EU Cookie & Local Storage Policy
Last updated: 24/09/2026
1. Introduction & Legal Framework
This Cookie & Local Storage Policy explains how W.S.A.P Events (“we,” “us,” or “our”, operated by Robin De Pauw) uses cookies, browser local storage (localStorage), and client-side privacy controls on https://wsapevents.be. This policy and our technical consent implementation are strictly compliant with the EU General Data Protection Regulation (GDPR - Regulation EU 2016/679), the EU ePrivacy Directive (Directive 2002/58/EC as amended), Belgian Data Protection Authority (APD / GBA) directives, and the Belgian Code of Economic Law (Boek XII).
- Radical Privacy Transparency: We only deploy tracking or telemetry cookies with your affirmative, unambiguous opt-in consent. The only storage that does not depend on consent is essential: your session, the booking flow, and Stripe's PCI-DSS fraud prevention, under Art. 6(1)(b) & (f). Our own site-traffic counting is deliberately NOT on this list because it stores nothing on your device at all. Section 3 describes it, and the Privacy Policy explains it in full.
- Strict Zero-Ad-Brokering: We do NOT license, sell, or transmit visitor data to third-party ad networks, data brokers, or retargeting exchanges.
- Automated Script Quarantine: Our open-source consent manager blocks external trackers and media embeds from loading until affirmative consent is confirmed.
2. EU Open-Source Consent Management (react-cookie-manager)
To ensure verifiable compliance with European privacy laws, W.S.A.P Events utilizes the open-source react-cookie-manager engine (licensed under MIT from hypershiphq/react-cookie-manager). This framework enforces the following compliance guarantees:
- Google Consent Mode v2 Integration: Emits default "denied" signals for analytics_storage, ad_storage, and personalization_storage before user interaction.
- Granular Category Opt-in: Visitors can selectively enable or disable specific categories (Analytics, Media, Advertising) independently.
- Persistent Revocation Mechanism: A floating cookie shield control is available in the bottom-left/right of every screen, allowing users to modify or revoke consent at any moment without penalty.
- Proof of Consent Record: User consent timestamps and specific category choices are stored locally in the "cookie-consent" token for 180 days.
3. Cookie Categories & Legal Grounds
Every storage token and cookie deployed on wsapevents.be is categorized into distinct functional buckets:
- Strictly Necessary & Security: Indispensable for event reservations, cart state, operator authentication, and security. Legal Basis: GDPR Art. 6(1)(b) & (f). Cannot be disabled.
- Stripe Payment Tokenization: Encrypted anti-fraud heuristics (__stripe_mid, __stripe_sid, m) ensuring secure Bancontact, card, Apple Pay and Google Pay processing under PSD2 SCA mandates.
- Analytics & Performance (Optional): governs optional COOKIE-based measurement. No such cookie is set today, so this category is off by default and enabling it currently changes nothing. Our own traffic counting sits outside this switch because it stores nothing on your device — no cookie, no IP address, and no identifier that survives the day. Legal Basis: GDPR Art. 6(1)(f) (Legitimate Interests) — aggregate statistics about our own website, with no profiling.
- Media & Video Embeds (Optional): Enables YouTube briefing videos, Vimeo walkthroughs, and Google Maps field topography. Quarantined until consented. Legal Basis: GDPR Art. 6(1)(a) (Consent).
- Commercial Advertising (Disabled): W.S.A.P Events enforces an absolute ban on third-party commercial ad networks.
4. First-Party Local Storage (W.S.A.P Events)
Our platform sets first-party client-side storage keys to deliver our airsoft command and ticketing capabilities:
- better-auth.session_token (Strictly Necessary): the signed, httpOnly session cookie. It is the only thing that proves you are signed in and no readable copy is exposed to page scripts. Retained 30 days, sliding.
- cookie-consent (Strictly Necessary): Stores your verified consent categories, the timestamp, and Google Consent Mode signals for 180 days.
