Cookie Policy

This Cookie Policy explains how Computerko Limited, operating the KleipData service ("KleipData", "we", "us" or "our"), uses cookies and other technologies that store information on, or access information from, a user’s device.

This Policy applies to:

• a. the KleipData public website;
• b. the KleipData customer portal;
• c. the KleipData developer portal;
• d. authenticated KleipData web applications;
• e. documentation and support pages operated by KleipData; and
• f. other KleipData online services that link to this Policy.

This Policy should be read together with the KleipData Privacy Policy.

KleipData is operated by:

Computerko Limited 27 Old Gloucester Street London WC1N 3AX United Kingdom

Company Registration Number: 11125670

Privacy and cookie enquiries may be sent to:

support@kleipdata.co.uk

A cookie is a small piece of information stored on a computer, mobile device, tablet or other device when a website or online service is accessed.

Cookies may allow an online service to:

• a. recognise a device;
• b. maintain a login session;
• c. remember user preferences;
• d. protect an account;
• e. maintain security controls;
• f. remember consent choices;
• g. measure use of a service; or
• h. provide other online functionality.

Some cookies exist only for a browser session.

Others remain on the device for a defined period.

UK electronic-communications rules apply more broadly than traditional browser cookies.

Accordingly, references in this Policy to "Cookies and Similar Technologies" may include:

• a. HTTP cookies;
• b. local storage;
• c. session storage;
• d. pixels;
• e. tags;
• f. JavaScript identifiers;
• g. software development kits;
• h. device identifiers;
• i. browser or device storage;
• j. server-side tagging where information is stored on or accessed from a user’s device;
• k. link-decoration technologies;
• l. device fingerprinting where used;
• m. authentication storage;
• n. preference storage; and
• o. other technologies capable of storing information on, or accessing information from, a user’s device.

The particular technology used matters less than what it does and why it is used.

Our use of Cookies and Similar Technologies is principally governed by the Privacy and Electronic Communications Regulations 2003 ("PECR"), as amended.

Where information obtained through such technologies is personal data, the UK GDPR, the Data Protection Act 2018 and other applicable data-protection legislation may also apply.

Some Cookies and Similar Technologies require consent.

Others may lawfully be used without consent where a statutory exception applies.

KleipData assesses technologies according to their actual purpose and configuration rather than simply labelling every technology as either a "cookie" or "non-cookie".

KleipData may use the following categories:

• 1. Strictly Necessary
• 2. Security and Authentication
• 3. Functional and Preference
• 4. Statistical / Service Analytics
• 5. Optional Analytics
• 6. Advertising or Marketing

Not every category will necessarily be used at all times.

The current technologies in use are identified through the Cookie Settings / Cookie Register made available on the relevant KleipData website or service.

Strictly Necessary Technologies are used where storage or access is essential to provide a service requested by the user.

These may be required for purposes such as:

• a. logging into an account;
• b. maintaining an authenticated session;
• c. routing a request;
• d. remembering the contents of an active transactional process;
• e. providing account security;
• f. maintaining CSRF protection;
• g. preventing abuse;
• h. maintaining load balancing;
• i. remembering that a user has already made a cookie choice;
• j. protecting forms;
• k. enabling secure customer-portal functionality; or
• l. providing another function without which the requested service could not properly operate.

Where the statutory requirements for the strictly necessary exception are met, these technologies do not require consent.

They must not be repurposed for unrelated tracking or advertising.

PECR also permits storage or access where its sole purpose is carrying out the transmission of a communication over an electronic communications network.

KleipData may rely upon this exception where the relevant statutory requirements are satisfied.

A technology will not be treated as exempt merely because it is technically involved in a website.

Its purpose must fall within the applicable exception.

Security technologies may be used to:

• a. authenticate users;
• b. maintain sessions;
• c. protect accounts;
• d. detect unauthorised access;
• e. identify suspicious authentication behaviour;
• f. protect APIs and portals;
• g. mitigate automated abuse;
• h. maintain service integrity; and
• i. prevent fraudulent use.

Where such technology is strictly necessary to provide a secure service requested by the user, it may operate without consent.

Security information may separately constitute personal data and will be processed in accordance with the KleipData Privacy Policy.

UK law permits certain technologies to be used without prior consent where the sole purpose is to collect statistical information about how a website or online service is used with a view to improving that service.

