This Policy sets out what https://jfloo.com/ stores on your device, why, and how you can change it. It sits alongside our Privacy Policy, which covers personal data more broadly.
Last updated: 18 September 2026
1. What this covers
A cookie is a small text file a website leaves in your browser so it can recognise you on the next page, or on your next visit. Everything below applies equally to your browser's local storage and to any other way of writing something to your device — the technology matters less than the fact that something is being stored.
2. The short version
We sort these files into two groups. Strictly necessary ones keep your basket from forgetting your order and open the site in the right language and the right city; they are set immediately and cannot be switched off from within the site. Everything else — analytics, advertising, and the note of where you arrived from — is set only after you press “Accept” in the consent banner.
You can check this rather than take our word for it. Before you decide, the only things on your device are the ones listed in section 3.1 — open your browser's developer tools and look at the cookie list. Choose “Essential only” and the list stays that way. This follows Article 5(3) of the ePrivacy Directive: without consent, only what is strictly necessary may be stored.
3. What we use
3.1 Strictly necessary — no consent needed
Name
What it does
Lifetime
PHPSESSID
Your session identifier. Without it the basket and checkout details do not survive from one page to the next. Marked HttpOnly, so scripts cannot read it.
Until you close the browser
default
A second identifier the shop uses to keep your data separate inside that session. Works together with the one above, also HttpOnly.
Until you close the browser
language
The site language you chose.
30 days
currency
The currency your prices are shown in.
30 days
currency_choice
Records that the currency was your choice rather than ours, so it is not overridden automatically.
30 days
city
Your delivery city. Range, prices and delivery times all depend on it, so the storefront cannot be assembled without it.
1 year
jfloo_city
The city you were in last time, used for the “Continue in …” prompt on the front page.
90 days
fi_consent
Your answer to the consent banner — accepted, or essential only. It exists precisely so that we do not ask again and so that a refusal is honoured.
180 days
fi_geo
The outcome of the region check — “EEA” or “rest of world”, with no country and no address. See section 3.4.
30 days
_pc, ANTIBOT_V
Records that your browser has passed our automated-abuse check so you are not asked to repeat it. Set only where that protection is switched on.
Up to 7 days
3.2 Functional — set only after consent
Name
What it does
Lifetime
blog_rated_*
Records that you have already rated a blog article, so the rating widget is not offered to you again.
1 year
3.3 Analytics, advertising and referral source — set only after consent
We would rather name these plainly than soften them: these are advertising and analytics technologies, and some belong to third parties who handle the data under their own rules.
Name
Who sets it, and why
Lifetime
_ga, _ga_*
Google Analytics 4: tells visitors apart and ties your page views into a single visit. It gives us traffic figures, popular products and the path to an order.
Up to 2 years
_gcl_au
Google Ads: connects a click on an advert with an order that follows, so we can see which advertising pays for itself.
90 days
test_cookie
A Google technical check of whether your browser accepts cookies at all. It carries no content.
About 15 minutes
_ym_uid, _ym_d, _ym_isad, _ym_visorc, bh
Yandex Metrica — see the note below the table. Not used for visitors from the EEA, the United Kingdom or Switzerland.
Up to 1 year
ref, engine, keyword
Where you came to us from: the address of the referring page and the search phrase from an advertising tag. They let the florist handling your enquiry see its source. This stays with us.
Until you close the browser
tracking
A partner link code, if you arrived through one.
Up to 1000 days
A note on Yandex Metrica. It runs a feature called Webvisor, which records how you behave on the page — cursor movement, scrolling, clicks and typing into form fields — and lets us replay the visit afterwards. Metrica processes this data in the Russian Federation. For visitors from the European Economic Area, the United Kingdom and Switzerland, Metrica is not loaded at all — neither the counter nor Webvisor — regardless of which language you are reading or which delivery city you picked. How we work that out is the next section.
3.4 How we work out your region
To decide whether Yandex Metrica may run at all, we need to know which country the site is being opened from. We determine that from your IP address, which is also how Google itself draws regional lines in its own consent mechanism. Neither the page language nor the delivery city would do: you might be reading the English version from inside the EEA, and your rights would be exactly the same.
The check happens on our own server against a local table matching address ranges to countries. Your IP address is not sent anywhere, no request goes out to any third party, and we do not keep the address for this purpose. All that reaches your browser is the verdict — “EEA” or “rest of world”, in the fi_geo cookie — so the check need not be repeated on every page. If the check fails for any reason, we treat you as being in the EEA and Metrica does not run.
Some pages embed content from others — a map, or a payment page. When you interact with it, that third party may set cookies of its own under its own rules, and those are outside our control. Payment pages are provided by our payment service providers and are governed by their terms.
4. Changing your mind
Withdrawing consent is as easy as giving it: press the button below and the banner comes back.
Withdrawal takes effect from the moment you press it and does not make anything done beforehand unlawful. Beyond that:
In your browser: every current browser lets you view, block and delete cookies — look under Settings → Privacy. Blocking the strictly necessary ones will break the basket and checkout.
On your device: clearing this site's data removes everything we have written, including your answer to the banner — we will ask again on your next visit.
5. Changes to this Policy
If what we store changes, we will update this page and the date at the top. If something new requires consent, we will ask before setting it.
6. Contact
Questions about this Policy, or about how we handle personal data: write to privacy@jfloo.com or call +66 6 353 777 86.
