Cookie & Tracking Policy

This Cookie Policy is issued by DCK Media & Business Consulting (Registration No. 202503147640 (PG0572109-H)), a business registered in Malaysia. Capitalised terms not defined here have the meanings given in our Privacy Policy and Terms of Service, including "Services", "Platform", "Apps", "Customer", "Visitor", "Tracking Script" and "Personal Data".

This Cookie Policy covers:

• (a)cookies and browser storage used on our website at dckvisibility360.com, the Platform and the Apps, for which we are the controller;
• (b)third-party technologies that may operate when you use our Services; and
• (c)the Tracking Script when a Customer installs it on a website the Customer owns or controls, for which the Customer is the controller and we are its processor (Section 7).

Information collected through cookies and similar technologies may be Personal Data. We process it as described in our Privacy Policy, which also explains your rights and how to contact our Data Protection Officer.

In this Cookie Policy, "cookies and similar technologies" means any technology that stores or accesses information on your browser or device, including:

Laws such as Article 5(3) of the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations 2003 ("PECR") apply to all of these technologies, not only to cookies. References to "cookies" in this Cookie Policy include them all unless the context requires otherwise.

We group cookies and similar technologies into the following categories:

• (a)Strictly necessary — required for the Services to work, for example to keep you signed in, to secure the Services and to remember the session of an authorised sales representative. They cannot be switched off in our systems; you can block them in your browser, but parts of the Services will then not work.
• (b)Functional (preferences) — remember choices you make, such as light or dark theme, language and whether you have completed or dismissed an onboarding checklist. Blocking them means your preferences will not be remembered.
• (c)Analytics — help us understand how our website is used, which pages and campaigns bring visitors, and which pages lead to enquiries, so that we can improve it. Our analytics are first-party and use our own Tracking Script.
• (d)Advertising — we do not currently use advertising, retargeting or cross-site tracking cookies. If we introduce them, we will update this Cookie Policy and obtain consent where required before using them.

The following items are set by us on our own domains. Durations are approximate and may change as we update the Services; this table will be updated if we add new items in a different category.

We self-host the web fonts used on our website, so loading our pages does not cause Google Fonts or any other font service to set cookies or receive your IP address.

Some third parties set their own cookies or similar technologies when you use our Services or follow links from them. They act as independent controllers or as our service providers, as indicated in our Privacy Policy, and their own cookie and privacy policies apply.

Where we use error and performance monitoring (Sentry) on our pages, it collects technical information about errors to keep the Services secure and working; it is not used for advertising.

We use our own Tracking Script on our website to understand how visitors find and use it. On our website, we are the controller of the data collected.

The Tracking Script collects:

• (a)the page URL and title, referrer and UTM campaign parameters;
• (b)page text, metadata and structured data (for SEO analysis of our own pages) and page performance metrics;
• (c)your browser's user agent, language and screen size;
• (d)the pseudonymous identifiers seo_ai_visitor (localStorage) and seo_ai_session (sessionStorage); and
• (e)conversion events, being form submissions (recording only the form's action URL, the page, referrer and UTM parameters) and clicks on telephone, email and WhatsApp links.

Privacy safeguards built into the Tracking Script:

• (a)form field values are never read or sent — we do not capture what you type into forms through the Tracking Script;
• (b)your IP address is used only transiently to determine your approximate country and is truncated (anonymised) before storage;
• (c)only salted hashes of IP-derived values are used for rate limiting and abuse prevention;
• (d)the identifiers are random and are not linked to your name or email address unless you separately identify yourself to us (for example, by creating an account or submitting a form); and
• (e)the data is not used for advertising and is not sold or shared for cross-context behavioural advertising.

How to opt out. You can prevent the Tracking Script from identifying you on our website by:

• (a)blocking JavaScript or the Tracking Script using your browser's content-blocking settings or a reputable content-blocking extension;
• (b)clearing local storage and session storage for dckvisibility360.com (often called "clear site data" or "cookies and site data" in your browser settings), which deletes the visitor identifier — a new random identifier will be created on your next visit unless you also block the script; or
• (c)using your browser's private or incognito mode, in which local storage is discarded when you close the window.

Where applicable law requires your consent before analytics identifiers are stored on or read from your device (for example in the EEA or the UK), we rely on consent obtained through the notice or consent controls presented on our website, and you may refuse or withdraw it at any time using the methods in this Cookie Policy. Withdrawal does not affect processing carried out before you withdrew.

Roles. When a Customer installs the Tracking Script on a website, the Customer is the controller of the Visitor data collected and DCK VISIBILITY 360 processes it only as the Customer's processor (in Malaysian terms, its "data processor"; under the CCPA, its "service provider"), in accordance with the Customer's instructions and our Data Processing Addendum. The Tracking Script on a Customer's website collects the same types of data and applies the same safeguards as described in Sections 6.2 and 6.3, using the localStorage key seo_ai_visitor and the sessionStorage key seo_ai_session.