- wsap_cart_items (Strictly Necessary): Preserves the passes in your cart (Day Pass, Weekend Pass, Rental Gear vs Own Gear, faction, add-ons) across checkout steps.
- wsap.unpaidOrder (Strictly Necessary): Remembers an order whose payment is incomplete — order number, amount outstanding, hold expiry and that order’s private confirmation token — so you can come back and pay before the seats are released. Deleted once the order is paid, and it never contains card data.
- wsap_current_user (Strictly Necessary): A display cache of your signed-in profile (display name, callsign, rank, membership tier). It is not a login: the session cookie above is what authenticates you.
- wsap_sponsors_data (Functional): legacy partner-deal cache. Live deals come from the API and member-only codes are only revealed server-side per request; this key may still exist in browsers that used an older version of the site.
5. Third-Party Infrastructure Services (Stripe, Google, Google Fonts)
A few mission-critical operations rely on external providers. These are all of them:
- Stripe, Inc. (__stripe_mid, __stripe_sid, m): PCI-DSS Level 1 payment processor. Detects card-testing bots and verifies merchant risk under PSD2 SCA. Domains: .stripe.com, m.stripe.com. Privacy: https://stripe.com/privacy.
- Google Ireland Limited (Sign-in with Google, optional): if you click "Continue with Google" your browser is redirected to Google, which authenticates you and returns your name, email address and profile picture to us. Google sees that you signed in to wsapevents.be and receives your IP address, and may set its own cookies on its own domains under its own policy. Use the email and password form instead and none of this happens.
- Google Ireland Limited (Web Fonts only): our typography is loaded from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address. Google Fonts sets NO cookies. Privacy: https://policies.google.com/privacy.
- Our own edge: the site is served by Caddy on our own server, with no third-party CDN, WAF or bot-management proxy in front of it, so no Cloudflare-type tokens exist. An earlier version of this policy listed __cf_bm and cf_clearance; they were never set.
6. Zero Commercial Tracking & Ad Privacy
W.S.A.P Events operates with an unyielding commitment to operator privacy:
- Zero Retargeting Pixels: No Facebook/Meta, TikTok, or LinkedIn tracking pixels are loaded on our site.
- Zero Fingerprinting: No canvas fingerprinting or cross-device profiling technologies are deployed.
- No Data Reselling: Your operator identity, registration details, and squad purchases are never sold or shared with advertisers.
7. How to Change or Revoke Consent
Under GDPR Art. 7(3), you have the absolute legal right to withdraw your consent at any time as easily as you gave it:
- Floating Cookie Button: Click the floating shield/cookie icon located at the edge of your screen to open the preference manager.
- Website Footer: Click the "Cookie Preferences" link located in the footer of every page.
- Clear Local Cache: Open the Cookie Policy in the footer and click "Clear Local Cache" or "Revoke Consent" to reset all stored decisions.
- Browser Controls: You can also manage or purge cookies directly through Chrome, Firefox, Safari, or Edge browser privacy settings.
8. Programmatic Backend API Endpoint
Anyone — a visitor, an auditor or a regulator — can check what this site actually stores, instead of taking our word for it:
- GET /api/cookies: the complete JSON registry of every first-party and third-party storage token, with its purpose, retention period and legal basis. Public, and no account is needed to read it.
- Consent status and revocation are deliberately NOT server endpoints. Consent is recorded in your own browser by the consent manager, so a server could neither truthfully report it nor change it — and one that claimed to would be worth less than the honest answer. To revoke, use the floating cookie control, the footer link, or clear site data (see Section 7).
9. Data Protection Officer & Contact
For questions regarding our privacy framework or to exercise GDPR rights (access, rectification, erasure, objection):
- Data Protection Contact: Robin De Pauw (W.S.A.P Events)
- Email: info@wsapevents.be
- Registered Address: Achterheide 39, Londerzeel, Belgium
- Supervisory Authority: Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD), Rue de la Presse 35, 1000 Brussels, Belgium (https://www.gegevensbeschermingsautoriteit.be).