Privacy policy.Your data, handled with care.

1. Introduction

This Privacy Policy explains how CookieLet (a DigitalOfficePro company) (“Cookielet,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal data in connection with our consent management platform, including our website, dashboard, consent tools, cookie scanning features, scripts, support channels, and related products and services (collectively, the “Service”).

We are committed to handling personal data responsibly and transparently. This Privacy Policy describes the categories of personal data we process, the purposes for which we process it, the legal bases we rely on where applicable, and the rights and choices available to individuals. We encourage you to read this Privacy Policy carefully so that you understand our practices.

This document is provided for general informational purposes and does not constitute legal advice.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data we process when individuals and organisations:

• visit, browse, or interact with our website and any associated online properties;
• register for, access, or use the Cookielet dashboard and account features;
• configure, deploy, or operate our consent tools, banners, scripts, and cookie scanning features;
• contact us through our support channels, sales enquiries, or other communications; and
• otherwise engage with us in connection with the Service.

This Privacy Policy does not apply to the websites, products, or services of our customers or of any third parties, even where those are integrated with or accessed through the Service.

3. Who We Are

The entity responsible for the Service is CookieLet (a DigitalOfficePro company), Techhub, 101 Finsbury Pavement, EC2A 1RS, London, United Kingdom (company number 10899076). For the purposes of applicable data protection laws, we act as the controller of personal data described in this Privacy Policy except where we expressly state, or where the context indicates, that we act as a processor on behalf of a customer.

4. Personal Data We Collect

The categories of personal data we collect depend on how you interact with the Service. In general, we may collect:

• Identity and account data, such as name, username, job title, organisation name, and login credentials;
• Contact data, such as email address, telephone number, and business address;
• Billing and transaction data, such as billing contact details, plan and subscription information, and limited payment-related information processed through our payment providers;
• Usage and configuration data, such as settings, preferences, and configurations applied within the dashboard and consent tools;
• Technical and device data, such as IP address, browser type, device identifiers, operating system, and similar diagnostic information;
• Support and communications data, such as the content of your enquiries, correspondence, and records of your interactions with our teams;
• Marketing and preference data, such as your subscription choices and communication preferences; and
• Consent and cookie data processed through the Service, as described below.

5. Information Customers Provide

When customers register for and use the Service, they provide certain information directly to us. This typically includes account registration details, organisation and billing information, the websites and domains on which the Service is deployed, configuration choices for consent banners and tools, and any information submitted through support requests or other communications.

Customers are responsible for ensuring that the information they provide to us is accurate and that they have an appropriate legal basis and any necessary permissions to share with us any personal data relating to their personnel, end users, or other individuals.

6. Information Collected Automatically

When you use our website or the dashboard, we and our service providers may automatically collect certain information through cookies, log files, and similar technologies. This may include IP address, device and browser characteristics, pages and features accessed, referring and exit pages, timestamps, and aggregated usage statistics.

We use this information to operate, secure, and improve the Service, to understand how it is used, to detect and prevent fraud or misuse, and to maintain the reliability and performance of our systems.

7. Consent and Cookie Data Processed Through Cookielet

A core function of the Service is to help our customers manage consent on their own websites and applications. When the Service is deployed by a customer, it may process information relating to that customer's end users, including:

• consent and preference records, including the choices an end user makes regarding cookies and similar technologies, and the date, time, and scope of those choices;
• technical identifiers and signals used to recognise returning visitors and to apply their preferences, such as consent identifiers and limited device or browser information;
• information generated by cookie scanning features, which detect and categorise cookies, scripts, trackers, and similar technologies present on a customer's properties; and
• records used to demonstrate that consent was collected and managed in accordance with the customer's configuration.

When we process this consent and cookie data, we generally act as a processor on behalf of the customer, who acts as the controller. The customer is responsible for determining the lawful basis for this processing and for configuring the Service appropriately.

