cookie policy
Cookie Policy, Brand Activator Academy
Controller: act.3 GmbH ("the Company", "we", "us", "our") Käthe-Dassler-Straße 2, 91074 Herzogenaurach, Germany Website: https://www.weareact3.com
Data protection contact: data.protection@weareact3.com
Last updated: 12 August 2026
1. Scope of this Policy
This Cookie Policy explains how cookies are used on Brand Activator Academy (the "Platform"), an internal online training platform operated by the Company to onboard and train Brand Activators (the Company's staff and personnel who represent brands at events) and to allow managers and executives to assign courses and view completion reports. The Platform is not a public consumer product.
This Policy sits alongside, and should be read together with, the Platform's Privacy Notice, which describes in full the personal data we process (e.g. name, work email, hashed password, training records), the legal bases relied on, retention periods, and your data-subject rights.
2. What are cookies?
A cookie is a small text file that a website places on your device (computer, tablet, or phone) through your browser. Cookies allow a website to recognise your device and to store limited information between requests, for example, to keep you logged in as you move from page to page.
Cookies can be described in several ways:
- Session cookies expire when you close your browser or after a short period of inactivity. Persistent cookies remain on your device for a defined period or until deleted.
- First-party cookies are set by the website you are visiting (here, the Platform). Third-party cookies are set by another domain.
- Strictly-necessary cookies are essential for the website to function and to provide a service you have expressly requested (such as logging in). Non-essential cookies (for example analytics, advertising, or tracking cookies) are not required for the service to work.
Similar technologies (such as localStorage, sessionStorage, pixels, or device fingerprinting) can be used to store or read information on your device. We do not use any such non-essential technologies on the Platform.
3. Cookies we use
The Platform uses strictly-necessary cookies only: two login-session cookies plus one small cookie that remembers you have seen the cookie notice. The login-session cookies exist solely to authenticate you and to maintain your logged-in session. They are set as first-party cookies and are marked httpOnly, meaning they cannot be read by client-side JavaScript, which reduces the risk of theft via cross-site scripting. The cookie-notice cookie is a small first-party preference cookie and stores no personal data.
| Cookie name | Purpose | Type | httpOnly | Expiry |
|---|---|---|---|---|
ba_session | Keeps a signed-in Brand Activator authenticated while using the Platform; without it, login and access to training content would not work. | Strictly necessary, first-party login session | Yes | 7 days after it is set |
mgr_session | Keeps a signed-in manager or executive authenticated while assigning courses and viewing completion reports; without it, the manager area would not work. | Strictly necessary, first-party login session | Yes | 7 days after it is set |
cookie_notice_ack | Remembers that you have acknowledged the cookie notice, so it is not shown again on every visit. Stores no personal data. | Strictly necessary, first-party preference | No | 6 months after it is set |
These cookies do not track your activity across other websites, do not build a profile about you, and are not shared with advertisers.
4. Cookies we do NOT use
We do not use, and the Platform does not set:
- analytics or performance-measurement cookies (e.g. Google Analytics);
- advertising, marketing, or re-targeting cookies;
- social-media or "share button" tracking cookies;
- third-party tracking cookies of any kind; or
- cross-site or cross-device tracking, profiling, or fingerprinting.
Because the Platform is an internal staff-training tool, no marketing profiles are created and no behavioural tracking is performed. We also do not use pixels, device fingerprinting, or localStorage/sessionStorage for tracking purposes.
5. Legal basis, why we do not ask for consent
Under the ePrivacy Directive (2002/58/EC) as implemented in Germany by the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG), storing or accessing information on a user's device requires prior consent, except where the storage or access is strictly necessary to provide a service that the user has expressly requested (§ 25(2) TDDDG).
The cookies described in Section 3 fall within this strictly-necessary exemption: they are essential to authenticate you and to deliver the training service you have logged in to use, or simply to remember that you have seen the cookie notice. For that reason, no cookie-consent banner is required and we do not ask for consent. For transparency, a short informational cookie notice is shown when you first enter the Platform, letting you know that only strictly-necessary cookies are used and linking to this Policy.
To the extent any personal data associated with these cookies is processed under the GDPR, the relevant lawful bases are set out in the Platform's Privacy Notice, principally the performance and management of your employment or engagement relationship and staff training/record-keeping (Art. 6(1)(b) and (f) GDPR together with § 26 BDSG, data processing for employment purposes), and legal obligation where applicable. Because completion of the training is mandatory, this processing is not based on consent.
6. Managing and disabling cookies
You can control or delete cookies through your browser settings. Most browsers let you view stored cookies, delete them individually or in bulk, and block cookies from some or all websites. Instructions are available in the help pages of your browser (for example Google Chrome, Microsoft Edge, Mozilla Firefox, or Apple Safari).
Please note: the cookies used by the Platform are strictly necessary for it to function. If you block or delete the ba_session / mgr_session cookies, you will not be able to log in or use the Platform, because these cookies are what keep you authenticated. Disabling them does not disable "tracking", the Platform performs no tracking, it simply prevents sign-in.
7. Where your data is processed (service providers)
The Platform is hosted in the European Union (Frankfurt). We use a small number of vetted service providers (processors) who may set or process the strictly-necessary session data on our behalf, each under a data processing agreement (DPA):
- Vercel Inc., application hosting; served from an EU region. Covered by a DPA and, for any transfer outside the EEA, the EU Standard Contractual Clauses (SCCs) and/or the provider's certification under the EU-US Data Privacy Framework (DPF).
- Supabase, managed PostgreSQL database and file storage; Frankfurt / EU region. Covered by a DPA.
- Resend, sending of transactional invitation emails. Covered by a DPA.
Where personal data is transferred outside the EEA, such transfers are safeguarded by SCCs and/or the EU-US Data Privacy Framework. Further detail on international transfers is provided in the Platform's Privacy Notice.
8. Your rights
You have the rights granted by Articles 15 to 22 GDPR: to access your data, and to seek its rectification, erasure, restriction of processing, portability, and to object to processing. To exercise these rights, contact us at data.protection@weareact3.com.
You also have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction.
9. Future changes to sign-in
Sign-in to the Platform may in future move to a single sign-on (SSO) arrangement. If and when that change is made, additional strictly-necessary authentication cookies operated by the SSO provider may be set as part of the sign-in flow, and this Policy will be updated to reflect it before the change takes effect.
10. Changes to this Policy
We may update this Cookie Policy from time to time, for example if we change our session-management technology or move sign-in to a single sign-on provider. The current version will always be available on the Platform, and the "Last updated" date at the top will reflect the most recent revision. Material changes will be communicated through the Platform or by other appropriate internal means.
11. Contact
Questions about this Cookie Policy or our use of cookies can be directed to:
act.3 GmbH Käthe-Dassler-Straße 2, 91074 Herzogenaurach, Germany Data protection contact: data.protection@weareact3.com