Privacy Policy & Terms and Conditions

COOKIE POLICY

I. PURPOSE OF THIS COOKIE POLICY

1.1 This Cookie Policy outlines how IuteCredit Albania SH.A (“Iute“, “we“, “us” uses cookies and similar technologies when individuals (“you”) visit our website www.iute.al and Myiute Albania mobile application in accordance with our Privacy Notice. Privacy Policy and Recruitment Policy.

II. WHAT ARE COOKIES?

2.1 Cookies and similar technologies are small files or identifiers that may be stored on or accessed from your device when you use Iute’s digital services. They allow us or third-party service providers to recognize your browser, device, or application, remember certain information, improve functionality, make future use of our services easier, and support the secure and efficient operation of our digital services.

III. TYPES OF COOKIES BY STORAGE DUARATION

3.1 Iute uses different types of cookies, which may differ by storage duration and purpose. Based on storage duration, Iute uses the following categories of cookies:

Session cookies are used to enable the proper functioning of Iute’s digital services. They are stored temporarily on your device and are deleted when you log out, close the browser or application, or end the session.
Persistent cookies are stored on your device for a limited period and may be used to remember your preferences, collect statistics, analyze service use and improve Iute’s digital services.

IV. TYPES OF COOKIES BY PURPOSE

4.1 Based on the processing purpose, Iute uses the following categories of cookies:

Necessary cookies are required for Iute’s digital services to function properly. They enable core features such as secure login, navigation, authentication, form submission, and security. Without these cookies, certain services requested by you cannot be provided.

Functionality cookies enable additional functions and personalization features. They allow us to remember your preferences, choices, settings, and entered information. If you decline these cookies, some features may be less convenient and you may need to re-enter information or adjust your settings again.

Analytical cookies help us understand how you interact with Iute’s digital services. They allow us to collect statistics, measure performance, identify popular and less-used features or pages, and improve the user experience. If you decline these cookies, your use of our digital services will not be included in our analytics statistics.

Targeting cookies are used to provide more relevant information, offers, and advertising about Iute’s products and services. They may also help us measure and improve advertising campaigns, including on third-party websites or platforms. If you decline these cookies, the advertising you see may be less personalized.

V. THIRD-PARTY COOKIES AND SERVICE PROVIDERS

5.1 Iute may use cookies and similar technologies provided by third-party service providers. These third parties may provide technical solutions, tools, and features that help us ensure functionality, analyze the use of our digital services, measure performance, improve user experience, and support advertising or personalized content where applicable.

5.2 Third-party cookies are cookies placed or accessed by a domain or service provider other than Iute. They may be used, for example, when you interact with content, tools, or features provided by a third party through Iute’s digital services.

5.3 Data collected through cookies or similar technologies may be shared with Iute’s trusted partners and third-party service providers where this is necessary for the purposes described in this Cookie Policy. Third-party cookies and similar technologies may also be subject to the relevant third party’s cookie or privacy policy.

VI. COOKIE CONSENT AND CONTROL

6.1 Where required, Iute asks for your consent before using functionality, analytical, and targeting cookies or similar technologies. Necessary cookies are required for Iute’s digital services to function properly and cannot be disabled through the cookie settings.

6.2 Your cookie choices are stored for one year, unless you change or withdraw your consent earlier. When you consent to a category of cookies, you consent to all cookies within that category, as further described in the List of Cookies below.

6.3 Iute may update the cookies and similar technologies it uses from time to time, for example to improve service quality, functionality, security, analytics, or user experience. The List of Cookies may therefore be amended accordingly.

6.4 Where applicable, you can update your cookie preferences at any time by clicking

Change Cookie Preferences

6.5 You may remove stored cookies by clearing them in your browser, device, or application settings. Please note that deleting or disabling cookies may affect the functionality and performance of Iute’s digital services.

6.6 Cookie management steps may vary by browser, device, or application you use. For guidance, visit allaboutcookies.org.

VII. PERSONAL DATA PROCESSING

7.1 Where personal data is processed through cookies or similar technologies, such processing takes place in accordance with our Privacy Notice

7.2 The Privacy Notice provides more information about how Iute processes personal data, the rights available to you under applicable data protection laws, and how you can exercise those rights.