8. How We Use Personal Data

Where we act as a controller, we use personal data for purposes that may include:

• providing, operating, maintaining, and supporting the Service;
• creating and administering accounts and authenticating users;
• processing billing, subscriptions, and related transactions;
• responding to enquiries and providing customer and technical support;
• monitoring, securing, and improving the Service and developing new features;
• conducting analytics to understand usage and performance;
• sending administrative, service, and security communications;
• sending marketing communications where permitted, subject to your choices;
• detecting, investigating, and preventing fraud, abuse, and security incidents; and
• complying with legal obligations and enforcing our terms and agreements.

9. Legal Bases for Processing

Where data protection laws require a legal basis for processing personal data, we rely, depending on the circumstances, on one or more of the following:

• Performance of a contract — where processing is necessary to provide the Service or to take steps at your request before entering into a contract;
• Legitimate interests — where processing is necessary for our legitimate interests, such as securing and improving the Service;
• Consent — where you have given consent for a specific purpose, which you may withdraw at any time; and
• Compliance with legal obligations — where processing is necessary to meet our legal and regulatory obligations.

10. Cookies and Similar Technologies

Our own website and dashboard use cookies and similar technologies to operate, secure, and analyse the Service, to remember your preferences, and to understand how the Service is used. Some of these technologies are strictly necessary for the Service to function, while others are used only where permitted or with your consent.

You can manage your preferences for non-essential cookies through the controls we make available and through your browser settings. For further details, see our Cookie Policy.

11. Sharing Personal Data

We do not sell personal data. We may share personal data in the following circumstances:

• with service providers and subprocessors who process personal data on our behalf to support the operation of the Service;
• with our affiliates and group entities, where applicable, for the purposes described in this Privacy Policy;
• in connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards;
• where required to comply with applicable law, legal process, or a lawful request from a public authority; and
• to protect the rights, property, safety, and security of Cookielet, our customers, our users, or others, and to enforce our agreements.

12. Third-Party Service Providers / Subprocessors

We engage trusted third-party service providers and subprocessors to perform functions on our behalf, such as cloud hosting and infrastructure, data storage, analytics, payment processing, communications, and customer support tooling. These providers are permitted to process personal data only as necessary to provide their services to us and are subject to contractual obligations to protect personal data.

13. International Data Transfers

We and our service providers may process and store personal data in countries other than the one in which it was originally collected. Where personal data is transferred across borders, we take steps to ensure that appropriate safeguards are in place, which may include standard contractual clauses or other lawful transfer mechanisms.

14. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service, to comply with our legal, accounting, and reporting obligations, to resolve disputes, and to enforce our agreements. When personal data is no longer required, we take reasonable steps to delete, anonymise, or otherwise securely dispose of it.

15. Security

We maintain technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction. These measures may include access controls, encryption in transit, network and application safeguards, monitoring, and internal policies and training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Customer Responsibilities

Customers who deploy the Service on their own websites and applications remain responsible for their own compliance obligations, including providing their own privacy notices and cookie policies, configuring consent banners appropriately, determining legal bases for processing, and responding to the privacy rights requests of their own end users.

17. Your Privacy Rights

Subject to applicable law, individuals may have certain rights in relation to their personal data, which may include the right to access, correct, update, or delete personal data; to object to or restrict certain processing; to data portability; and to withdraw consent where processing is based on consent. Where applicable, individuals may also have the right to lodge a complaint with a supervisory authority.

To exercise any rights you may have, please contact us using the details in the Contact Information section. We may need to verify your identity before responding to a request.

18. Children's Privacy

The Service is intended for use by businesses and is not directed to children. We do not knowingly collect personal data directly from children. If we become aware that we have collected personal data from a child in a manner inconsistent with applicable law, we will take appropriate steps to delete that data.

19. Links to Third-Party Websites

The Service may contain links to third-party websites, products, or services that are not operated or controlled by us. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable legal requirements. When we make changes, we will update the “Last updated” date at the top of this page.

21. Contact Information

If you have any questions, comments, or requests regarding this Privacy Policy or our data practices, please contact us: