Cookie Policy
AqNova Marketplace Policies & Disclosures
AQNOVA MARKETPLACE
Global Legal Footer Framework
Comprehensive Compliance & Platform Governance Reference
B. Similar Tracking Technologies
In addition to traditional HTTP cookies, AqNova and its third-party partners may deploy the following similar technologies on the Platform. Where consent is required for cookies, the same consent requirement applies equally to all similar tracking technologies:
| Technology | Technical Description | How It Functions Like a Cookie | Consent Required? |
|---|---|---|---|
| Web Beacons / Pixel Tags | Transparent 1x1 pixel images embedded in web pages or HTML emails. | When loaded, the image request transmits the user's IP address, browser type, timestamp and page URL to the server — enabling page view tracking without a local file. | Yes — for non-essential analytics and advertising purposes |
| Tracking Pixels (Meta Pixel, Google Tag, TikTok Pixel etc.) | JavaScript snippet that fires a request to a third-party server upon specific user actions (page view, add-to-cart, purchase). | Reports user behaviour events and may set third-party cookies. Used for conversion tracking and audience building. | Yes — opt-in consent required |
| Local Storage (HTML5) | Browser-based key-value storage with no expiry date (persists until manually cleared). | Enables persistent storage of larger data payloads than cookies — used for shopping cart state, user preferences, offline functionality. | Essential use: no consent. Non-essential analytics/profiling use: yes, consent required |
| Session Storage (HTML5) | Browser-based key-value storage that is cleared when the browser tab is closed. | Session-scoped storage — used for temporary state management during a browsing session. | Essential use only — no consent required |
| IndexedDB | Browser-based object database enabling complex structured data storage. | Can be used to store user preferences, offline data, and analytics events for batch transmission. | Consent required where used for non-essential purposes |
| ETags / Cache Cookies | HTTP response headers used for browser cache validation. | Can be exploited to recreate deleted cookies ('cookie resurrection') — AqNova does not use ETags for tracking purposes. | N/A — AqNova prohibits their use for tracking |
| Device Fingerprinting | Collection and hashing of multiple device attributes (browser version, installed fonts, screen resolution, time zone, etc.) to create a unique device signature. | Identifies a device without setting any local file, making it persistent across cookie clears. | Explicit consent required for all fingerprinting beyond essential fraud detection. AqNova limits fingerprinting to essential fraud prevention only. |
| CNAME Cloaking | Technique where a first-party subdomain is configured as a CNAME alias for a third-party tracker, disguising third-party cookies as first-party. | Circumvents browser-based third-party cookie blocking. AqNova does not use CNAME cloaking to evade consent or browser tracking protection. | N/A — AqNova expressly prohibits CNAME cloaking for consent evasion |
| Server-Side Tagging | Analytics and ad tracking logic executed on AqNova's server rather than in the user's browser, with data then forwarded to analytics/ad platforms. | Reduces reliance on browser cookies but may involve similar data collection. AqNova's server-side tagging only fires for users who have given valid consent. | Same consent requirements as equivalent client-side technologies |
A. Authentication & Session Management
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_session | AqNova (1st party) | Maintains the authenticated user session. Stores encrypted session ID. Required for login, cart, checkout, and all authenticated Platform actions. | Session | Browser close | No — server-side only |
| aqn_auth_token | AqNova (1st party) | Secure, HttpOnly, Secure-flag authentication token. Enables persistent login ('Remember Me'). Stores encrypted token reference; no PII in the cookie itself. | Persistent | 14 days | No |
| aqn_refresh_token | AqNova (1st party) | OAuth2-compatible refresh token for silent session renewal without re-authentication prompts. | Persistent | 30 days | No |
| aqn_2fa_verified | AqNova (1st party) | Records that two-factor authentication has been successfully completed for the current session. | Session | Browser close | No |
| aqn_device_trust | AqNova (1st party) | Records that a specific device has been verified by the user as a trusted device for reduced MFA friction. | Persistent | 90 days | No |
B. Shopping Cart & Transaction Continuity
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_cart_id | AqNova (1st party) | Preserves shopping cart contents for both authenticated users and guests. Stores a unique cart ID (not product data directly). | Persistent | 30 days | No |
| aqn_checkout_state | AqNova (1st party) | Preserves checkout progress (shipping address, payment method selection) to prevent data loss on browser navigation during checkout. | Session | Browser close | No |
| aqn_wishlist_id | AqNova (1st party) | Preserves wishlist/saved items for guest users between page refreshes. | Persistent | 7 days | No |
| aqn_order_intent | AqNova (1st party) | Tracks in-progress order placement to enable recovery of abandoned checkouts from same device (no personal profile built). | Persistent | 24 hours | No |