VIII. CONTACT US

8.1 If you have any questions about this Cookie Policy or the use of cookies and similar technologies, you can contact us at al.

10.1 Iute may update this Cookie Policy from time to time. Any changes will be published on this page, and significant changes may be communicated through Iute’s website, mobile application, or other appropriate channels.

Last updated: 10 July 2026

LIST OF COOKIES

Provider	Cookie name	Cookie type	Expires	Purpose
Iute	currentUser	Essential	Session – until log out	Keeps you signed in and allows MyIute to display information for your account.
Iute	ic-csrf-token	Essential	Session	Protects your account by helping verify that requests made through MyIute are genuine.
Iute	2fa_token, 2fa_phone, 2fa_*	Essential	Until 2FA flow completes	Stores the information needed to complete two-factor authentication securely.
Iute	passcodeExists, biometryFixed, biometric flags	Essential	Until log out	Allows MyIute to recognise whether passcode or biometric protection has been set up on your device.
Iute	consents	Essential	Persistent	Records your choices about cookies and marketing so that we can apply them.
Iute	Session-handover blob	Essential	Session	Allows your signed-in session to continue securely between the mobile app and its embedded web service.
Iute	appState	Essential	Session	Keeps the mobile app and the embedded web service synchronised while you use MyIute.
Iute	hasRunBefore	Essential	Until install	Identifies whether MyIute is being opened for the first time so that secure storage can be set up correctly.
Iute	frontendUrl	Essential	Persistent	Connects MyIute to the correct Iute service environment.
Iute	deviceRegistrationHash / deviceHash in deviceInfo	Essential	Until deleted	Creates a device-specific security value used to protect passcode and document-signing functions.
Iute	certificateGenerated:{pin}, passcodeCertificateGenerated:{pin}	Essential	Until secure device storage is reset	Records that secure signing credentials have been created for your account on that device.
Iute	usingSecureKeyStore	Essential	Persistent	Helps MyIute use the current secure-storage method safely.
Iute	PKI biometry private key + X.509 certificate	Essential	Until you log out or register biometrics again	Enables secure document signing and strong customer authentication using biometrics.
Iute	PKI passcode private key + X.509 certificate	Essential	Until you log out	Enables secure document signing and strong customer authentication using your passcode.
Iute	Passcode hash – Argon2i	Essential	Until you remove your passcode	Allows MyIute to verify your passcode without storing it in readable form.
Iute	WKWebView Website Data Store – .default()	Essential	Until uninstall	Stores the website data needed for the web-based parts of MyIute to work inside the iOS app.
Iute	Android WebView cookies + DOM storage	Essential	Until uninstall	Stores the website data needed for the web-based parts of MyIute to work inside the Android app.
Iute	HTTP Basic Auth credentials	Essential	For the lifetime of the installed staging build	Protects access to the non-production staging environment.
Google Firebase	FCM device token	Essential	Until you log out or Firebase replaces the token	Allows Iute to send push notifications to your device.
Google Firebase	Firebase Installations – installation ID + auth tokens	Essential	Until the app is reset	Supports Firebase services, including the creation and operation of push-notification tokens.
Google reCAPTCHA Enterprise	reCAPTCHA Enterprise session token	Essential	Session	Helps protect sign-in and authentication processes from automated or fraudulent activity.
Cloudflare	__cf_bm	Essential	1 hour	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
CookieYes	cookieyes-*	Essential	1 year	CookieYes sets this cookie for consent solution management.
Youtube	VISITOR_PRIVACY_METADATA	Essential	6 months	YouTube sets this cookie to store the user’s cookie consent state for the current domain.
Google Recaptcha	rc::a	Essential	Never	This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks.
Google Recaptcha	rc::c	Essential	Session	This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks.
Iute Internal	utmData	Essential	1 month	It is for internal attribution tracking that only gets captured if a visitors submits a loan application
Iute	locale	Functionality	Persistent	Remembers your selected language.
Iute	balance_visibility	Functionality	Persistent	Remembers whether you choose to show or hide your account balance.
Iute	referralCode	Functionality	Persistent	Remembers a referral code received through a link.
