Cookie Policy
Last updated: October 2026
This page explains how Shards Cybersecurity uses cookies and similar technologies on this website. The short version: this site sets no cookies of its own. It keeps a few small entries in your browser, and only for things you do: one remembers that you dismissed our cookie notice, and our two self-checks, the NIS2 policy builder and the NIS2 supplier contract check keep your answers while the tab is open, so a reload doesn't lose them. These entries stay on your device; a self-check sends your answers to us only if you submit its form to get your summary. Visitors in the EU get no analytics script (see section 3). What is stored is strictly necessary for something you asked for, so under the EU ePrivacy rules (in Slovakia, section 109(8) of Act No. 452/2021 on electronic communications) it needs no consent, and there is no accept/reject choice to make — this page simply lists what runs.
1. What are cookies?
Cookies are small text files placed on your device by the websites you visit. They are widely used to make sites work, or work more efficiently, and to provide reporting information.
2. What we store in your browser
The notice entry sits in your browser's local storage. The self-check, policy builder and contract check entries sit in session storage, which your browser normally clears when you close the tab. Neither is a cookie, but the same rules apply, so they are listed here in full. The only cookie you could ever get here is Cloudflare's security-check cookie, listed last; a normal visit never gets it.
| Entry | Purpose | Type | Duration |
|---|---|---|---|
| shards-cookie-consent | Remembers that you dismissed the cookie notice, so it isn't shown again. | Strictly necessary | Until you clear it (local storage) |
shards.nis2. shards.nis2. shards.nis2. | NIS2 readiness check: your answers, the scope you picked and where you stopped, so a reload doesn't lose them. Created when you answer your first question. | Strictly necessary | Normally until you close the tab, or until you start over (session storage) |
shards.supplier. shards.supplier. shards.supplier. | Supplier readiness check: your answers, the scope you picked and where you stopped, so a reload doesn't lose them. Created when you answer your first question. | Strictly necessary | Normally until you close the tab, or until you start over (session storage) |
| shards.kit. | NIS2 policy builder: your answers during the visit, so a reload doesn't lose them. Created when you give your first answer. | Strictly necessary | Normally until you close the tab, or until you start over (session storage) |
| shards.kit. | NIS2 supplier contract check: your answers and the fields you fill in during the visit, so a reload doesn't lose them. Created when you give your first answer. | Strictly necessary | Normally until you close the tab, or until you start over (session storage) |
| cf_clearance | Set by Cloudflare, which hosts and protects this site, only if its security check challenges your browser, so you aren't challenged again. A normal visit never gets it. | Strictly necessary | 30 minutes (cookie) |
3. Third-party services that load on this site
We use a small number of third-party services on this marketing website. None of them sets cookies on shardscybersecurity.io, and the two embeds only load after you click to load them — no request reaches the provider until you do:
- Cloudflare Web Analytics — a cookieless beacon (
static.cloudflareinsights.com/beacon.min.js) that counts page views and page-load times. Cloudflare leaves it out of pages served from its data centres in the EU, the EEA, Switzerland and the UK, which is where visits from those countries normally land. For other visitors it sets no cookies, stores nothing in the browser and does no fingerprinting. Cloudflare receives the visitor's IP address with each page view and discards it at its edge without storing it; we see only counts by page, referring site, country, browser and device, and page load times. - Google Maps embed — only on the /contact page, behind a “Load map” button. Once you load it, the iframe comes from Google's domains and may set Google's own cookies subject to Google's privacy policy. If you never click, nothing is requested from Google.
- Microsoft Bookings calendar — only on the /contact page, behind a “Load the booking calendar” button. Once you load it, the calendar comes from Microsoft's domains and may set Microsoft's own cookies subject to Microsoft's privacy statement. If you never click, nothing is requested from Microsoft.
Both services are described in more depth on /trust under “About this website”. The sub-processors of Vittnor — Supply Chain Assurance for the mid-market — are listed separately on the same page.
4. How to remove what is stored
On a self-check's results, “Start over” removes everything that check stored; in the NIS2 policy builder and the NIS2 supplier contract check, “Start over” removes the answers the tool keeps. Closing the tab normally clears them too, but a browser that reopens closed tabs or restores your last session can bring them back, and a self-check you haven't finished has no “Start over” yet. To remove everything this site stores at any time, clear your browser's site data for this domain. The self-checks and the two tools still work if you block site data; they just won't keep your answers through a reload. Most browsers let you block cookies and site data entirely; see the About Cookies site for instructions.
5. Contact
For questions about this policy, email privacy@shardscybersecurity.io.