Where KleipData relies upon this statistical-purposes exception, we will ensure that:

• a. the purpose is genuinely statistical;
• b. the purpose is improving the KleipData website or service;
• c. the technology is not used to track people for advertising;
• d. the resulting information is used to produce aggregate statistical information;
• e. individual-level information is not retained longer than necessary to produce the statistical information;
• f. the statistical information is not used to make decisions about particular individuals;
• g. any third-party analytics provider used under this exception acts only to help KleipData improve its service;
• h. the provider does not independently use the information for advertising, profiling or unrelated purposes;
• i. users receive clear information about the processing; and
• j. users are provided with a simple and free means of objecting.

Where configured in accordance with the statistical-purpose exception, KleipData may collect information such as:

• a. total website visits;
• b. total page views;
• c. which pages are used most frequently;
• d. aggregate time spent on pages;
• e. average scroll depth;
• f. aggregate navigation paths;
• g. browser types;
• h. operating-system types;
• i. device categories;
• j. general loading performance;
• k. bounce rates;
• l. exit pages;
• m. aggregate referral information;
• n. coarse non-identifying geographic information; and
• o. aggregate interaction information.

The purpose of this processing is understanding and improving the KleipData service.

KleipData will not treat the statistical-purpose exception as authority to:

• a. create advertising profiles;
• b. track identified individuals across websites;
• c. link individual browsing behaviour with advertising platforms;
• d. conduct behavioural advertising;
• e. create persistent marketing profiles;
• f. record individual browsing sessions for general analytics;
• g. make decisions about a person based on their browsing behaviour;
• h. retain individual-level analytics indefinitely; or
• i. use analytics information for purposes unrelated to service improvement.

Where consent is required for such processing, it will not occur until appropriate consent has been obtained.

PECR may permit technologies whose sole purpose is:

• a. adapting the appearance or operation of a service according to a user’s preference; or
• b. enhancing how a service appears or functions on that user’s device.

Examples may include remembering:

• a. display preferences;
• b. language;
• c. theme;
• d. interface density;
• e. accessibility preferences;
• f. table presentation;
• g. user-interface configuration; or
• h. another device-specific presentation preference.

Where KleipData relies upon this exception:

• a. clear information will be provided;
• b. the technology will be limited to the relevant purpose; and
• c. the user will be given a simple and free means of objecting.

This exception is not used to justify personalised advertising or behavioural profiling.

Some convenience or functionality technologies may not satisfy a PECR exception.

Where they do not, they will be treated as optional and will not be activated until the required consent has been obtained.

A technology is not exempt simply because it makes the website more convenient.

KleipData may wish to use analytics that go beyond the statutory statistical-purpose exception.

For example, an analytics service may:

• a. create a persistent visitor identifier;
• b. retain individual-level histories;
• c. combine information across websites;
• d. independently use collected information;
• e. perform visitor segmentation; or
• f. otherwise exceed the narrow statistical exception.

Where such technology requires consent, KleipData will obtain consent before activating it.

Cookies or Similar Technologies used for:

• a. behavioural advertising;
• b. remarketing;
• c. cross-site tracking;
• d. advertising profiling;
• e. advertising attribution involving identifiable visitor activity;
• f. conversion tracking shared with advertising platforms;
• g. measuring whether a particular person viewed or interacted with an advertisement; or
• h. building advertising audiences

will not be activated until the consent required by PECR has been obtained.

KleipData will not classify an advertising technology as "necessary" merely because it is commercially useful.

The operation of KleipData’s customer data-intelligence Services does not require a website visitor to accept advertising cookies.

Refusing optional advertising or marketing technologies will not by itself prevent a user from accessing ordinary public website content or core paid KleipData functionality, except where a particular optional third-party feature genuinely depends upon the technology and the user chooses to use that feature.

Some pages may contain content or services provided by third parties.

Examples could include:

• a. video players;
• b. scheduling facilities;
• c. embedded documentation;
• d. support services;
• e. payment facilities;
• f. interactive demonstrations; or
• g. other third-party functionality.

A third-party feature may wish to set its own Cookies or Similar Technologies.

Where consent is required, the feature should remain inactive, blocked or appropriately restricted until the required consent is given.

KleipData will not assume that loading a page constitutes consent to third-party tracking.

