CAIT Cookie Policy
Effective date: 8 August 2026
1. Introduction and Scope
The present Cookie Policy explains how the Community Archive for Integrated Teaching, referred to as "CAIT", "the Platform", or "the Service", uses cookies and comparable technologies when you visit and interact with the website. The document describes what such technologies are, which of them are actually employed, the purposes they serve, the legal basis on which they operate, and the means by which you may exercise control over them. The Cookie Policy operates alongside the CAIT Privacy Statement, which sets out in greater detail how personal data is processed, and forms part of the conditions to which you agree when using the Platform. Defined terms carry the meaning given to them in the Privacy Statement, unless the context indicates otherwise.
2. What Cookies and Similar Technologies Are
A cookie is a small text file that a website places on, or reads from, the terminal equipment of a visitor, such as a computer, a tablet, or a mobile telephone. Comparable technologies, including local storage, session storage, databases held in the browser, pixels, and device fingerprinting techniques, perform functions similar to those of cookies and fall within the same regulatory treatment. Through such files and techniques, a website is able to recognise a device, to maintain an authenticated session, to remember certain choices, and, where applicable, to observe how a service is used. Cookies may be set by the operator of the site, in which case they are described as first-party cookies, or by a third party whose service is integrated into the pages, in which case they are described as third-party cookies. According to their duration, cookies are either session cookies, which are erased when the browser is closed, or persistent cookies, which remain stored for a defined period or until they are deleted.
3. Legal Framework
Use of cookies on the Platform is governed by Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), which transposes Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC). Where the placing or reading of cookies entails the processing of personal data, Regulation (EU) 2016/679, the General Data Protection Regulation, applies in addition. Under the third paragraph of Article 11.7a, the obligation to inform and the obligation to obtain consent do not apply to storage or access whose sole purpose is the transmission of a communication over an electronic communications network, or which is strictly necessary in order to deliver an information society service explicitly requested by the subscriber or user. For every other purpose, prior, informed, and freely given consent is required, and such consent may not be inferred from browser settings or from the mere continuation of a visit.
4. Inventory of the Cookies Used by the Platform
A single cookie is placed by the Platform, and it belongs to the strictly necessary category. Its particulars are set out below, and no other cookie is set by the Provider.
Name: The cookie is named auth-token. Where the value exceeds the size that a browser accepts within a single cookie, it is divided into two parts, stored under the names auth-token.0 and auth-token.1, which together constitute one and the same cookie.
Nature and party: It is a first-party cookie, set by the Platform itself, and it is not shared with any advertising network, analytics provider, or other external recipient.
Purpose: It maintains your authenticated session after you have signed in through SURFconext, so that your identity need not be verified again at each request, and so that access to private or unpublished materials may be granted to the account entitled to them.
Content: Its value is a base64-encoded string containing a signed access token in JSON Web Token form, together with the refresh token associated with it.
Validity of the tokens: The access token expires one hour after it has been signed, whereupon the refresh token is used in order to obtain a new one and is itself renewed in the same operation.
Duration of the cookie: The maximum age applied to the cookie is approximately 400 days, which corresponds to the upper limit that Chromium-based browsers impose upon persistent cookies; browsers applying a shorter limit will discard it sooner. The lifetime of the cookie and the lifetime of the tokens it carries are distinct: the former governs how long the file remains on your device, the latter how long the credentials inside it remain valid.
Legal basis: Because the cookie is indispensable to the delivery of a service that you have expressly requested, namely access to your account, it falls within the exemption of Article 11.7a(3) of the Telecommunicatiewet and is placed without consent.
5. Technologies That the Platform Does Not Use
Several categories of technology commonly encountered on websites are absent from the Platform, and their absence is recorded here expressly. The Platform employs no analytics cookie and no analytics script of any kind, whether provided by a third party or developed in-house. Nothing is placed for advertising purposes, for behavioural profiling, for audience measurement across sites, or for the commercial tracking of individuals. No social plug-in, no advertising pixel, and no fingerprinting technique operates on the pages of the Service. Cookies of third parties are consequently not set through the Platform.
6. Session Storage and Local Databases
Two mechanisms other than cookies store information on your device, and both serve strictly technical ends.
Session storage: The interface of the Platform is built with the Svelte and SvelteKit framework, which of its own accord retains a limited amount of information in the session storage area of your browser in order to render navigation between pages, and the use of the back and forward controls, more responsive. No code written by the Provider addresses that area directly, and the information held there is discarded when the browsing session ends.
Local database: While you are preparing a publication, the draft and the data connected with it are held temporarily in an IndexedDB database within your browser, so that work in progress survives an interruption. The record is erased once the publication is completed, or after a defined period has elapsed without completion.
