Cookie Policies
1. Objective
The purpose of this document is to establish a clear, formal governance policy that outlines how anDREa B.V. (hereafter referred to as "anDREa") implements, manages, and audits HTTP cookies and state-tracking mechanisms across its web perimeters and application ecosystems. This policy guarantees that browser-state tracking aligns with data minimization principles, protects user privacy, and complies with ISO/IEC 27001:2023 Control A.08.11 (Data masking) and the General Data Protection Regulation (GDPR).
2. Scope
The scope of this document aligns directly with the overall scope of the ISMS as defined in Clause 4 (Context of the Organization). It specifically governs all cookies deployed by the core myDRE application infrastructure, as well as downstream third-party Software-as-a-Service (SaaS) integrations.
3. Availability and Access
This document is:
- Required reading for all anDREa employees and contractors.
- Available to all authorized interested parties and platform users via our public ISMS repository.
4. Cookie Classification and Operational Use
Cookies are temporary cryptographic text entities stored on a user's local endpoint (computer, tablet, or smartphone) during active web sessions. anDREa restricts its application footprints strictly to two functional taxonomies:
- Functional Cookies (Strictly Necessary): Cryptographic state indicators required to ensure reliable load balancing, maintain authenticated application sessions, and preserve localized user preferences.
- Analytical / Performance Cookies: Telemetry tokens that aggregate anonymous behavioral patterns to track platform stability, identify structural bugs, and monitor resource utilization.
5. Technical Consent and Banner Governance
- Consent Mechanism: Upon an external user’s initial network connection to an anDREa web application, the platform generates a programmatic cookie consent banner.
- Preference Mapping: The interface prevents the execution of non-essential analytical scripts until the visitor explicitly gives affirmative, granular consent to accept or modify their cookie preferences.
- Automated Liquidation: Browser state caches are configured to self-expire automatically based on the retention parameters defined in Section 6. Users can manually purge cookies or block local storage engines through the native privacy settings of their web browsers (e.g., Google Chrome, Mozilla Firefox, Microsoft Edge).
6. The myDRE Application Cookie Ledger
To maintain absolute compliance and operational transparency, all cookies deployed within the primary myDRE production application perimeter are registered within the centralized technical ledger below:
| Technical Cookie Name | Maximum Retention Lifespan | Primary Placer Entity | Functional Operational Purpose & Security Classification |
|---|---|---|---|
| ARRAffinity | End of active browser session | anDREa (Microsoft Azure Platform) | Strictly Necessary (Functional): Binds user requests to a specific routing node within the Windows Azure cloud infrastructure to maintain consistent server session routing. |
| ARRAffinitySameSite | End of active browser session | anDREa (Microsoft Azure Platform) | Performance & Security: Part of the Microsoft Application Insights software stack. Leverages the SameSite attribute to block Cross-Site Request Forgery (CSRF) vectors by governing cross-origin cookie transmission mechanics. |
| ai_session | End of active browser session | anDREa (Microsoft Application Insights) | Performance (Analytical): Houses a unique, anonymous session tracking token that maps real-time platform performance metrics for developer diagnostic reviews. |
| ai_user | 1 Year from initial session generation | anDREa (Microsoft Application Insights) | Performance (Analytical): Deploys a unique, anonymous user identification string to audit application adoption rates over time, distinguishing unique browsers without exposing PII. |
7. Third-Party SaaS Integrations (support.mydre.org)
The anDREa external help desk and institutional knowledge base located at support.mydre.org are driven by the Zoho Desk SaaS cloud provider.
- Platform Delineation: Because Zoho Desk operates as an isolated, third-party software environment, anDREa does not maintain code-level configuration rights over the underlying telemetry cookies deployed by that domain.
- Audit Transparency: Users are directed to review the official Zoho Cookie Policy directly via their public trust center (
https://www.zoho.com/privacy/cookie-policy.html) to audit their specific data handling and compliance perimeters.