Zásady používania súborov cookie

This Cookie Policy explains what cookies, browser storage and similar technologies we use on ryanwear.net (the "Site"), why we use them, the legal bases for using them, and how you can control them. It should be read together with our Privacy Policy and our Imprint. This policy is provided for transparency and forms part of how we comply with the EU ePrivacy Directive (2002/58/EC, as amended), the German Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), the EU General Data Protection Regulation (GDPR), applicable US state privacy laws and, for UK visitors, the UK Privacy and Electronic Communications Regulations 2003 (PECR) read with the UK General Data Protection Regulation (UK GDPR, as amended by the Data (Use and Access) Act 2025), enforced by the Information Commissioner's Office (ICO).

1. Who we are

Seller / website operator / data controller: Ryan Wear LLC, 5203 Juan Tabo Blvd STE 2B, Albuquerque, New Mexico 87111, USA. Email: service@ryanwear.net. Ryan Wear LLC is the seller and merchant of record for all orders worldwide and is the data controller under the GDPR for personal data collected through the Site. Because Ryan Wear LLC is established in the United States, personal data collected through the Site — including device, cookie and consent data — is processed in the USA; see Section 9 (International transfers).

For EU/EEA visitors, our EU contact is Franotech OÜ, Rotermanni tn 6, 10111 Tallinn, Estonia. Franotech OÜ acts in two distinct data-protection capacities: as our EU Representative under Article 27 GDPR (the point of contact for data subjects and supervisory authorities in the EU/EEA on behalf of the non-EU controller) and, per our internal arrangement, as our EU data-protection contact / Data Protection Officer (DPO) (a voluntary EU data-protection point of contact; this is not a formal designation of a Data Protection Officer under Articles 37–39 GDPR). These are technically separate roles under the GDPR (Article 27 representative versus the DPO contact role), and Franotech OÜ serves in both. EU/EEA residents may contact Franotech OÜ for all data-protection matters, including those relating to cookies. Franotech OÜ also acts as our authorised EU distributor and as the EU responsible economic operator / product-safety responsible person (GPSR) under the EU General Product Safety Regulation (Regulation (EU) 2023/988); those product-safety roles are described in our Imprint. Full entity details and contact channels are set out in our Imprint and Privacy Policy.

For UK visitors, the supervisory authority is the Information Commissioner's Office (ICO), and our UK Article 27 representative (a separate appointment from Franotech OÜ; see our Imprint and Privacy Policy) is the UK point of contact for data-protection matters, including those relating to cookies. Franotech OÜ does not act as our UK representative.

2. What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to store on your device. When you return, the cookie can be read back, which lets the site remember things (such as your preferences) or recognise your browser. Cookies set by the website you are visiting are called first-party cookies; cookies set by another domain (for example an analytics or advertising provider) are called third-party cookies.

We also use technologies that are not cookies in the technical sense but are treated the same way under data-protection and ePrivacy law because they store or read information on your device:

• Local storage (localStorage): a browser storage area, similar to cookies but with a larger capacity, that keeps information on your device until it is cleared. We use localStorage for your shopping cart, your cookie-consent choice, and your display preferences (accessibility settings, light/dark theme and reading mode). All of these are strictly necessary or functional; none is a tracking technology and none is sent to advertisers.
• Session storage, pixels/web beacons, software development kits (SDKs) and similar identifiers: small files or scripts that may be used to measure activity or, where you have consented, for marketing. Any such technology that is not strictly necessary is used only after you opt in.

In this policy, "cookies" means cookies and all of the similar technologies described above, unless we say otherwise.

3. How consent works on this Site

We use a granular consent banner that appears the first time you visit and whenever no valid consent choice of the current version is stored on your device. It lets you accept all cookies, reject all non-essential cookies, or customise exactly which categories to allow. Our consent model follows the GDPR and the ePrivacy rules:

