BunnySteps — Cookie Notice

Last updated: 6 May 2026

1. What this Notice covers

This Cookie Notice explains how LOYALPLAY sp. z o.o. ("LOYALPLAY", "we") uses cookies and similar technologies on the website at bunnysteps.io and any subdomains we operate (the "Site"). It complements our Privacy Policy, which describes the rest of how we process personal data.

The BunnySteps mobile application does not use website cookies. The SDKs and similar technologies used inside the App are described directly in our Privacy Policy.

LOYALPLAY sp. z o.o., ul. Wolińska 4, 03-699 Warsaw, Poland — KRS 0001223867, NIP 5243064238, REGON 543987170 — is the data controller for cookies set on the Site.

2. What is a cookie?

A cookie is a small text file that a website places on your device (computer, tablet, or phone) when you visit. It allows the website that issued it (a "first-party cookie") or a third party (a "third-party cookie") to recognise your device on a return visit, remember your preferences, count visits, or build a picture of how the site is being used.

In this Notice, "cookies" also covers similar technologies — including pixels, tracking tags, web beacons, local storage, and SDKs — that perform comparable functions, even when no actual file is stored on your device.

3. Categories of cookies we use

We classify cookies into the following categories:

3.1 Strictly necessary cookies

These are required for the Site to function — for example, to remember your cookie-consent choice, to maintain a session, to detect the language and country we should serve, and to protect against abuse and fraud. Without these, basic features of the Site will not work.

Strictly necessary cookies do not require your consent under the EU/UK ePrivacy framework or Polish telecommunications law.

3.2 Analytics cookies

These help us understand how visitors interact with the Site — which pages are visited, how long people stay, which links they click. We use this data to improve the Site.

These cookies are set only if you give consent through our cookie banner. You can withdraw your consent at any time (see Section 5).

3.3 Marketing and advertising cookies

These cookies and pixels allow us and our advertising partners (such as Meta, Google, TikTok) to measure the effectiveness of advertising campaigns, attribute installs and conversions to the right campaign, and (in some cases) show you tailored advertising on third-party platforms based on your visit to the Site.

These cookies are set only if you give consent through our cookie banner. You can withdraw your consent at any time (see Section 5).

4. Cookies we set on bunnysteps.io

The table below lists the cookies and similar technologies currently used on the Site, along with their purpose, the third party (if any) that sets them, and a typical retention period.

4.1 Strictly necessary

Name / Provider	Purpose	Type	Retention
bunnysteps_session (LOYALPLAY)	Maintains your session while you browse the Site	First-party	Session
bunnysteps_consent (LOYALPLAY)	Stores your cookie-consent choices	First-party	6 months
bunnysteps_locale (LOYALPLAY)	Remembers the language and country version of the Site you are using	First-party	12 months
Cloudflare (__cf_bm, cf_clearance)	Bot detection, security, performance	Third-party — Cloudflare privacy notice	Up to 30 days

4.2 Analytics (consent required)

Name / Provider	Purpose	Type	Retention
Google Analytics 4 (_ga, _ga_<container>)	Aggregated audience and behaviour analytics	Third-party — Google privacy policy	Up to 2 years
Mixpanel	Product analytics for the Site (where deployed)	Third-party — Mixpanel privacy	Up to 12 months

4.3 Marketing and advertising (consent required)

Name / Provider	Purpose	Type	Retention
Meta Pixel (_fbp, fr)	Conversion measurement and audience building for Meta ads	Third-party — Meta privacy policy	Up to 90 days
Google Ads (_gcl_au, IDE via DoubleClick)	Conversion measurement and remarketing for Google Ads	Third-party — Google privacy policy	Up to 13 months
TikTok Pixel (_ttp)	Conversion measurement and audience building for TikTok ads	Third-party — TikTok privacy	Up to 13 months
LinkedIn Insight Tag (li_gc, lidc)	Conversion measurement for LinkedIn ads (where used)	Third-party — LinkedIn privacy	Up to 13 months

Some of these third parties also act as independent or joint controllers for the data they collect. We recommend reviewing their privacy policies linked above.

5. How to manage your cookies

5.1 Through the consent banner

When you first visit the Site, a cookie banner asks for your choices. You can:

• Accept all non-essential cookies;
• Reject all non-essential cookies (rejecting must be as easy as accepting);
• Customise your choices by category (analytics, marketing).

You can change these choices at any time by clicking the "Cookie settings" link in the footer of every page on the Site.

5.2 Through your browser

You can also block, delete, or limit cookies through your browser settings. Each browser handles this differently — here are the official guides:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

You can also opt out of advertising by major industry programs:

• Your Online Choices (EU)
• Network Advertising Initiative (US)
• Digital Advertising Alliance (US)

5.3 What changes if you reject

Strictly necessary cookies will continue to operate regardless of your choices, since the Site depends on them. If you reject analytics or marketing cookies:

• some non-essential features (for example, personalised recommendations or campaign-aware content) may not work;
• our ability to measure campaign effectiveness may be reduced, but rejection has no effect on your access to the public Site itself.

6. Notes for users in different regions

6.1 European Economic Area, UK, and Switzerland

Under the EU ePrivacy Directive (implemented in Poland via the Prawo Komunikacji Elektronicznej) and the EU/UK GDPR, non-essential cookies require your prior consent. You can withdraw consent at any time, with the same effort required to give it.

6.2 California (US)

We treat cookie data as personal information for the purposes of the California Consumer Privacy Act (CCPA/CPRA). California residents have specific rights, including the right to opt out of the "sale" or "sharing" of personal information. To exercise these rights, click "Do Not Sell or Share My Personal Information" in the Site footer or contact us at [email protected].

6.3 Other US states and other countries

Where local law gives you additional rights with respect to cookies or tracking technologies, you can exercise them by contacting [email protected].

7. Retention

We keep records of your cookie-consent choices for 6 months by default, after which we will ask again. The retention periods of individual cookies are listed in the tables above. Personal data collected through cookies is retained in line with our Privacy Policy.

8. International transfers

Many of the third parties whose cookies appear in this Notice (Google, Meta, TikTok, LinkedIn, Cloudflare, Mixpanel) are based in the United States or use US-based infrastructure. Where such transfers take place, they are protected by the EU–US Data Privacy Framework, the UK Data Bridge, or Standard Contractual Clauses, as further described in our Privacy Policy.

9. Changes to this Notice

We may update this Cookie Notice to reflect changes in the cookies we use, in the law, or in our practices. The "Last updated" date at the top of this Notice will always show the most recent revision. For material changes, we will notify users through the Site or, where applicable, through the cookie banner.

10. Contact

For any question about cookies on the Site:

• Email: [email protected]
• Post: LOYALPLAY sp. z o.o., ul. Wolińska 4, 03-699 Warsaw, Poland

For your wider data-protection rights, see our Privacy Policy. The relevant supervisory authority for LOYALPLAY is the Polish President of the Personal Data Protection Office (UODO); UK users may also contact the Information Commissioner's Office (ICO).