Customer obligations. As required by our Terms of Service, Data Processing Addendum and Acceptable Use Policy, each Customer that installs the Tracking Script must:

• (a)install it only on websites that the Customer owns or controls;
• (b)provide Visitors with clear and comprehensive cookie and privacy notices that describe the Tracking Script and the Customer's use of DCK VISIBILITY 360 as a processor;
• (c)obtain any consent required by applicable law before the Tracking Script is loaded or stores or reads information on a Visitor's device — including under Article 5(3) of the EU ePrivacy Directive and its national implementations, UK PECR, the notice-and-choice requirements of the Malaysian Personal Data Protection Act 2010, the Singapore Personal Data Protection Act 2012, and the notice-at-collection requirements of the CCPA — for example by loading the Tracking Script only after consent is given through the Customer's consent management platform;
• (d)respect Visitors' choices, including withdrawals of consent and opt-out signals where the law requires it;
• (e)not configure, modify or deploy the Tracking Script, or structure its web pages, in a way that causes it to capture sensitive personal data, payment data, passwords, government identifiers, the content of form fields, or Personal Data of children; and
• (f)not use the Tracking Script on pages directed to children or in a way that breaches our Acceptable Use Policy.

What we will not do. Regardless of how the Customer configures its website, the Tracking Script is designed never to read or send form field values, and Visitor IP addresses are truncated before storage. We do not use Visitor data collected on Customer websites to build advertising profiles, and we do not sell it or share it for cross-context behavioural advertising. We may use it in aggregated or de-identified form only as permitted by our Data Processing Addendum and described in our Privacy Policy.

Requests from Visitors. If a Visitor contacts us about data collected on a Customer's website, we will, where we can identify the Customer, refer the request to it and assist the Customer as required by our Data Processing Addendum. We are not responsible for a Customer's failure to provide notices or obtain consents, and, to the maximum extent permitted by applicable law, the Customer bears responsibility for its deployment of the Tracking Script.

Visitor controls. Visitors can always prevent the Tracking Script from identifying them by blocking it or clearing local and session storage for the relevant website, as described in Section 10, in addition to any controls offered by the website owner.

The table below summarises the basis on which we use each category on our own website, Platform and Apps. For the Tracking Script on Customer websites, the Customer determines and is responsible for the legal basis (Section 7).

Global Privacy Control (GPC). We treat a GPC signal sent by your browser as a valid request to opt out of the sale or sharing of your personal information for that browser, as required by the CCPA and similar laws. Because we do not sell personal information or share it for cross-context behavioural advertising, honouring the signal does not change how our website currently operates.

Do Not Track (DNT). There is no common industry or legal standard for how websites should respond to DNT signals. We are working towards having the Tracking Script on our own website recognise DNT and GPC signals by not setting analytics identifiers when they are present. Until that functionality is released, these signals may not prevent analytics on our website, and you should use the controls in Section 10 if you do not want to be measured.

Customers decide whether and how the Tracking Script on their websites responds to browser privacy signals, as part of their own consent and compliance arrangements.

You can control cookies and similar technologies in the following ways:

• (a)Browser settings. Most browsers let you view, block and delete cookies and site data, including localStorage and sessionStorage, and block third-party cookies. Look for "Privacy", "Cookies and site data" or "Clear browsing data" in your browser's settings, or consult its help pages, for example for Chrome, Safari, Firefox and Edge.
• (b)Clearing storage. Deleting site data for dckvisibility360.com removes the analytics identifier and your saved preferences, and signs you out.
• (c)Blocking scripts. Content-blocking settings or extensions can prevent the Tracking Script from running.
• (d)Signing out. Signing out of the Platform removes the authentication tokens stored in your browser and ends the signed-in state indicated by the dckv360_authed cookie.
• (e)Consent controls. Where we present a cookie notice or consent controls on our website, you can use them to give, refuse or withdraw consent to non-essential items.
• (f)App settings. In the Apps, you can manage notifications and other permissions in your device settings and in the App's settings, and you can remove all locally stored App data by signing out or uninstalling the App.

If you block or delete strictly necessary items, you will not be able to sign in or use parts of the Services. If you delete functional items, your preferences will reset. Blocking analytics items does not affect your ability to use the Services.

Your choices are specific to each browser and device. If you use several browsers or devices, or clear all site data, you will need to make your choices again.

The Apps do not use browser cookies in the same way as websites, but they use equivalent device storage and may include software development kits to provide the same functions: keeping you signed in (strictly necessary), remembering your preferences (functional), and collecting crash reports and diagnostics to keep the Apps stable (described in our Privacy Policy).

The Apps do not access the device advertising identifier for tracking and do not track you across apps and websites owned by other companies. We will not use any technology that requires permission under Apple's App Tracking Transparency framework (or an equivalent requirement on Android) without first asking for your permission through the required prompt and updating this Cookie Policy.

The data-collection disclosures on our app-store listings (including Apple's App Privacy labels and Google Play's Data safety section) are intended to be consistent with this Cookie Policy and our Privacy Policy.

We may update this Cookie Policy to reflect changes to the technologies we use, our Services or the law. The "Last updated" date at the top shows when it was last revised.

If we introduce a new category of non-essential cookies or similar technologies (for example, advertising), we will update this Cookie Policy before doing so and, where the law requires, ask for your consent. Other material changes will be notified as described in our Privacy Policy.

If you have questions about this Cookie Policy or our use of cookies and similar technologies, please contact:

• (a)DCK Media & Business Consulting (Registration No. 202503147640 (PG0572109-H)), a business registered in Malaysia
• (b)Data Protection Officer: the DCK VISIBILITY 360 Data Protection Officer (privacy@dckvisibility360.com)
• (c)Privacy and legal: privacy@dckvisibility360.com
• (d)Product support: support@dckvisibility360.com

You also have the rights described in our Privacy Policy, including the right to complain to a data protection authority. The governing law and dispute-resolution provisions of the Terms of Service apply to this Cookie Policy, except where mandatory law provides otherwise.