-Lemon-Flavored-uitgesneden-image_square.png)
Je winkelwagen is leeg
Ga naar de shop
Version 1.0.0 · Last updated 6 August 2026
Cookies are small data files stored by a website or service in your browser.
We also use related technologies, including browser storage, advertising identifiers, server-side event identifiers and a server-side consent register.
This policy covers the cookies and identifiers that Victus currently sets or reads on victus.sport.
Necessary cookies record and enforce your privacy choice and support the operation and security of the website.
These cookies are not used for analytics or advertising and remain available regardless of your optional choices.
Analytics technologies measure how the storefront is used. This includes Google Analytics, Hotjar and Lucky Orange.
Analytics cookies, identifiers, session recordings and heatmaps require analytics consent. The limited Google cookieless pings described in section 6 continue when analytics consent is refused.
Marketing technologies measure advertisements, attribute affiliate or advertising conversions, build advertising audiences and support personalised advertising.
This includes Meta, Google Ads and Tapfiliate. Marketing cookies, identifiers and events require marketing consent.
We use two optional categories: analytics and marketing.
The consent banner allows you to accept the optional categories or open the preferences dialog.
In the preferences dialog, analytics and marketing are shown as separate controls. Both controls are initially selected, but you can turn either or both off before confirming your choice.
Analytics and marketing cookies, browser storage and identifiable tracking do not become active until you confirm a choice.
You can change or withdraw your choice at any time by using the cookie-settings button in the website footer.
When you withdraw consent:
We use Google Advanced Consent Mode. Refusing analytics and marketing does not stop all requests to Google. Google continues to receive the cookieless pings described in section 6.
Most Victus cookies are HttpOnly. This means browser scripts cannot read them. A cookie is readable by browser code only where the consent interface needs access to it.
| Cookie name | Who sets it | Purpose | Category | Duration | Does associated data leave the EU? |
|---|---|---|---|---|---|
victus_consent |
Victus | Stores the analytics and marketing decision and the applicable notice version so the website can enforce the choice. | Necessary | 6 months | Not through the cookie itself. Normal website requests may be processed by Cloudflare outside the EU. |
victus_consent_id |
Victus | Holds the identifier that links your browser to the consent record described in section 8, so a later withdrawal can be applied to the decision you actually made. | Necessary | 6 months | No. |
victus_consent_denied |
Victus | Records that optional categories were refused so the refusal can be respected without repeatedly requesting the same choice. | Necessary | 6 months | Not through the cookie itself. Normal website requests may be processed by Cloudflare outside the EU. |
victus_consent_update |
Victus | Provides a short-lived signal that a privacy choice changed so browser-side services can start, stop or clear storage as required. | Necessary | 10 minutes | No. |
victus_meid |
Victus | Provides a first-party marketing event identifier used to match and deduplicate browser-side and server-side marketing events, including Meta events. | Marketing | 2 years | Yes. When marketing consent is active, the identifier may be sent to Meta in the United States. |
victus_attribution |
Victus | Stores affiliate or referral attribution so a purchase can be connected to the relevant referring partner. | Marketing | Until the browser session ends unless a longer period is set by the referral link | No under the current Tapfiliate processing setup, which is based in the European Economic Area. |
victus_gclid |
Victus | Stores Google advertising click attribution, including relevant Google click identifiers, so consented purchases can be attributed to an advertisement. | Marketing | 90 days | Yes. Associated conversion data may be sent to Google in the United States. |
_ga |
Google Analytics through the Google tag on victus.sport | Stores a Google Analytics client identifier used to distinguish browsers and measure visits and ecommerce activity. | Analytics | Up to 2 years, set by Google | Yes. Analytics information may be processed in the United States. |
_gcl_* |
Google Ads through the Google tag on victus.sport | Stores Google advertising and conversion-linker information used to measure advertisement interactions and conversions. | Marketing | Up to 90 days, set by Google | Yes. Advertising and conversion information may be processed in the United States. |
_fbp |
Meta through the Meta Pixel on victus.sport | Identifies a browser for advertising delivery, advertising measurement and audience services. | Marketing | 90 days, set by Meta | Yes. The identifier and associated events may be processed in the United States. |
_fbc |
Meta through the Meta Pixel on victus.sport | Stores Meta click-attribution information when a visitor reaches the website through a Meta advertisement. | Marketing | 90 days, set by Meta | Yes. The identifier and associated events may be processed in the United States. |
_hj* |
Hotjar | Maintains Hotjar session state, distinguishes sessions or browsers and supports session recordings and heatmaps. | Analytics | From the end of the browser session up to 365 days, depending on the specific Hotjar cookie | Yes. Hotjar processing may involve the United States. |
Some measurement and advertising events are sent from Victus servers rather than directly from your browser.
When marketing consent is active, Victus sends server-side events to Meta through the Conversions API.
The events may include:
Depending on the event, Meta may receive hashed email address, first name, last name, telephone number, city, state, postcode, country and customer identifier.
