Cookie Policy
Last updated: 06-10-2026
This Cookie Policy explains how ESIO uses cookies and similar technologies on esio.dk and in budget.esio.dk.
It supplements our Privacy Policy at https://esio.dk/legal/privacy, which explains how we handle personal data and describes your rights.
1 Who we are
ESIO ApS, CVR 45129756 with its registered address at Snedronningen 32, 5240 Odense NØ, Denmark, operates the website and application.
For questions about cookies or personal data, contact privacy@esio.dk.
2 What cookies are
Cookies are small pieces of information stored in your browser when you visit a website or use an online application. They can help maintain your login, remember choices or collect information about website usage.
First-party cookies are set on the domain you are visiting. Third-party cookies are set on another provider’s domain. A cookie’s purpose determines whether consent is required; first-party cookies are not automatically exempt.
Session cookies normally expire when your browser session ends. Persistent cookies remain until their expiry date or until you delete them.
Similar technologies, such as browser local storage, can also store information on your device. Where we use these technologies, they are covered by this policy.
3 Necessary cookies in the application
Our application uses authentication and session cookies to recognise signed-in users, maintain their login and associate requests with the correct account.
These cookies are necessary to provide the application functions you request. We do not ask for cookie consent for these necessary functions.
Recognising your account to maintain a login is separate from analysing your browsing behaviour for optional analytics.
We also use a first-party cookie named “klaro”, stored for 365 days, to remember your cookie consent choices.
On our public website, a first-party cookie named “.AspNetCore.Culture”, stored for 365 days, remembers the language you choose with the language flags. It is set only when you choose a language. Until you do, the front page opens in the language your browser asks for, and in Danish when your browser asks for neither Danish nor English; this uses the language preference your browser sends with every request and stores nothing on your device.
4 Analytics and marketing services on our public website
We use Microsoft Clarity on our public website to understand how visitors interact with our pages and improve the website’s usability.
Clarity uses cookies and similar technologies to associate page visits and interactions with a browser identifier. Depending on the features enabled, it can produce usage statistics, heatmaps and session recordings showing interactions such as clicks and scrolling.
Our Clarity project uses session recordings, heatmaps and the usage statistics Clarity derives from them. Clarity collects the page address and the referring page, the type of device, screen size, browser and operating system, the country derived from your IP address, page loading and error diagnostics, and your interactions with the page, such as clicks, scrolling, mouse movements, window resizing and text selection, together with the page structure needed to replay a session. Text you type into input fields is masked before it leaves your browser.
Information collected through Clarity is shared with Microsoft. See the Microsoft Privacy Statement for information about Microsoft’s handling of personal data.
We do not use Microsoft advertising features. Our configuration tells Clarity that advertising storage is denied and only analytics storage is granted, so Clarity sets no cross-site advertising identifiers on our website; a scan on 26 September 2026 with consent given found only the first-party cookies _clck and _clsk. Microsoft processes the information collected through Clarity as an independent controller for the purposes described in the Microsoft Privacy Statement.
Clarity is used on our public website, rather than within the signed-in budgeting application.
We activate Clarity only after you consent to the relevant optional tracking. Where this processing involves personal data, our legal basis is your consent under GDPR Article 6(1)(a).
Google Ads We use the Google Ads tag, provided by Google Ireland Limited, on our public website to measure whether our advertisements on Google led to a visit or a sign-up. It sets the cookies _gcl_au, _gcl_aw, _gcl_gs and _gac_gb_* on esio.dk for 90 days, which store the identifier of the advertisement you clicked, and it reports the visit and the sign-up to Google. Google also sets the cookies IDE and test_cookie on its own domain, doubleclick.net. Advertising storage, advertising user data and advertising personalisation are denied by default and granted only after you consent to optional marketing. Information collected is shared with Google and may be used by Google to attribute and personalise advertisements under Google’s Privacy Policy.
Meta Pixel We use the Meta Pixel, provided by Meta Platforms Ireland Limited, on our public website to measure our advertisements on Facebook and Instagram. It sets the cookie _fbp and, after a click on one of our advertisements, the cookie _fbc on esio.dk for 90 days, and it sends the pages you visit and events such as a page view to Meta, together with your IP address and browser information. Meta may also set the cookie fr on facebook.com. The Pixel is loaded only after you consent to optional marketing and is told to revoke that consent when you withdraw it. Meta may combine this information with your Facebook or Instagram account and use it for its own purposes under Meta’s Privacy Policy.
