COOKIE AND SIMILAR TECHNOLOGIES POLICY

This Policy explains how ScoreID B.V. uses cookies, local storage, pixels, tags, software development kits (“SDKs”), device identifiers and similar technologies (“Technologies”) on its websites, applications, dashboards and developer interfaces. It applies to the Technologies that ScoreID deploys or permits a provider to deploy on its behalf.

The Privacy Notice explains the wider processing of Personal Data, including legal bases, recipients, transfers, retention and rights. This Policy does not replace the live consent manager. The live inventory in Annex 1 or the consent manager must accurately reflect the Technologies actually operating in each environment.

The public marketing website and an authenticated product may use different Technologies. A consent recorded on one domain or application applies only to the scope disclosed in the consent interface unless a lawful cross-domain mechanism clearly states otherwise.

Cookies are small data files stored on or read from a browser or device. Session cookies normally expire when the session or browser closes; persistent cookies remain for a stated period. First-party cookies are set by the domain being used; third-party cookies are set or accessed by another provider.

Local storage and similar browser storage can retain identifiers, preferences and state. Pixels, tags and SDKs can transmit device, page, event, advertising or app information to ScoreID or a provider. Device fingerprinting and link decoration may identify or distinguish a device even without a conventional cookie and are treated according to their function and applicable law.

The rules apply to access to or storage of information on terminal equipment, not only to technologies labelled “cookies”. Renaming or implementing a technology in an SDK does not avoid consent or transparency obligations.

A Technology is classified by its actual purpose and configuration. A vendor product may contain both necessary and optional functions; optional functions are not treated as necessary merely because they are bundled in the same SDK.

In the EEA and United Kingdom, we request valid prior consent before storing or accessing information on a user’s device unless the action is strictly necessary to transmit a communication or provide a service expressly requested by the user. Any later processing of Personal Data must also have a GDPR/UK GDPR legal basis described in the Privacy Notice.

In other opt-in jurisdictions, we apply the locally required consent standard. In U.S. states, analytics or advertising disclosures may constitute sale, sharing or targeted advertising depending on actual configuration. We provide legally required opt-out and universal-signal controls and obtain consent for sensitive-data processing where required.

We do not rely on a generic statement that continued browsing constitutes consent where affirmative consent is legally required. We do not use consent for strictly necessary security and authentication processing merely to avoid relying on the correct lawful basis.

Optional Technologies are off by default until the individual makes an affirmative choice. Accept and Reject choices are displayed with comparable ease and prominence. Category and vendor-level information is available before choice, and pre-ticked boxes, inactivity, scrolling or ambiguous controls are not used as consent.

Consent is specific by purpose and is not bundled with Terms acceptance, account creation, wallet connection, institution sharing, email marketing, SMS marketing or push marketing. Refusing optional Technologies does not prevent use of core Services, although an optional feature may not remember preferences or load a third-party component until enabled.

Withdrawing consent is as easy as giving it and stops future optional storage/access and associated processing. Withdrawal does not require removal of strictly necessary Technologies and does not retroactively invalidate processing completed while consent was valid.

A persistent “Cookie Settings” or “Privacy Choices” control is available on relevant websites and applications. The manager describes each category, provider and purpose; records the choice; prevents non-essential tags/SDKs from firing before consent; and applies withdrawal across the disclosed scope.

Consent records include the notice and vendor-list version, purposes and vendors selected, timestamp, region, interface/domain, relevant pseudonymous identifier and later change or withdrawal. Records are access-restricted and retained only for the accountability period and preference function.

We retest blocking and withdrawal after material site, app, tag-manager, vendor or SDK change. A policy statement alone is not evidence that the technical consent control works.

Third-party providers may receive device, page, event, IP or identifier information where their Technology is enabled. Annex 1 identifies the provider and links or directs users to relevant information. Depending on the configuration, a provider may act as our processor or as an independent controller for its own purpose; this role is assessed and not assumed.

We contractually restrict processors, minimise event payloads, avoid transmitting Scores or wallet/financial profiles to advertising or general analytics vendors, and disable unnecessary data sharing. A third-party tag or SDK must not receive seed phrases, private keys, connected-source credentials, full transaction histories or High-Impact Decision Outputs.

Where a provider processes data outside the EEA/UK/Switzerland, we use the transfer mechanisms and supplementary measures described in the Privacy Notice and current Subprocessor/Transfer List. Consent to a cookie is not automatically valid consent to an international transfer derogation.

• Open Cookie Settings or Privacy Choices to accept, reject or change optional categories and vendors.
• Use browser or device settings to block or delete stored information, recognising that authentication or requested functionality may be affected.
• Use application permissions and operating-system settings to control device identifiers, push notifications and certain SDK access.
• Use account marketing preferences or the message opt-out to control promotional email, SMS and push; these choices are separate from cookie consent.
• Contact …@scoreid.com if the consent manager does not reflect a choice or an optional Technology appears active after rejection.

Where legally required, ScoreID recognises Global Privacy Control (“GPC”) and other legally recognised universal opt-out mechanisms as a request to opt out of sale, sharing and targeted advertising for the relevant browser/device. The signal is applied without requiring an account and, where we can lawfully and reliably associate it, may also be applied at account level.

The industry’s treatment of legacy “Do Not Track” signals is not uniform. ScoreID responds where law requires or where the consent interface expressly states. We do not treat the absence of a GPC or Do Not Track signal as consent to optional Technologies in an opt-in jurisdiction.

Each Technology’s lifespan is limited to the shortest period reasonably necessary for its function and appears in Annex 1 or the live manager. Persistent identifiers are not renewed merely to extend tracking without a valid purpose and choice. Analytics and marketing event data are retained under the Privacy Notice and vendor contract, independently of the browser cookie expiry.

Consent is requested again when required by law, after expiry of the selected accountability period, or when a material purpose/vendor change invalidates the earlier choice. Security and suppression records may be retained longer where necessary to protect the Services or honour an opt-out.

The Privacy/Legal owner approves categories and notices; Product/Engineering owns accurate technical inventory and blocking; Security reviews vendor access; and Marketing must not deploy a tag or SDK outside the approved change process. A scan and manual verification are performed before production and after material releases.

This Policy is reviewed at least annually and upon material Technology, vendor, purpose or legal change. Material changes are notified and renewed consent is requested where necessary. Questions may be sent to ScoreID B.V. at …@scoreid.com.

Public landing-page verification on 16 July 2026 observed no browser-readable cookie, local-storage or session-storage keys and one first-party script (/js/landing.js). This observation does not establish the complete server-side, CDN, authenticated-app or mobile-SDK inventory. The table below must be updated from a production scan and vendor configuration before publication and kept synchronised with the consent manager.