• Strictly Necessary cookies and storage are always on. They are required for the Site to work and do not need your consent (they are exempt under Article 5(3) of the ePrivacy Directive / § 25(2) TDDDG).
• Analytics and Marketing cookies are switched off by default and are set only after you give your prior, freely given, specific and informed consent via the banner.
• No analytics or marketing cookies are set before you make a choice. If you ignore the banner and continue browsing without selecting an option, the default state is "reject" for non-essential categories: no tag in the Analytics or Marketing category may store anything on your device or send any measurement data until you affirmatively opt in. Google's tag container itself is loaded on every page view from our own domain with all analytics and advertising storage pre-set to denied — see Section 5.
• We do not use pre-ticked boxes, and we do not treat continued browsing or scrolling as consent for non-essential cookies. The banner does not have a dismiss / close control that records consent; you make an active choice by selecting "Accept all", "Reject non-essential", or saving your preferences in "Customize".
• The "Accept all" and "Reject non-essential" options are presented together on the first layer of the banner with equal prominence — the same size and format — so that rejecting non-essential cookies is exactly as straightforward as accepting them.
• Your consent choice is recorded with a timestamp so that we can honour it and remember it across pages.

UK visitors (PECR and UK GDPR)

For UK visitors, non-essential cookies are set only with prior opt-in consent under regulation 6 PECR read with the UK GDPR — consent that is freely given, specific, informed and unambiguous, with no pre-ticked boxes. Strictly-necessary cookies are exempt from this consent requirement. We do not rely solely on the ePrivacy Directive / TDDDG citations for UK users.

Under changes to PECR that took effect on 5 February 2026 (Data (Use and Access) Act 2025), certain low-risk cookies used solely for listed purposes (for example first-party analytics, or site appearance/functionality) may be set without prior consent provided clear information and a free opt-out are given. Advertising and cross-purpose cookies still require opt-in consent. This is a limited exemption for specified low-risk purposes; it does not remove our consent duties generally. We now run Google Analytics 4 (analytics) and Google Ads (advertising) tags, and we treat both as strictly opt-in: we do not rely on this DUAA low-risk exemption for analytics, so — for UK visitors as for everyone else — no analytics or advertising cookie is set, and no analytics or conversion data is sent to Google, until you give prior consent via the banner. Google's tag container itself is served from our own domain on every page view with all analytics and advertising storage pre-set to denied; see Section 5 for exactly how that works and for the one technical request made to Google before consent.

Our banner standard — reject-by-default, with "Reject all" / "Reject non-essential" as easy and as prominent as "Accept all", no non-essential cookies firing before consent, no pre-ticked boxes, and the Global Privacy Control (GPC) signal honoured — also satisfies UK PECR requirements and ICO expectations.

Re-asking for your consent

Your consent does not last indefinitely. After a set period we will ask you again so that your choice stays current:

• Your stored consent expires after 12 months, after which the banner reappears and you can renew or change your choice.
• We will also show the banner again if we materially change the cookies we use (in which case the stored consent version is updated).

Changing or withdrawing your consent

You can change your choices or withdraw your consent at any time, and withdrawing is as easy as giving consent:

• Click the "Cookie settings" link in the footer of any page. This reopens the consent panel where you can turn Analytics and Marketing on or off and save your new choice.
• Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
• You can also delete cookies and clear local storage directly in your browser (see Section 8). If you clear your stored consent choice, the banner will appear again on your next visit.

Your consent choice is itself stored on your device as a strictly necessary record (the `ryanwear-consent-v1` entry described below) so that we can honour your decision and avoid re-prompting you unnecessarily within the 12-month period above.

Global Privacy Control (GPC)

Our Site honours the Global Privacy Control (GPC) browser signal. If your browser or extension sends a GPC signal, we treat it as an automatic opt-out of Analytics and Marketing cookies — those categories stay switched off without any further action from you, and (for US residents) GPC is also treated as a valid opt-out of the "sale" or "sharing" of personal information and of targeted advertising (see Section 10). Strictly Necessary cookies and storage remain on, as they are exempt from consent.

How we keep a record of consent

We keep a record of your cookie-consent choice and the time you made it (stored in your browser's local storage as the `ryanwear-consent-v1` entry described below), so that we can honour your decision and demonstrate consent where required under Article 7(1) GDPR. You can delete this record at any time through your browser, in which case the banner will appear again on your next visit.

4. Cookie categories

The table below explains the categories used by our consent banner.

5. Cookies and storage in use today

The following table lists the cookies and similar storage actually used by the Site at the date of this policy. Items marked as set only after consent are not active unless you opt in via the banner.

We use Google Tag Manager to load and manage our measurement and advertising tags. Through it we run Google Analytics 4 (Analytics category) and Google Ads conversion and remarketing tags (Marketing category). No analytics or advertising cookie is set, and no analytics, conversion or remarketing data is sent to Google, until you opt in to the Analytics or Marketing category via the banner.

How that is enforced. Before anything else runs on the page, we set Google Consent Mode v2 to `denied` for `analytics_storage`, `ad_storage`, `ad_user_data`, `ad_personalization` and `personalization_storage`. Only `functionality_storage` and `security_storage` (strictly necessary) are granted. We also enable Google's ads data redaction while advertising consent is denied. On top of that signal, the Google tag container is not fetched at all until you opt in to the Analytics or Marketing category: if you ignore the banner or reject it, no Google tag is ever loaded onto the page, so there is nothing that could store or transmit anything.

Nothing is sent to Google before you consent. Until you opt in to Analytics or Marketing, the Site makes no request of any kind to Google, and no Google cookie is set. Your IP address, user agent and the address of the page are not disclosed to Google. If you never opt in, Google receives nothing about your visit at all.

After you opt in — measurement runs through our own server. We operate a tagging server on our own domain (`s.ryanwear.net`), a technique known as *server-side tagging*. Once you have consented: the tag container and the Google tag library are loaded from that domain instead of Google's CDN, and Google Analytics 4 measurement data is sent to our tagging server, which processes it and forwards it to Google server-to-server. Our tagging server is hosted on our own infrastructure in the Netherlands; our hosting provider acts as our processor for operating it, and Cloudflare delivers and protects it in the same role it plays for the rest of the Site. One exception: Google Ads conversion and remarketing data is still sent directly from your browser to Google's own domains (`www.google.com`, `googleads.g.doubleclick.net`, `ad.doubleclick.net`) and is not routed through our server. A single technical request to `www.googletagmanager.com` accompanies first-party serving of the container; because the container is only loaded after consent, that request happens only after you have opted in. Google acts as our processor for Google Analytics and, for the Google Ads conversion and remarketing features, as an independent controller under its own advertising terms (see Sections 7 and 9). Google Tag Manager itself sets no cookies — the cookies come from the tags listed above.

If you withdraw consent. We signal the withdrawal to Google and the tags stop using cookies and stop sending measurement data. A container that has already been fetched cannot be removed from the page you are currently on; it takes effect immediately as a consent signal and fully on your next page load.

The only Marketing-category cookie set by us directly is the first-party affiliate-referral cookie `rw_aff` above. If we add further analytics or marketing tools, they will only load after you opt in, and this policy will be updated first.

We embed product videos hosted by Gumlet Pte. Ltd. (Singapore). These appear in the "Video in Action" tab on product sections. Because the Gumlet player is a third-party embed that sets its own cookies, it is treated as a Marketing technology: the player is not loaded, and no request or cookie reaches Gumlet, until you opt in to the Marketing category via the banner. Until you do, we show a static placeholder with a button that reopens the cookie settings, so you can choose to enable and play the video. Gumlet processes video-playback data under its own privacy notice (https://www.gumlet.com/privacy); any specific Gumlet cookies present in your browser are reflected in the table above.

The exact Cloudflare cookies present, and their durations, may vary with Cloudflare's configuration and security state; the entries above reflect Cloudflare's documented strictly necessary security cookies. The exact set and duration of the Google cookies may likewise vary with Google's configuration; the international-transfer safeguards that apply to Google are set out in Section 9. We will update this table when we add or change any cookies.

6. Payments and content delivery

When you place an order, payment is processed by Revolut (Revolut Merchant payment gateway). Payment data is handled by Revolut under its own privacy notice (https://www.revolut.com/legal/privacy/); Revolut is PCI-DSS compliant and we do not store your full card number. Completing a payment may involve cookies or similar technologies set by Revolut in connection with the checkout to process the transaction securely and to prevent fraud; any such cookies that are actually set in your browser via the Site will be added to the inventory in Section 5, together with their category and our assessment of whether they require consent.

