Legal
Cookie policy
This is a draft, not yet reviewed by a lawyer
This text sets out as precisely as we can what Nermio actually does with data, so that a lawyer has something to build on. It is not legally binding and not something to rely on. Where a choice has to be made, you'll find a marked placeholder with the question in it rather than an invented clause.
Draft of 4 November 2026. While that status holds, the page sits in the footer but not in the sitemap, and asks search engines to leave it out. If you need a cookie statement now, ask us for one at info@nermio.com.
The Dutch text is the binding one
Nermio is a Dutch company, the agreement is governed by Dutch law, and the Dutch version is the text a lawyer reviews. This English version is a translation offered for convenience. Where the two differ, the Dutch text prevails.
The short answer: there is no analytics or advertising script on this site, and no cookie is used to follow you around. What there is: eight cookies that make the software work or remember a preference — and for the two that remember a display preference we ask you first.
What cookies are
A cookie is a small file a website puts on your device and can read again on a later visit. What follows applies equally to comparable techniques that do the same thing, such as local storage. Nermio doesn’t use local storage for preferences: the server renders your theme and your sidebar, and a server can’t read local storage.
What doesn’t happen
No Google Analytics or any other analytics service. No advertising network. No tracking pixel from a social network. No third-party script watching what you do. That isn’t a statement of principle but a fact about the code: those scripts aren’t in it.
There is a consent banner all the same, and that was a choice. Strictly speaking it isn’t required: what we set keeps your session alive or remembers a preference. But a visitor who cares can now choose — and the choice has consequences. Pick “essential only” and the two preference cookies are not written, and are deleted straight away if they were already there. Your theme then applies to that one visit.
That difference is the whole point. A banner that asks and then ignores a refusal is worse than no banner: you have asked for consent and not kept to it.
Which cookies there are
| Name | What for | How long | Consent needed |
|---|---|---|---|
| sb-… | Keeps you logged in. These cookies are set by the authentication service Nermio runs on; their names start with sb-. Without them you can't log in: you'd have to enter your password again after every click. | Set by the authentication service; we don't set the duration ourselves. Logging out clears them. | No — strictly necessary |
| nermio_cookies | Remembers your choice in the banner, so it doesn't come back on every page and the server knows whether it may store a preference. | One year | No — without this cookie your choice can't be honoured |
| nermio_actief | Records when you last did something, so you're logged out automatically after eight hours of silence. It holds a timestamp and nothing else, and scripts can't read it. | Eight hours, moving forward with every action. Gone the moment you log out. | No — strictly necessary to close a forgotten session |
| nermio_taal | Remembers which language you want to see the software in, so every screen and every email comes in that language. It holds a language code and nothing else, for example en or nl. | One year | No — strictly necessary to deliver the service in the language you chose |
| NEXT_LOCALE | Remembers the language of the website. This cookie is set by the component that handles the translated addresses, on the public pages too. It holds a language code and nothing else. | Until you close your browser | No — strictly necessary for the language the site is shown in |
| nermio_mail_oauth | Sits on your computer for ten minutes while you connect your mailbox, and nowhere else. On the way back it proves that you started that connection, and not someone who sent you a link. | Ten minutes, and it's gone the moment the connection is finished or broken off. | No — strictly necessary; without this cookie a connection can't be completed safely |
| nermio_thema | Remembers whether you want the light or the dark view, or the one your system uses. | One year | Yes |
| nermio_zijbalk | Remembers whether you had the sidebar collapsed. | One year | Yes |
Most of these belong to the signed-in part of Nermio, with two exceptions: your cookie choice is read on the public pages too, because that is where the banner sits, and NEXT_LOCALE is set on every page, even if you are only looking around. Three of them are read on the server — the language, the theme and the sidebar — and there is a reason for that: otherwise your screen shows half a second of the wrong language or the wrong theme on load, or a sidebar unfolding when you had it shut. None of the three holds more than a preference — a language code, “dark”, “collapsed” — and nothing that identifies you.
What you can do yourself
Your choice isn’t final. Below you can withdraw it: the choice cookie and the two preference cookies are deleted and the banner comes back, so you can choose again.
You can also block or delete cookies in your browser; how to do that is in your browser’s own settings. Block the session cookies and logging in stops working and you’ll be signed out. Block the two preference cookies and everything still works, but Nermio starts in the default view every time.
The questions still open
To be settled by a lawyer
Are nermio_cookies and nermio_actief rightly marked as strictly necessary, and does a banner with two equal buttons and no preference screen meet the requirement?
For the session cookies it is clear; without them logging in doesn't work. The choice cookie and the logout clock are listed as strictly necessary because without the first you cannot honour the choice and without the second you leave a forgotten session open — artikel 11.7a Telecommunicatiewet, the Dutch rule that governs Nermio as a Dutch company. That is a line of reasoning, not a ruling. And because there are only two categories, a third button would lead to a screen with a single toggle on it; whether that is allowed is the same kind of judgement. OUTSIDE DUTCH LAW — for a visitor in Ireland the equivalent rule is Regulation 5(3) of S.I. No. 336/2011, which requires consent plus information that is “prominently displayed and easily accessible”, with the strictly necessary exemption in Regulation 5(5). Both implement the same directive and the substance is the same, so nothing on this page changes. The open question is whether the Irish rule applies alongside the Dutch one to an Irish visitor, and if so whether the Data Protection Commission reads “strictly necessary” the same way the Dutch regulator does. That is a question about territorial scope, not about our cookies.
To be settled by a lawyer
What do we agree for the day an analytics service is added?
Then the answer on this page changes, and the consent question has to come before that script loads — not after. The banner is already there and can carry it; the category and the wording would have to follow. Better to work out what that looks like now than on the day someone wants visitor numbers.
More about data
What data Nermio records and for how long is in the privacy notice. How your data is walled off and who can reach it on our behalf is on the security page.