Umami session recordings and heatmaps With your consent we record visits to our public website with the recorder of Umami, the open-source software that we host ourselves at analytics.esio.dk. A recording shows the pages you opened, your clicks, your scrolling and the movement of your pointer, so that we can find and fix what is hard to use. Everything you type into a field is masked before it leaves your browser and is never recorded. Heatmaps are built from the recorded visits taken together and identify no individual visitor. The recorder sets no cookie and stores nothing in your browser, and the recordings never leave ESIO’s own servers in the EU and are shared with nobody. It is loaded only after you consent to optional analytics.
Like Clarity, these services run on our public website only, never within the signed-in budgeting application, and each is activated only after you consent to the relevant optional analytics or marketing tracking. Where this processing involves personal data, our legal basis is your consent under GDPR Article 6(1)(a).
Umami statistics We measure how our public website is used with Umami, open-source statistics software that we host ourselves at analytics.esio.dk. It sets no cookie and stores nothing in your browser. It counts page views, the referring page, campaign parameters in the address you arrived by, your country, device type, browser and operating system, clicks on our sign-up and newsletter buttons, which sections of a page came into view, how far you scrolled, how long the page was open in front of you and how fast it loaded, using a visitor identifier derived from your IP address and browser that changes every day. In the application we count, in the same way, only the public steps of signing up: that the sign-up page was opened, that a registration was accepted and that an address was confirmed, which lets us see which platform or campaign our sign-ups come from. The address of those pages is sent without its parameters, and nothing is counted once you are signed in. The information never leaves ESIO’s own servers in the EU. Because nothing is stored on your device, no cookie consent is requested for it; where this processing involves personal data, our legal basis is our legitimate interest in understanding how our website is used, GDPR Article 6(1)(f).
5 Cookies and storage technologies we use
The table below identifies the cookies and similar technologies used by the website and application.
The table reflects the configuration in force on 6 October 2026 and a cookie scan carried out on 26 September 2026.
| Cookie or storage name | Provider and domain | Purpose | Lifetime | Category |
|---|---|---|---|---|
| .AspNetCore.Identity.Application | ESIO ApS / budget.esio.dk | Recognises the signed-in account and maintains authentication. | Browser session. The server-side login expires after 8 hours of inactivity and is extended while you use the application. | Necessary |
| .AspNetCore.Antiforgery.<id> | ESIO ApS / budget.esio.dk | Protects the application’s forms against forged requests from other websites. | Browser session | Necessary |
| klaro | ESIO ApS / esio.dk | Remembers your cookie consent choices. | 365 days | Necessary |
| .AspNetCore.Culture | ESIO ApS / budget.esio.dk | Remembers the language and region you chose in the application. | Browser session | Necessary |
| .AspNetCore.Culture | ESIO ApS / esio.dk | Remembers the language you chose with the language flags on the website. | 365 days | Necessary |
| esio-theme (browser local storage) | ESIO ApS / esio.dk and budget.esio.dk | Remembers your light or dark theme choice. | Until you delete it | Necessary |
| None (Umami statistics) | ESIO ApS / analytics.esio.dk | Cookieless usage statistics of esio.dk and of the public sign-up steps of budget.esio.dk; no cookie or storage is used, so nothing is stored on your device. | Not applicable | No consent required |
| None (Umami session recordings and heatmaps) | ESIO ApS / analytics.esio.dk | Records clicks, scrolling and page views of a visit, with typed text masked; no cookie or storage is used. | Not applicable | Optional analytics |
| _clck | Microsoft Clarity / esio.dk (set for esio.dk and its subdomains) | Remembers a browser identifier and Clarity preferences for this website. | 365 days | Optional analytics |
| _clsk | Microsoft Clarity / esio.dk (set for esio.dk and its subdomains) | Groups page views into a Clarity session. | 1 day | Optional analytics |
| CLID, ANONCHK, MR, MUID, SM | Microsoft Clarity / clarity.ms, bing.com (third-party) | Cross-site identifiers used by Microsoft for advertising and synchronisation across Microsoft services. Not set in our configuration: advertising storage is denied, and the scan of 26 September 2026 found none. | Not applicable | Not used |