Iute	educationSurveyCompleted, loyalty, quickActions, welcomeBottomSheetSeen, iuteMarketPromoSeen and other show-once flags	Functionality	Persistent	Prevents MyIute from repeatedly showing onboarding steps, promotions or messages you have already completed, seen or dismissed.
Iute	marketingConsent:{pin}	Functionality	Persistent	Records whether you wish to receive marketing communications. Used only in the Albania and North Macedonia versions of MyIute.
Iute	consents.optional_cookies	Functionality	Persistent	Records your choice to accept or reject optional cookies and similar technologies.
Iute	IuteMarket cart keys (5 keys)	Functionality	Until checkout	Keeps items in your IuteMarket shopping cart.
Iute	Multi-step form / wizard state keys (about 28)	Functionality	Session	Saves your progress while you complete loan, KYC or profile forms.
Iute	notification_permission_status	Functionality	Persistent	Remembers whether you have allowed MyIute to send push notifications.
Iute	notification_analytics_events	Functionality	Persistent	Temporarily stores notification-permission events until MyIute can send them.
Iute	permissions_handler_asked (per permission)	Functionality	Persistent	Remembers permissions you have permanently declined, so that MyIute does not repeatedly ask for them.
Iute	trackingAuthorizationStatus	Functionality	Persistent	Remembers your iOS App Tracking Transparency choice.
Iute	version_preference	Functionality	Persistent	Makes the MyIute version number available in iOS device settings.
Iute	Temporary downloaded PDFs / images	Functionality	Until logout / next launch	Temporarily stores downloaded contracts, statements and images so that you can view or sign them.
WordPress	wp-wpml_current_language	Functionality	Session	Supports internal translation review in development and staging environments.
Youtube	VISITOR_INFO1_LIVE	Functionality	6 months	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
Youtube	ytidb::LAST_RESULT_ENTRY_KEY	Functionality	Never	The cookie ytidb::LAST_RESULT_ENTRY_KEY is used by YouTube to store the last search result entry that was clicked by the user. This information is used to improve the user experience by providing more relevant search results in the future.
PostHog	ph_phc_{project-token}_posthog	Analytical	Cookie: 1 year. localStroage persistent	Helps us understand how MyIute is used, remember feature and experiment settings, and support session analysis where enabled.
PostHog	myiute_ph_country_props_v1_{country}	Analytical	Persistent	Associates analytics information with the relevant country version of MyIute.
PostHog	Anonymous-flow experiment variant cache	Analytical	Persistent	Ensures that you continue to see the same version of a website or app experiment.
Google Analytics 4 / Google Tag Manager	_ga	Analytical	2 years	Distinguishes returning browsers for aggregated usage statistics.
Google Analytics 4 / Google Tag Manager	_gid	Analytical	24 hours	Distinguishes activity during a short period for aggregated usage statistics.
Google Analytics 4 / Google Tag Manager	_gat	Analytical	1 minute	Limits the number of Google Analytics requests sent in a short period.
Google Analytics 4 / Google Tag Manager	_ga_{stream-id}	Analytical	2 years	Maintains Google Analytics session and measurement settings.
Google Tag Manager	dataLayer	Analytical	Session	Temporarily holds event information before it is sent to enabled Google Tag Manager tools.
Hotjar	_hjSession_{site-id}	Analytical	30 minutes	Groups activity during one visit for heatmaps and session analysis.
Hotjar	_hjSessionUser_{site-id}	Analytical	1 year	Recognises a returning browser for usage analysis.
Hotjar	_hjFirstSeen, _hjAbsoluteSessionInProgress, _hjIncludedInSessionSample	Analytical	Session to 1 year	Controls sampling and session-recording settings where Hotjar is enabled.
Iute	iute_tracking_session_id	Analytical	Session	Links actions taken during the same MyIute session for internal usage analysis.
Sentry	Breadcrumbs and session ID	Analytical	Until sent	Helps Iute identify and fix technical errors and performance problems in the web service.
Sentry	Sentry envelopes	Analytical	Until sent	Temporarily stores native crash and error reports so that they can be sent to Iute’s technical monitoring service.
Google Firebase Analytics	Event queue, session ID and user properties	Analytical	Persistent	Helps us understand how the Android app is used and improve its performance.
Google Firebase Crashlytics	Crash reports	Analytical	Until sent	Helps Iute identify, investigate and fix application crashes.