Neither mechanism serves an analytical or a commercial purpose, and each is limited to what the requested functionality requires, with the result that the exemption described in Section 3 applies to both.
7. Collection of Usage Data on the Server Side
Information about the use of the Service is obtained exclusively from the logs produced by the infrastructure of the Provider, namely by the reverse proxy, by the API gateway, and by the other backend components that handle requests. Logging of that nature occurs on the server after a request has reached it, and it does not involve reading from or writing to your terminal equipment; the rules on cookies therefore do not govern it, although the data so collected is personal data and is treated in accordance with the Privacy Statement, notably as regards the one-year retention period applicable to visitor data.
8. External Links and Embedded Content
Requests for new features are gathered through a form supplied by Google Forms, which is reached by means of a link that opens the provider's own site in a separate window. Because the form is not embedded within the pages of the Platform, its provider sets no cookie through the Service, and any cookie encountered after the link has been followed is placed by that provider on its own site and under its own policy, over which the Provider exercises no control. Consultation of the policy in question is advisable before data is submitted there. Should embedded content of any kind be introduced in the future, and should it involve non-essential cookies, the present document will be revised and consent will be sought before such cookies are activated.
9. Absence of a Consent Banner
No consent banner is displayed on the Platform, and the grounds for its absence are set out here. Every technology described above is either strictly necessary to the delivery of the Service that you have requested, in the case of the authentication cookie, or purely technical and confined to the functionality you have called upon, in the case of session storage and of the local draft database. Since the exemption of Article 11.7a(3) of the Telecommunicatiewet covers each of them, no consent is legally required, and a banner soliciting consent that the law does not demand would serve no purpose. Were a non-essential technology to be adopted at a later stage, a consent mechanism satisfying Article 4(11) and Article 7 of the GDPR would be implemented beforehand, with a refusal option as accessible as the option to accept, and access to the Platform would in no case be made conditional upon acceptance.
10. Managing and Disabling Cookies through Your Browser
Independently of the choices offered on the Platform, you retain the ability to manage cookies through the settings of your browser, which generally allow you to view the cookies stored on your device, to delete them individually or collectively, and to block the placing of future cookies, whether in respect of all websites or of particular websites. The procedure varies according to the browser that you use, and guidance is ordinarily available within its help function, on desktop and on mobile devices alike. Session storage and the contents of local databases may likewise be cleared through the tools that browsers provide for site data. Deletion or blocking of the authentication cookie will end your session and oblige you to sign in again, and it may render the parts of the Platform reserved to registered users unavailable. Settings apply to the device and to the browser in which they are made, so the adjustment must be repeated on each device and in each browser that you use.
11. Retention and Duration
The authentication cookie remains on your device for the maximum age stated in Section 4, unless you delete it beforehand or the browser applies a shorter limit of its own. Tokens contained within it cease to be usable according to the shorter periods described in the same Section, with the consequence that an expired cookie left in place confers no access. Information kept in session storage disappears when the browsing session ends, and entries held in the local draft database are removed upon publication or upon the lapse of the period allotted to unfinished drafts. Personal data collected on the server side in connection with your requests is retained in accordance with the periods set out in the CAIT Privacy Statement.
12. Relationship with the Privacy Statement
The present Cookie Policy concerns the storage of information on your terminal equipment and the reading of information from it, whereas the broader processing of personal data, the legal bases relied upon, the recipients of data, the retention periods, and the rights available to you as a data subject are addressed in the CAIT Privacy Statement. The two documents are complementary and should be read together. Where personal data is processed by means of the technologies described here, the rights of access, rectification, erasure, restriction, portability, and objection described in the Privacy Statement apply equally, and may be exercised through the channels indicated there.
13. Amendments to this Cookie Policy
The Provider may revise the present Cookie Policy from time to time, in order to reflect changes in the technologies employed, in the structure of the Platform, or in the applicable legal framework. The version published on the Platform, bearing the effective date set out above, is the version in force. Where a revision is of material significance, an appropriate notice will be published on the Platform, and, where the change concerns a technology that is not exempt from the consent requirement, your consent will be sought before that technology is activated. Periodic consultation of this page is recommended, so that you remain informed of the manner in which information is stored on your device.
14. Contact and Supervisory Authority
Questions or requests concerning the use of cookies on the Platform may be addressed to the CAIT team at cait-ewi@tudelft.nl, or to the Data Protection Officer of TU Delft at fg@tudelft.nl. Should you consider that the use of cookies infringes the applicable rules, you are entitled to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, whose website is available at https://www.autoriteitpersoonsgegevens.nl.