Our content is delivered through Cloudflare, acting as our CDN, reverse proxy and security layer (see the strictly necessary security cookies above). Cloudflare sits in front of our tagging server (`s.ryanwear.net`) in that same role, so once you have opted in, the Google Analytics measurement data you send to us passes through Cloudflare's network in transit on its way to our server. Cloudflare acts as our processor for that delivery and does not use the data for its own purposes. Our product videos are hosted and streamed by Gumlet; the embedded Gumlet player is a Marketing-category technology that loads only after you opt in, as described in Section 5. For details of how these and other providers process personal data, please see our Privacy Policy.

7. Legal bases for cookies and related processing

We rely on the following legal bases. Note that ePrivacy/TDDDG governs the storing of and access to information on your device, while the GDPR governs any subsequent processing of personal data — these are two separate layers:

• Analytics and Marketing cookies (and the related processing): your consent under Article 5(3) of the ePrivacy Directive / § 25(1) TDDDG for the storage/access, and Article 6(1)(a) GDPR for the subsequent processing. You may withdraw this consent at any time (see Section 3).
• Shopping cart and your consent record: these are exempt from the consent requirement because they are strictly necessary to provide the service you have actively requested (§ 25(2) TDDDG). The related processing of any personal data is based on performance of a contract or steps taken at your request, Article 6(1)(b) GDPR, and on our handling of your own consent decision — not on legitimate interest.
• Security / anti-abuse cookies (e.g. the Cloudflare security cookies): exempt from consent as strictly necessary (§ 25(2) TDDDG); the related processing is based on our legitimate interest in a secure and functioning Site, Article 6(1)(f) GDPR.
• For UK visitors, the storing of and access to information on your device is governed by regulation 6 PECR read with the UK GDPR: non-essential cookies are set only after your prior opt-in consent (the equivalent UK lawful basis for the related processing being your consent under Article 6(1)(a) UK GDPR), while strictly-necessary cookies are exempt. See Section 3 (UK visitors) for how this — and the limited DUAA 2025 low-risk exemption from 5 February 2026 — applies.

8. How to control cookies in your browser

In addition to our "Cookie settings" panel, you can control or delete cookies and clear local storage through your browser. Most browsers let you block all cookies, block third-party cookies only, delete existing cookies, or alert you when a cookie is set. Blocking strictly necessary cookies and storage may stop parts of the Site (such as the shopping cart) from working.

You can find instructions in your browser's help pages. The following links are provided as illustrative starting points; the exact location of cookie controls changes over time, so use your browser's current help/privacy settings if a link has moved:

• Google Chrome cookie settings
• Mozilla Firefox cookie settings
• Apple Safari privacy settings
• Microsoft Edge cookie settings

Many browsers also offer a private/incognito mode and a "Do Not Track" or "Global Privacy Control" (GPC) signal. We honour the GPC signal as an automatic opt-out of Analytics and Marketing cookies (see Section 3) and, for US residents, of the sale/sharing of personal information and targeted advertising (see Section 10). In all cases, our consent banner controls whether non-essential cookies are set.

9. International transfers

Personal data is processed in the United States (by Ryan Wear LLC) and via Cloudflare's global content-delivery and security network. Because Ryan Wear LLC is established in the United States, personal data collected through the Site is transferred to and processed in the USA, which is a country outside the EU/EEA. In addition, our Analytics and Marketing tags are provided by Google — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with data processed by Google LLC (1600 Amphitheatre Parkway, Mountain View, California, USA). Where you consent to Analytics or Marketing, Google may transfer personal data (such as cookie/device identifiers and, for advertising, ad-interaction data) to the USA. No data of any kind is transferred to Google unless you opt in — before consent your browser does not contact Google at all (Section 5). After you opt in, Google Analytics data reaches Google via our own tagging server in the Netherlands, while Google Ads conversion and remarketing data goes to Google directly.