C. Security, Fraud Prevention & Platform Integrity
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_csrf_token | AqNova (1st party) | Cross-Site Request Forgery (CSRF) protection. Unique token validated on every state-changing request. Prevents malicious third-party sites from executing unauthorised actions. | Session | Browser close | No |
| aqn_fraud_sid | AqNova (1st party) | Device-level fraud risk signal. Assigns a session-scoped risk identifier used by AqNova's fraud engine. Does not track browsing history or build behavioural profiles. | Session | Browser close | No — internal fraud engine only |
| aqn_rate_limit | AqNova (1st party) | Tracks request frequency per session to enforce API rate limits and prevent automated scraping or brute-force attacks. | Session | Browser close | No |
| __cf_bm | Cloudflare (3rd party) | Cloudflare Bot Management cookie. Distinguishes between human visitors and bots. Collects device type, browser attributes (hashed), and request pattern data. | Session | 30 minutes | Cloudflare only — for security processing |
| __cflb | Cloudflare (3rd party) | Cloudflare load balancer affinity. Routes the user to the same CDN edge server during a session for performance and session consistency. | Session | Browser close | Cloudflare only |
| cf_clearance | Cloudflare (3rd party) | Records successful completion of a Cloudflare security challenge (e.g., CAPTCHA). Prevents repeated challenge prompts. | Persistent | 1 year | Cloudflare only |
D. Payment Processing
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| __stripe_mid | Stripe, Inc. (3rd party) | Stripe payment processor machine identifier. Assigned to device for fraud detection during payment processing. Required for secure checkout. | Persistent | 1 year | Stripe only — for payment fraud detection |
| __stripe_sid | Stripe, Inc. (3rd party) | Stripe session-level payment identifier. Maintains payment session state during checkout. Required for secure payment. | Session | Browser close | Stripe only |
| __stripe_origin-do-not-use | Stripe, Inc. (3rd party) | Stripe security cookie that validates payment request origin. Prevents cross-origin payment attacks. | Session | Browser close | Stripe only |
E. Consent & Legal Compliance
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_consent_id | AqNova (1st party) | Stores a unique reference ID that links the browser to the server-side consent record in AqNova's Consent Management Platform audit log. | Persistent | 12 months | No — internal CMP only |
| aqn_consent_ver | AqNova (1st party) | Records the Cookie Policy version number under which the user's consent choices were made. Triggers re-consent when policy version changes materially. | Persistent | 12 months | No |
| aqn_consent_ts | AqNova (1st party) | Stores the UTC timestamp of the most recent consent interaction (accept, reject, or customise). | Persistent | 12 months | No |
| aqn_consent_cats | AqNova (1st party) | Stores the user's per-category consent choices as a compact binary flag string (e.g., '10010' for essential+analytics only). Used to gate cookie activation client-side. | Persistent | 12 months | No |
| aqn_geo_region | AqNova (1st party) | Stores the user's detected jurisdiction code (e.g., 'EU-DE', 'US-CA', 'NG') to apply the correct legal framework, language, and consent requirements. | Session | Browser close | No |
F. Accessibility & User Interface
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_a11y_prefs | AqNova (1st party) | Stores user-configured accessibility settings (font size, high contrast mode, reduced motion preference, screen reader optimisation) set by the user via the accessibility menu. | Persistent | 1 year | No |
| aqn_ui_lang | AqNova (1st party) | Stores the user's chosen display language to persist language selection across sessions. | Persistent | 1 year | No |
| aqn_ui_currency | AqNova (1st party) | Stores the user's chosen display currency to persist currency preference across sessions. | Persistent | 1 year | No |
| aqn_cookie_banner_dismissed | AqNova (1st party) | Records that the cookie banner has been displayed to the user. Prevents repeated display of the banner where consent has been recorded. | Persistent | 12 months | No |
G. Load Balancing & Infrastructure
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_lb_sticky | AqNova (1st party) | Server affinity cookie. Ensures that all requests from a user during a session are routed to the same backend server for session consistency. | Session | Browser close | No |
| aqn_ab_variant | AqNova (1st party) | Records the A/B test variant assigned to the user for platform feature testing. Contains only a variant identifier (e.g., 'A' or 'B'); no personal data. | Persistent | 30 days | No — internal analytics only |
| AWSALB / AWSALBCORS | Amazon Web Services (3rd party) | AWS Application Load Balancer affinity cookies. Route the user to the same backend instance during a session. | Persistent | 7 days | AWS infrastructure only |
A. Google Analytics 4 (GA4)
Google Analytics 4 is AqNova's primary web analytics platform, operated by Google LLC (US). GA4 uses an event-based data model to measure user interactions across the Platform. AqNova has configured GA4 with IP anonymisation, data minimisation, and limited data retention in compliance with GDPR.
