan, allow open or Password/OTP-protected access, deliver and display the Content and ensure security.

Google Analytics 4, non-essential WordPress statistics, Meta Pixel and other non-indispensable tags may be activated, after consent for the relevant category, only on the landing pages and on the commercial or purchase pages. On the private Digital Page displaying the Content, no analytics, marketing, profiling or measurement tools are activated, even with prior consent. Refusal does not prevent purchase, activation, management or viewing of the Content.

Message content is hosted for J.Rose through 650MB/Serverplan. The NFC scan passes through a separate TagLink phase: cookies, logs, security and tools used on the TagLink domain are determined by Sinfotech and are not controlled by J.Rose’s CMP.

9. TagLink and other external environments

Scanning an NFC tag may open tag.link, a platform managed by Sinfotech. At that stage Sinfotech determines cookies, trackers, network logs, security and abuse prevention and issues its own notice. J.Rose does not install the Iubenda CMP on the TagLink domain and does not record as its own the consent collected by Sinfotech.

After the redirect to a J.Rose environment, this Policy applies again. Preferences expressed on jrose.it do not automatically authorise trackers on the TagLink domain and, conversely, a choice made on TagLink does not authorise J.Rose analytics or marketing.

Payment providers, Apple Wallet, Google Wallet, Passcreator, QlikTag, Ethereum, social networks and other external services apply their own rules when the user opens their environment or requests the relevant function. J.Rose limits the preventive loading of such components and documents the roles in the dedicated notices.

10. Inventory of services and durations

INTEGRAL PART — The table indicates the authorised services. The Iubenda panel must show the technical inventory actually detected — cookie or tracker name, domain, purpose, supplier and duration — and prevails for the specific technical datum only if it complies with the configuration actually tested.
Service/tool Environment and category Duration/criterion Activation condition
WordPress and WooCommerce jrose.it — necessary Session; cart and customer session for the technically configured time, as a rule no longer than necessary for the operation Always, limited to the functions requested
Security, login, account and age check jrose.it/Message/App — necessary Session or minimum configured duration; security according to the logs described in the notices Always, limited to security and the service
Iubenda Privacy Controls and Cookie Solution Environments with CMP — necessary Preference configured for 180 days; choice log according to the GDPR file Always, to record acceptance, refusal, selection and withdrawal
Google Tag Manager jrose.it and Message commercial pages — infrastructure Must not retain independent purposes; follows the managed tags Container loaded in a mode that does not activate unauthorised tags; absent from the private Digital Page
Google Analytics 4 jrose.it and Message commercial pages — Measurement Browser identifiers up to 24 months or shorter configured duration; Analytics data according to account settings Only after Measurement consent; never on the private Digital Page
Non-essential WordPress statistics jrose.it and Message commercial pages — Measurement Session or duration declared by the active component in the panel Only after Measurement consent; never on the private Digital Page
Meta Pixel jrose.it and authorised Message commercial pages — marketing Browser identifiers as a rule up to 90 days; actual duration in the panel Only after Marketing consent; never on the private Digital Page
Firebase (Google) App — necessary for authentication, database, hosting and notifications; optional Crashlytics diagnostics Session and technical identifiers until logout, data deletion or technical expiry; push token until revocation/deletion, with removal from live systems and backups according to Firebase timescales; Crashlytics retains reports and associated identifiers for 90 days. Always for authentication and essential functions; Crashlytics only after optional consent to diagnostics. No J.Rose analytics of its own.
Google Maps App Stores — Functionality, subject to testing Cartographic requests and supplier logs; no GPS location. Unnecessary usage telemetry prohibited without consent Loaded when Stores is opened only if traffic testing excludes excessive telemetry; otherwise removal, blocking or Measurement consent
TagLink/Sinfotech tag.link — external environment According to Sinfotech’s Cookie Policy and retention Outside J.Rose’s CMP
Payment providers Checkout — requested function According to provider and transaction When the user chooses and starts the payment method

Any tool not present in the table or in the updated panel is considered unauthorised until it is classified, the Policy is updated and, where necessary, consent is obtained.

11. Managing, proving and withdrawing preferences

In environments that use non-essential trackers, the CMP offers on first access clearly distinguishable controls to refuse non-essential tools, customise and accept all. No optional category is preselected and the controls for refusing and continuing without trackers have prominence and accessibility no lesser than acceptance.

Proof of preferences consists of the CMP’s Cookie and Consent Preference Log and the J.Rose GDPR file. The log records the technical elements made available by Iubenda, including preferences, record identifier and date/time; J.Rose separately retains the version of the Policy and banner, the configuration of categories, screenshots, the period of validity and evidence of changes or withdrawal. The Consent Database is not used as a substitute for the Preference Log; it may be introduced only for documented synchronisation relating to authenticated users or for other consents that require it.

The browser preference is retained for 180 days and is not requested again before then, except in the event of a significant change to the services, deletion of the preference from the device or technical impossibility of recognising it.

The permanent “Manage cookie preferences” control is available in the footer of jrose.it and on the Message pages. In the App, the link to the Policy is available and, if optional categories exist, the panel as well. Withdrawal blocks future activations; J.Rose deletes or renders unusable, where technically possible, first-party cookies no longer authorised.

Preferences for the different domains are not added together or reused automatically without a reliable technical basis and clear information. The authenticated user is not tracked across devices except by specific choice and a function actually implemented.

12. Transfers, recipients and suppliers

Data collected through trackers may be processed by Iubenda, Google (including Firebase and Google Maps), Meta, WordPress/plugins actually active, Serverplan, 650MB and the other suppliers indicated in the dedicated notices, according to their role and only for the categories authorised. FlutterFlow is the development platform and, in the documented configuration, does not receive end users’ data through the App’s trackers.

Some suppliers may carry out processing outside the European Economic Area. J.Rose checks, according to the service, adequacy decisions, the EU-US Data Privacy Framework for participating organisations, Standard Contractual Clauses, transfer assessments and supplementary measures. Further details are contained in the privacy notices and in the suppliers’ documents.

J.Rose does not sell data collected through cookies and does not allow advertising tools to activate for their own purposes before the applicable consent.

13. User rights

Users may change or withdraw their preferences at any time, request access, rectification, erasure, restriction, portability where applicable and object to processing based on legitimate interest, by writing to privacy@jrose.it. Withdrawal does not affect the lawfulness of earlier operations.

A complaint may be lodged with the Italian Data Protection Authority (Garante per la protezione dei dati personali), www.garanteprivacy.it. For processing independently determined by TagLink, payment providers, wallets or other external environments, rights must also be exercised against the respective controller indicated in the relevant notice.

14. Updates and checks

J.Rose updates the Policy when technologies, domains, suppliers, purposes or legislation change. A change introducing a new third party or a new non-essential purpose results in an update of the panel and, where required, a new consent request.

The site, the App on each channel and the Message pages are scanned before publication, after changes to plugins, GTM or integrations, and periodically. The results, with date, browser, consent status, cookies, local storage and network requests, are kept in the GDPR file.

If the technical inventory does not match this Policy, the excess tracker is blocked or removed until regularised. No documentary description can replace the correct technical behaviour of the system.

15. Legal sources and links

VERSION — Version 1.2 — last updated 24 July 2026. The preferences panel and the updated technical inventory form an integral part of this Policy.