For transfers of EU/EEA personal data to the USA and other third countries, we rely on the EU–US Data Privacy Framework where a recipient is certified, and otherwise on EU Standard Contractual Clauses. Google LLC is certified under the EU–US Data Privacy Framework, and we rely on that certification (with Google's Standard Contractual Clauses as a fallback) for the transfers arising from Google Analytics and Google Ads. Some EU supervisory authorities have found that certain standard deployments of US analytics and advertising tools require additional safeguards; for that reason, and consistent with our promise above, no Analytics or Marketing cookie is set, no tag is loaded and no data is sent to Google until you opt in via the consent banner. Serving the container, and routing Google Analytics measurement, through our own tagging server in the Netherlands (Section 5) means that the data reaches Google from our server rather than directly from your browser; it does not change the fact that Google receives it, nor the safeguards that apply to that transfer. Google Ads conversion and remarketing data is transmitted from your browser to Google's own domains.

For transfers of UK personal data to the USA and other third countries — including the routing of UK cookie and device data through US-based sub-processors such as Cloudflare (and, at checkout, Revolut) — we rely on the ICO International Data Transfer Agreement (IDTA) or, where the EU Standard Contractual Clauses are used, those clauses together with the ICO's UK International Data Transfer Addendum, supported by a documented transfer risk assessment. We do not rely on the UK–US "data bridge" (the UK Extension to the EU–US Data Privacy Framework) unless the specific US recipient is actually certified to the Data Privacy Framework under its UK Extension. The IDTA cannot satisfy EU GDPR and the EU Standard Contractual Clauses alone cannot satisfy UK GDPR — each mechanism is named for the jurisdiction it covers.

Further detail on international transfers, including how to obtain a copy of the relevant safeguards, is set out in our Privacy Policy.

10. Your rights — EU/EEA, United Kingdom and United States

EU/EEA residents

EU/EEA residents have the right to access, rectify, erase, restrict and object to the processing of their personal data, the right to data portability, and the right to withdraw consent at any time, as well as the right to lodge a complaint with their local supervisory authority. You may exercise these rights, and contact our EU Representative / data-protection contact Franotech OÜ, as described in our Privacy Policy and Section 11 below.

UK residents

UK residents have, under the UK GDPR, the right to access, rectify, erase, restrict and object to the processing of their personal data, the right to data portability, and the right to withdraw consent at any time. You may exercise these rights via service@ryanwear.net or through our UK Article 27 representative (see our Imprint and Privacy Policy).

You also have the right to complain to the ICO (https://ico.org.uk/make-a-complaint/; helpline 0303 123 1113). Under the Data (Use and Access) Act 2025 you may also complain to us first — we operate a data-protection complaints process, and raising the matter with us gives us the chance to resolve it before you approach the ICO.

United States residents

Depending on your state of residence (for example California, Colorado, Connecticut and Virginia), you may have rights to know about, access, correct and delete personal information, and to opt out of the "sale" or "sharing" of personal information and of targeted/cross-context behavioural advertising. Our Marketing category, which can involve cross-site identifiers and advertising on third-party platforms, may constitute a "sale" or "sharing" / "targeted advertising" under those laws.

• You can exercise the opt-out for the Marketing category through our "Cookie settings" panel (selecting "Reject non-essential" or turning Marketing off).
• Global Privacy Control (GPC): we honour a recognised opt-out preference signal (such as GPC) and treat it as a request to opt out of the sale/sharing of personal information and targeted advertising for the Marketing category. When your browser sends a GPC signal, the Analytics and Marketing categories stay switched off automatically.
• Additional US rights, the categories of personal information involved, how to submit a request, and any "Do Not Sell or Share My Personal Information" mechanism are described in our Privacy Policy.

11. Contact

For questions about this Cookie Policy or our use of cookies, contact us at service@ryanwear.net, or write to Ryan Wear LLC, 5203 Juan Tabo Blvd STE 2B, Albuquerque, New Mexico 87111, USA. EU/EEA residents may also contact our EU Representative and data-protection contact, Franotech OÜ, Rotermanni tn 6, 10111 Tallinn, Estonia (email: service@ryanwear.net). UK residents may also contact our UK Article 27 representative (see our Imprint and Privacy Policy; email: service@ryanwear.net), which is a separate appointment from Franotech OÜ.

12. Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use or in the law. When we make material changes, we will update the policy and, where required, ask for your consent again through the banner. The version in force is the one published on this page, under the "Last updated" date shown at the top.

Disclaimer: This Cookie Policy is provided for transparency and general information. It does not constitute legal advice. If you need advice on your specific situation, please consult a qualified professional.