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _ga | Google LLC (3rd party) | Primary GA4 client identifier. Stores a randomly generated client ID (not linked to PII in GA4). Used to distinguish unique visitors. Data collected: pseudonymised user ID, session count, time of first/last visit. | Persistent | 2 years | Google LLC — US. EU SCCs / DPF in place. |
| _ga_[CONTAINER_ID] | Google LLC (3rd party) | GA4 measurement ID-specific cookie. Maintains session state and stores event data for the specific GA4 property. Required for GA4 data collection. | Persistent | 2 years | Google LLC — US |
| _gid | Google LLC (3rd party) | Distinguishes users over a 24-hour period. Used for session-level analytics. | Persistent | 24 hours | Google LLC — US |
| _gat_UA-[ID] | Google LLC (3rd party) | Used to throttle analytics request rate. Does not store user data. | Persistent | 1 minute | Google LLC — US |
| _gcl_au | Google LLC (3rd party) | Google Ads conversion linker. Stores a Google Click ID to attribute ad clicks to Platform conversions. Only active if Google Ads cookies also consented. | Persistent | 90 days | Google LLC — US |
AqNova's GA4 configuration: IP anonymisation enabled; Google Signals disabled; User ID feature disabled (no cross-device tracking without consent); data retention set to 14 months; advertising features (Google Signals) are only enabled if the User has separately consented to Category 4 (Targeting & Advertising) cookies; Data Processing Amendment (DPA) executed with Google under GDPR Art. 28.
B. Hotjar — Session Analytics
Hotjar (Hotjar Ltd, Malta / EU) is used by AqNova for anonymised session recording, heatmap analysis, and user behaviour analytics. Hotjar is configured with IP masking, PII suppression (screens masking all text input fields), and EU-based data storage.