The KleipData customer portal may use Cookies and Similar Technologies required to:

• a. authenticate a user;
• b. maintain a secure session;
• c. enforce Organisation access;
• d. enforce permissions;
• e. protect authentication;
• f. remember user-interface preferences;
• g. prevent cross-site request forgery;
• h. secure account-management functions; or
• i. remember applicable consent and objection choices.

Portal technologies may therefore differ from those present on the public marketing website.

The developer portal may use technologies required for:

• a. authentication;
• b. session management;
• c. API-application administration;
• d. API credential management;
• e. documentation preferences;
• f. sandbox access;
• g. security;
• h. Usage dashboards; and
• i. user-interface preferences.

API calls made directly by a customer’s backend system normally do not require conventional browser cookies.

Where consent is required, KleipData will seek consent before the relevant non-exempt technology is activated.

Consent must represent a genuine choice.

Accordingly, where applicable:

• a. optional technologies will not be pre-enabled merely because a visitor arrived on the website;
• b. consent will require an affirmative action;
• c. consent choices will be sufficiently granular;
• d. consent will not be hidden inside the Terms of Service;
• e. refusing optional technologies will be possible;
• f. consent choices will be recorded; and
• g. consent can subsequently be withdrawn.

The KleipData consent interface should allow users to:

Accept optional technologies

or

Reject optional technologies

and, where appropriate:

Manage individual categories

without unnecessary difficulty.

KleipData does not intentionally design consent interfaces to mislead users into accepting optional technologies.

Where KleipData relies upon the statistical-purpose or appearance exception rather than consent, the relevant technology may initially operate without opt-in consent.

However, the user must have a simple and free means of objecting.

Cookie Settings should therefore allow a user to switch off technologies operating under those exceptions where required.

Once a valid objection is made, KleipData will stop the relevant storage or access unless another lawful exception applies.

A Cookie Settings link should remain available from the website footer or another easily accessible location.

Through Cookie Settings, users should be able to:

• a. see the categories of technologies in use;
• b. understand their purposes;
• c. accept optional categories;
• d. reject optional categories;
• e. object to statistical-purpose technologies where applicable;
• f. object to appearance technologies where applicable;
• g. change previous choices; and
• h. access the current Cookie Register.

A user may change an optional consent decision.

Where consent is withdrawn:

• a. KleipData will stop future storage or access requiring that consent;
• b. withdrawal does not retrospectively make earlier processing unlawful; and
• c. some information previously collected may continue to be retained where another lawful retention basis applies.

A user who previously objected to a technology operating under an applicable exception may subsequently change that preference.

KleipData may store a necessary consent or preference record so that the website can remember:

• a. whether Cookie Settings have been presented;
• b. which optional categories were accepted;
• c. which categories were rejected;
• d. which exceptions were objected to;
• e. when the choice was made; and
• f. which version of the consent configuration applied.

Without such a record, the website might need to ask the same question on every page visit.

We may periodically ask users to review their choices.

We may also seek fresh consent where:

• a. new purposes are introduced;
• b. material new third parties are introduced;
• c. the nature of the processing changes;
• d. an existing technology is materially repurposed; or
• e. applicable law or regulatory guidance requires a new choice.

KleipData will maintain a Cookie Register for technologies currently deployed.

The register should identify, as applicable:

The production Cookie Register forms part of this Cookie Policy.

Because website technology changes over time, the current live Register may be more accurate than a historical static copy of this Policy.

KleipData will not list a cookie merely because it is commonly used by another website.

The Cookie Register should reflect technologies actually deployed in the KleipData environment.

Before introducing a new Cookie or Similar Technology, KleipData should determine:

• a. its provider;
• b. its purpose;
• c. information accessed;
• d. information stored;
• e. duration;
• f. whether personal data is processed;
• g. third parties receiving information;
• h. whether consent is required;
• i. whether a statutory exception applies; and
• j. what control must be provided to the user.

KleipData may use a third-party analytics provider.

Where we rely upon the statistical-purpose exception, the provider must be configured so that it is assisting KleipData with service improvement rather than independently:

• a. profiling users;
• b. combining information with unrelated datasets;
• c. using the information for advertising;
• d. tracking visitors across unrelated services; or
• e. using the information for its own unrelated purposes.

If a provider cannot operate within those conditions, KleipData should obtain consent where required rather than incorrectly relying upon the exception.

Moving a tag or analytics process from a browser to server-side infrastructure does not automatically remove the application of PECR.

Where a server-side process causes information to be stored on or accessed from a user’s device, the relevant PECR rules may continue to apply.