| _gcl_au, _gcl_aw, _gcl_gs, _gcl_dc, _gac_gb_* | Google Ads / esio.dk | Attributes visits and sign-ups to our Google Ads advertisements. | 90 days | Optional marketing |
| IDE | Google Ads / doubleclick.net (third-party) | Identifies the browser to Google’s advertising servers so that a sign-up can be attributed to the advertisement you saw or clicked. | 13 months | Optional marketing |
| test_cookie | Google Ads / doubleclick.net (third-party) | Checks whether your browser accepts cookies. | 15 minutes | Optional marketing |
| _fbp | Meta Pixel / esio.dk | Identifies the browser to measure our advertisements on Facebook and Instagram. | 90 days | Optional marketing |
| _fbc | Meta Pixel / esio.dk | Stores the click identifier of a Facebook or Instagram advertisement that led you to our website. | 90 days | Optional marketing |
| fr | Meta Pixel / facebook.com (third-party) | Identifies your browser to Meta for delivering and measuring advertisements when you have a Facebook session. | 90 days | Optional marketing |
Microsoft lists additional cookies that may be associated with Clarity, including CLID, ANONCHK, MR, MUID and SM. Their presence and purposes must be reflected in the completed table where applicable. See Microsoft’s cookie documentation.
6 Cookie lifetimes and analytics retention
Cookie lifetimes are shown in the table above. A cookie’s expiry does not necessarily mean that information already collected using it has been deleted.
Microsoft currently describes the following retention periods for Clarity:
Session playback data: 30 days.
Labeled or favorited sessions: 9 months.
Heatmap and click data: 9 months.
These periods concern data held in Clarity, rather than the lifetime of cookies in your browser. See Microsoft’s data retention documentation.
ESIO does not export Clarity information or keep separate copies of it; we view it only in the Clarity dashboard, where Microsoft’s retention periods above apply.
Session recordings made with Umami are deleted 30 days after the visit. ESIO keeps no other copy of them.
Retention of other personal data is described in our Privacy Policy.
7 Accepting rejecting and withdrawing consent
When you first visit our website, our cookie banner lets you accept or reject optional cookies and tracking. Necessary cookies remain active to provide the functions you request.
You can change or withdraw your consent at any time by selecting the “Cookie Settings” link in the upper right menu button of our webpage.
The link reopens the consent controls with your current choices, and each optional service can be accepted or rejected separately.
Rejecting optional tracking does not prevent you from browsing our website or using the application’s essential functions.
When you withdraw consent, we stop the optional tracking concerned and update the consent status communicated to the relevant provider. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
You can also delete or block cookies through your browser settings. Blocking necessary authentication or session cookies may prevent you from signing in or using parts of the application. Deleting cookies may remove your saved consent choices, so you may be asked to choose again.
8 Where information is processed
Umami statistics, session recordings and heatmaps are processed on ESIO’s own servers in the EU and are not transferred to anyone.
Information collected through third-party technologies may be processed outside Denmark, including outside the EU/EEA.
Microsoft Clarity stores its data in the Microsoft Azure cloud. As an EU customer we contract with Microsoft Ireland Operations Limited, which transfers the data to Microsoft Corporation in the United States under the European Commission’s standard contractual clauses; Microsoft Corporation is also certified under the EU-U.S. Data Privacy Framework. Google Ads processes information in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. The Meta Pixel sends information to Meta Platforms Ireland Limited, which transfers it to Meta Platforms, Inc. in the United States under the EU-U.S. Data Privacy Framework. Our own website and application are hosted by Hetzner Online GmbH in Helsinki, Finland, within the EU/EEA.
For further information about recipients, international transfers and your data protection rights, see our Privacy Policy at https://esio.dk/legal/privacy/. You can also contact privacy@esio.dk for information about applicable safeguards and how to obtain a copy.
9 Changes to this policy
We update this policy when the cookies, providers or purposes we use change. The date above identifies the current version.
Where a change requires new consent, we will request it before activating the relevant optional tracking.