New Relic	New Relic agent storage	Analytical	Until sent	Helps Iute monitor Android app errors, performance and network activity.
SEON	SEON anti-fraud agent storage	Analytical	Provider-controlled	Helps identify potentially fraudulent activity using device and browser risk signals.
CredoLab	CredoLab behavioural biometrics	Analytical	Provider-controlled	Collects behavioural information during a loan application to support creditworthiness and fraud-prevention assessments.
Youtube	YSC	Analytical	Session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.
Optin monster	_omappvp	Analytical	1 year	The _omappvp cookie is set to distinguish new and returning users and is used in conjunction with _omappvs cookie.
Optin monster	_omappvs	Analytical	20 min	The _omappvs cookie, used in conjunction with the _omappvp cookies, is used to determine if the visitor has visited the website before, or if it is a new visitor.
Google Analytics 4	_ga_*	Analytical	1 year 1 month	Google Analytics sets this cookie to store and count page views.
Google Analytics 4	_ga	Analytical	1 year 1 month	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.
PostHog	dmn_chk_*	Analytical	Less than a minute	This cookie is set to track user activity across the website.
Microsoft Clarity	_clck	Analytical	1 year	Microsoft Clarity sets this cookie to retain the browser’s Clarity User ID and settings exclusive to that website. This guarantees that actions taken during subsequent visits to the same website will be linked to the same user ID.
Microsoft Clarity	_clsk	Analytical	1 day	Microsoft Clarity sets this cookie to store and consolidate a user’s pageviews into a single session recording.
Iute	utm (11 marketing parameters)	Advertising	30 days	Records the most recent campaign or referral source so that Iute can measure whether marketing activity led to an application or other action.
Branch.io	Branch session, deep-link parameters and install referrer	Advertising	Persistent	Allows links to open the correct content in MyIute and helps measure the source of app installations.
Meta / Facebook SDK	Access tokens, app-event cache and install-attribution storage	Advertising	Persistent	Helps measure whether a Meta/Facebook campaign resulted in an app installation or app activity.
Google Ads – On-Device Conversion	Conversion-tracking blob	Advertising	Persistent	Helps measure whether a Google Ads campaign resulted in an action in the iOS app.
Google Play Install Referrer	Install-referrer string	Advertising	Persistent	Records the installation source reported by Google Play.
Samsung Galaxy Store Install Referrer	Install-referrer string	Advertising	Persistent	Records the installation source reported by the Samsung Galaxy Store.
PostHog	_posthog	Advertising	1 year	PostHog’s primary persistence cookie
Adform	C	Advertising	1 month	No description
Youtube	__Secure-YNID	Advertising	6 months	YouTube cookie used to protect user security and prevent fraud, especially during the login process.
Youtube	__Secure-ROLLOUT_TOKEN	Advertising	6 months	YouTube sets this cookie to manage feature rollout and experimentation. It helps Google control which new features or interface changes are shown to users as part of testing and staged rollouts, ensuring consistent experience for a given user during an experiment.
Youtube	__Secure-YEC	Advertising	Past	No Description
Google Tag Manager	_gcl_au	Advertising	3 months	Google Tag Manager sets this cookie to experiment advertisement efficiency of websites using their services.
Adform	uid	Advertising	2 months	This is a Google UserID cookie that tracks users across various website segments.
Meta	_fbp	Advertising	3 months	Facebook sets this cookie to store and track interactions.
Google Doubclick	test_cookie	Advertising	15 minutes	doubleclick.net sets this cookie to determine if the user’s browser supports cookies.
Microsoft Bing	_uetsid	Advertising	1 day	Bing Ads sets this cookie to engage with a user that has previously visited the website.
Microsoft Bing	_uetvid	Advertising	1 year	Bing Ads sets this cookie to engage with a user that has previously visited the website.
Microsoft Bing	MUID	Advertising	1 year	Bing sets this cookie to recognise unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics, and other operations.
Google Ads	_gcl_ag	Advertising	3 months	It stores the Google Click ID (GCLID) from a user’s ad click, used to attribute conversions back to the originating Google Ads click
Google DoubleClick	IDE	Advertising	1 year	Google DoubleClick IDE cookies store information about how the user uses the website to present them with relevant ads according to the user profile.