KleipData will therefore assess the substance of the technology rather than treating server-side deployment as a means of avoiding cookie obligations.

Device fingerprinting or similar techniques may constitute a Storage and Access Technology even where no conventional browser cookie is placed.

KleipData will not use device fingerprinting for optional tracking or advertising without satisfying applicable consent requirements.

Security-related fingerprinting will be assessed according to its actual necessity, purpose and legal basis.

Most browsers allow users to:

• a. inspect cookies;
• b. delete cookies;
• c. block cookies;
• d. restrict third-party cookies; and
• e. apply other privacy settings.

Browser controls may be useful but are not necessarily a substitute for the controls KleipData is legally required to provide.

Blocking all cookies may prevent functionality that depends upon Strictly Necessary Technologies, including authenticated portal sessions.

Deleting cookies through your browser may delete the cookie containing your previously recorded preference.

If that occurs, KleipData may need to present Cookie Settings again on a later visit.

A computer or device may be used by more than one person.

A preference stored on a device may therefore reflect the decision made by a previous user of that device.

Where appropriate, Cookie Settings allow the current user to change those preferences.

Where information collected through Cookies or Similar Technologies constitutes personal data, KleipData must also establish an appropriate data-protection lawful basis.

The PECR treatment of a technology and the UK GDPR lawful basis for resulting personal-data processing are related but distinct questions.

Where PECR requires consent, consent will normally also be relevant to the associated personal-data processing.

Where a PECR exception applies, KleipData will separately identify an appropriate UK GDPR lawful basis where personal data is involved.

A third-party technology provider may process information outside the United Kingdom.

Where this results in a restricted transfer of personal data, KleipData will use an appropriate transfer mechanism as described in the KleipData Privacy Policy.

The current Cookie Register or associated privacy information may identify relevant third-party providers.

KleipData will seek to configure Cookies and Similar Technologies so that they do not collect more information than reasonably required for their purpose.

In particular, ordinary website analytics should not receive:

• a. API secret keys;
• b. passwords;
• c. raw Search Results;
• d. KYC documents;
• e. complete customer case contents;
• f. personal-data intelligence returned through production Searches; or
• g. other sensitive information unnecessary for website analytics.

KleipData should exercise particular care when deploying analytics or third-party tags within authenticated pages containing customer or Service Data.

The fact that a tag is acceptable on a public marketing page does not mean it is appropriate within:

• a. person-search results;
• b. KYC workflows;
• c. case records;
• d. address-history pages;
• e. API credential pages;
• f. audit logs; or
• g. customer reports.

Third-party advertising tags should not receive production Search Results or other restricted Service Data.

KleipData is a business and organisational service and is not directed toward children as customers.

We do not use Cookie technologies for the purpose of profiling children for behavioural advertising through the KleipData service.

KleipData should periodically audit its website and applications to identify:

• a. technologies actually deployed;
• b. undeclared third-party tags;
• c. changed provider behaviour;
• d. technology duration;
• e. consent configuration;
• f. technologies firing before consent;
• g. whether exception conditions remain satisfied;
• h. whether rejected technologies remain disabled; and
• i. whether the Cookie Register remains accurate.

Before introducing a materially new tracking, analytics, advertising or storage technology, KleipData should assess:

• a. its business purpose;
• b. necessity;
• c. PECR requirements;
• d. UK GDPR implications;
• e. third-party use;
• f. international transfers;
• g. security;
• h. retention;
• i. data minimisation; and
• j. the appropriate user control.

We may update this Cookie Policy where:

• a. our technology changes;
• b. applicable law changes;
• c. ICO guidance changes;
• d. new service functionality is introduced;
• e. new providers are used; or
• f. our privacy arrangements change.

The current version and the date this Cookie Policy was last updated will be displayed on the KleipData website.

Material changes to technologies requiring consent may require a new consent choice rather than merely an update to this Policy.

Questions or complaints concerning Cookies and Similar Technologies may be sent to:

support@kleipdata.co.uk

You also have the right to complain to the Information Commissioner’s Office where applicable.

Further information concerning data-protection complaints is contained in the KleipData Privacy Policy.

KleipData Operated by Computerko Limited 27 Old Gloucester Street London WC1N 3AX United Kingdom

Company Registration Number: 11125670

Email: support@kleipdata.co.uk

Privacy Policy: /privacy

Cookie Settings: available through the KleipData website footer.