COOKIES
Short answer: this website barely uses cookies at all. It has no audience measurement and no social network pixel. Its only first-party cookies belong to the careers area, and only after a candidate signs in. The page below explains, item by item, the little that does exist and why the cookie notice only informs.
Last updated: October 28, 2026
A cookie is a very small text file that a website asks your browser to store and hand back on later visits. It can serve ordinary purposes, such as remembering a chosen language, or it can follow your browsing across different pages and different websites.
This policy covers the public pages of gruporko.com.br. The internal management system, served under the /erp/ path of the same domain, is for corporate use, has its own session rules and is not covered by this document.
Stated plainly, with no hedging: this website uses no tracking cookies. We checked this in the source code itself, and there is no:
One item outside the code: Cloudflare, which delivers the site, has its own performance measurement (Cloudflare Web Analytics) that, when turned on in its dashboard, adds a script to the pages. It sets no cookie and does not identify the visitor. It is blocked in the careers area. [TO BE COMPLETED: confirm whether the automatic Cloudflare measurement is off; if it stays on, describe it here.]
Outside the careers area, the site sets no cookie of its own. In your browser's local storage it keeps a single thing: that you have seen the cookie notice. In the careers area, after sign-in, a cookie keeps you signed in. All of them are in the table in section 3. The Instagram, LinkedIn and YouTube links in the footer are plain links: nothing is loaded from those services until you click.
Why the cookie notice only informs. Asking for consent is how you accept or refuse non-essential cookies, meaning the ones used for measurement, advertising and profiling. There is no cookie of that kind here, so the notice at the bottom of the page only tells you what exists and has a "Got it" button. If anything non-essential is ever added, the notice gets "Accept" and "Decline" buttons of the same size, as explained in section 6.
The technical cookies described in section 3 are strictly necessary to deliver the site securely. They rely on legitimate interest, the legal basis in article 7, item IX, of the LGPD, which is the basis the ANPD's guidance on cookies accepts for strictly necessary cookies, and for that reason they do not depend on prior consent. The careers area cookies exist for the sign-in the candidate asks for, and also rely on article 7, item V, of the LGPD (steps prior to an employment contract).
Legitimate interest is not a blank cheque: you may object to that processing and ask for more information about it through the e-mail address in section 7, and the browser remains the place where you block any cookie, as section 5 shows.
The site is delivered behind the Cloudflare network, which acts as a CDN and security layer, and by a web server (Caddy) in our own infrastructure. Caddy serves static files and records the request in its access log, but sets no cookie. The service that receives the contact form, on the same domain, answers only in JSON and sets no cookie either. Cloudflare, in turn, may set technical security cookies and may keep access logs of its own, containing the IP address, the requested address and the browser identification.
This is the complete list of what may end up stored in your browser when you visit gruporko.com.br:
| Name / Origin | Type | Purpose | Duration |
|---|---|---|---|
| Technical, strictly necessary | Tell a request made by a person from an automated one, so bots and abuse are contained before the page is served. | About 30 minutes | |
| Technical, strictly necessary | Record that the browser has already passed a security challenge, so you do not have to repeat the check on every page. | Set only when a challenge occurs. Its lifetime is defined by Cloudflare according to the protection settings. | |
| First-party, strictly necessary | Keeps the candidate signed in to the careers area. Created only after sign-in, sent only to the careers area and not readable by the page JavaScript. | Up to 12 hours. Ends earlier after 60 minutes without use or when you sign out. | |
| First-party, strictly necessary | Ties the return from Google to the sign-in request made by this browser, so nobody can forge a sign-in in your name. Exists only when you click Sign in with Google. | 10 minutes. Deleted as soon as Google sends you back to the site. | |
| First-party, strictly necessary | Remembers that you have seen the cookie notice. Stores only the notice version and your choice, with no identifier. | Until you clear the site data in your browser. | |
| Technical, strictly necessary | In order tracking and the careers area, when enabled, checks that whoever looks up an order, signs up or signs in is a person and not a bot. Runs in a Cloudflare frame; what it stores stays on the Cloudflare domain, under the Cloudflare privacy policy. | Set by Cloudflare. |
It is worth repeating, because it is the main point of this page: outside the careers area, the site sets no cookie. Cloudflare's cookies, when they appear, protect the server against bots and abuse. The careers area cookies exist only after a candidate signs in and keep the sign-in. None of them identifies you to measure audience.
None of these cookies is used for advertising, for building a profile or for following you across other websites. Nothing you type into the contact form is stored in a cookie: it travels over HTTPS straight to the service that forwards the message by e-mail, as detailed in the Privacy Policy.
An access log is a different thing from a cookie, and it also has a deadline. The logs the server generates on each visit are kept for 6 months, the period set out in article 15 of the Marco Civil da Internet, and the full retention table is in section 7 of the Privacy Policy.
The site loads its images, fonts and scripts from its own domain. There is a single exception, and it deserves a clear explanation.
On the home page and on the news page there is a dark strip showing US Dollar and Euro rates. Those figures are not ours: your own browser calls the address economia.awesomeapi.com.br, a public exchange rate service operated by AwesomeAPI, and displays whatever comes back.
If you would rather avoid that contact entirely, block the domain economia.awesomeapi.com.br in your content blocker, or browse the other pages of the site, which do not carry the strip.
The decision about cookies is always yours, and it is made in the browser, not here. Every browser lets you view, delete and block cookies, either per site or across the board. The menu paths below apply to current versions:
You can also use the browser's private or incognito window, which discards cookies when it is closed. One honest warning: if you block all cookies, including the technical ones, the Cloudflare security check may repeat on every visit, because it can no longer recognise that your browser has already passed the challenge.
The picture described here is today's, and it is not an eternal promise. If Grupo RKO ever adopts audience measurement, a social network pixel, advertising or any feature that writes a non-essential cookie, two things happen before that tool goes live:
For as long as this page says what it says today, it is because none of that has been adopted.
Questions about cookies, about the market rates strip or about any personal data processed by this site can be sent to contato@gruporko.com.br. The data controller is RKO ALIMENTOS LTDA, registered under CNPJ (Brazilian corporate taxpayer registry) number 20.122.197/0001-49.
Data Protection Officer: to be defined. Until the formal appointment required by article 41 of the LGPD, requests concerning personal data go to the same e-mail address above and are answered within 15 days, as article 19 of that law provides.
If our answer does not settle the matter, you may petition the ANPD, Autoridade Nacional de Proteção de Dados, at gov.br/anpd, and also consumer protection bodies, under article 18, §§ 1 and 8, of the LGPD.
For the full picture, including what the contact form collects, how long we keep each piece of information and how to exercise your rights as a data subject, read the Privacy Policy.
Last updated: October 28, 2026