Meta may also receive fbp, fbc, IP address and user agent. The events use Meta dataset 274888676386578.
Meta Conversions API events stop when marketing consent is withdrawn.
When analytics consent is active, Victus may send subscription-renewal and refund events to Google Analytics through the Measurement Protocol.
These events may contain the Google Analytics client identifier, order identifier, event type and value.
These identifiable server-side events stop when analytics consent is withdrawn.
When marketing consent is active, a purchase may result in hashed email, telephone and address information being sent to Google Ads for enhanced conversion measurement.
Google click identifiers such as gclid, gbraid and wbraid are stored with the order so that a purchase can be attributed to an advertisement.
Enhanced-conversion data and stored advertising click identifiers are not used after marketing consent has been refused or withdrawn.
We use Google Advanced Consent Mode.
Google tags load before a visitor has accepted analytics or marketing. The initial consent state for the optional categories is set to denied.
When a visitor declines or leaves analytics and marketing denied, Google does not receive permission to set or read analytics or advertising cookies.
Google tags nevertheless continue to send cookieless pings to Google.
These pings contain the visitor's IP address and the URL of the page being visited. They also contain technical request information and the denied consent state.
Google uses the cookieless pings to model conversions. This allows Google to estimate advertising conversions and campaign results that cannot be measured directly because the visitor refused analytics or marketing cookies.
Refusing consent therefore has the following effect:
We do not describe refusal as stopping all Google data collection, because that would be incorrect.
Hotjar site 5240791 and Lucky Orange site 281e6eb1 operate only after analytics consent.
These services may record page navigation, scrolling, clicks, taps and similar interactions.
We mark sensitive parts of our own pages so that these services do not capture them. Delivery addresses, email addresses and account and address forms carry suppression markers that instruct Hotjar and Lucky Orange to exclude their contents from recordings. Password and payment fields are handled by our payment providers and are never rendered as ordinary form fields on our pages.
Recording retention is governed by the retention settings configured in each provider's account.
Withdrawing analytics consent stops active recording and clears analytics-related browser storage.
A cookie choice is also written to a durable server-side consent register.
The register contains:
We keep a consent record for as long as we may need to demonstrate which choice applied to you, and no longer than is necessary for that purpose. Section 10 of our Privacy Statement explains how we determine retention.
Meta, Google, Hotjar and Lucky Orange may transfer or make personal data accessible to recipients in the United States.
Where a US recipient has an active certification covering the relevant service under the EU-US Data Privacy Framework, a transfer may rely on the European Commission's adequacy decision for that framework.
Where the EU-US Data Privacy Framework is unavailable or does not cover the relevant transfer, the transfer is covered by the European Commission's Standard Contractual Clauses and, where required, additional safeguards.
Refusing analytics and marketing prevents optional transfers to Meta, Hotjar and Lucky Orange.
It also prevents Google from setting or reading analytics and advertising cookies, receiving enhanced-conversion information or receiving identifiable ecommerce measurement events from Victus.
Because Victus uses Google Advanced Consent Mode, refusal does not prevent every transfer to Google.
Google continues to receive cookieless pings containing the visitor's IP address and page URL for conversion modelling.
Refusal also does not prevent necessary connection and security processing by Cloudflare or transaction-related transfers that occur when you place an order and use a US-connected payment or fulfilment provider.
When a US visitor accepts marketing, Meta and Google may receive advertising identifiers, IP address, device and browser information, page URLs, product activity, checkout activity, purchase events and hashed customer information.
Meta and Google use this information for advertising activities including:
We do not enable Meta Limited Data Use or Google's Restricted Data Processing for US visitors.
Victus does not currently meet the statutory revenue, consumer-volume or sale-and-sharing thresholds that would make it a business subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
We nevertheless provide all US visitors with controls over our optional cookies and advertising services.
To stop Meta and Google's cookie-based advertising processing, customer matching and advertising audience building, turn marketing off in the consent banner or use the cookie-settings button in the website footer.
Turning marketing off stops Meta Pixel and Conversions API events, Google advertising cookies, stored Google click identifiers and Google enhanced conversions.
To stop Google Analytics cookies, identifiable analytics measurement, Hotjar and Lucky Orange, turn analytics off through the same controls.
These settings do not stop Google's cookieless pings.
Because Google Advanced Consent Mode remains active after refusal, Google continues to receive the visitor's IP address and page URL and uses these to model conversions.
The controls are offered as a Victus privacy choice. We do not present them as rights that Victus is currently required to provide under the CCPA or CPRA.
Use the cookie-settings button in the website footer to review, change or withdraw analytics and marketing consent.
You can also delete cookies through your browser.
Deleting the consent cookie may cause the banner to appear again. Browser deletion alone does not necessarily update the server-side consent register, so use the Victus cookie-settings control where possible.
Material changes are published as a new version with a new last-updated date and changelog entry.
The notice version stored in the consent register shows which version applied when a visitor made a choice.
What changed in this version: Initial version covering Victus cookies, third-party identifiers, consent withdrawal and Google Advanced Consent Mode.