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _hjSessionUser_[ID] | Hotjar Ltd (3rd party) | Assigns a unique Hotjar user ID when the user first visits. Used to link sessions across visits. Anonymised — not linked to PII. | Persistent | 1 year | Hotjar Ltd — Malta (EU) |
| _hjSession_[ID] | Hotjar Ltd (3rd party) | Contains data for the current session including whether Hotjar has initialised, session count and data. | Session | 30 minutes | Hotjar Ltd — Malta |
| _hjAbsoluteSessionInProgress | Hotjar Ltd (3rd party) | Detects the first session of a user for bounce rate calculation. | Session | 30 minutes | Hotjar Ltd — Malta |
| _hjFirstSeen | Hotjar Ltd (3rd party) | Identifies a first-time visitor. Used for session recording sampling logic. | Session | 30 minutes | Hotjar Ltd — Malta |
| _hjIncludedInPageviewSample | Hotjar Ltd (3rd party) | Determines whether the user is included in the pageview sample for analytics reporting. | Session | 30 minutes | Hotjar Ltd — Malta |
| _hjIncludedInSessionSample | Hotjar Ltd (3rd party) | Determines whether the user is included in the session recording sample. | Persistent | 2 minutes | Hotjar Ltd — Malta |
C. Platform-Native Analytics
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_analytics_sid | AqNova (1st party) | AqNova's first-party analytics session identifier. Tracks page views, product views, search queries, and funnel events within a session for internal reporting. Pseudonymised. | Session | Browser close | No — internal only |
| aqn_perf_cohort | AqNova (1st party) | Assigns the user to a performance analytics cohort for aggregate trend analysis. No PII collected. | Persistent | 90 days | No — internal only |
| aqn_page_timing | AqNova (1st party) | Stores page load performance metrics (TTFB, FCP, LCP, CLS) for Core Web Vitals monitoring and platform optimisation. | Session | Browser close | No — internal only |
| aqn_error_trace | AqNova (1st party) | Records anonymised JavaScript error events for platform debugging. Stores error type, page URL, and browser version. No user PII. | Session | Browser close | No — internal only |
A. User Experience Personalisation
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| aqn_recently_viewed | AqNova (1st party) | Stores a list of product IDs recently viewed by the user to power 'Recently Viewed' product recommendations on the Platform. | Persistent | 30 days | No — internal only |
| aqn_search_history | AqNova (1st party) | Stores recent search queries for search suggestion and personalised search result ranking (on-platform only, not shared). | Persistent | 30 days | No — internal only |
| aqn_rec_model_id | AqNova (1st party) | Identifies the recommendation model variant used for the user's product recommendations to enable model performance tracking. | Persistent | 14 days | No — internal only |
| aqn_category_prefs | AqNova (1st party) | Stores the user's browsing category interests (e.g., 'organic food', 'solar energy') for personalised homepage layout. | Persistent | 60 days | No — internal only |
| aqn_price_range_filter | AqNova (1st party) | Stores the user's most recently applied price range filter for convenience in subsequent sessions. | Persistent | 14 days | No — internal only |
B. Support & Live Chat
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| intercom-session-[ID] | Intercom, Inc. (3rd party) | Identifies and authenticates the user within the Intercom support chat widget. Enables chat history continuity. Collects user ID (if logged in), support conversation data. | Persistent | 7 days | Intercom, Inc. — US. EU SCCs in place. |
| intercom-id-[ID] | Intercom, Inc. (3rd party) | Assigns a unique Intercom anonymous visitor ID for users who have not authenticated. Used to link anonymous chat sessions. | Persistent | 270 days | Intercom, Inc. — US |
| intercom-device-id-[ID] | Intercom, Inc. (3rd party) | Device-level Intercom identifier. Supports cross-session continuity for support conversations. | Persistent | 270 days | Intercom, Inc. — US |
| __zlcmid | Zendesk / Zopim (3rd party) | Live chat user identifier. If Zendesk Chat is deployed as a support channel, this cookie stores a unique visitor ID. | Persistent | 1 year | Zendesk, Inc. — US. EU SCCs in place. |
C. Video Embeds & Educational Content
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared? |
|---|---|---|---|---|---|
| YSC | YouTube / Google LLC (3rd party) | YouTube session cookie. Tracks views of embedded product videos within the Platform session. | Session | Browser close | Google LLC — US. EU SCCs / DPF. |
| VISITOR_INFO1_LIVE | YouTube / Google LLC (3rd party) | Estimates the user's YouTube bandwidth for adaptive video streaming. Stores a unique visitor ID. | Persistent | 6 months | Google LLC — US |
| PREF | YouTube / Google LLC (3rd party) | YouTube player preference cookie (e.g., playback quality, volume). Stored when user interacts with embedded YouTube player. | Persistent | 8 months | Google LLC — US |
| yt-remote-device-id | YouTube / Google LLC (3rd party) | YouTube remote control device identifier for TV/streaming device integration. Rarely set in standard browser sessions. | Persistent | Never (until cleared) | Google LLC — US |
A. Google Advertising & Retargeting
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _gcl_aw | Google LLC (3rd party) | Google Ads Click Linker. Stores the Google Click ID (gclid) from an ad click to attribute conversions to Google Ads campaigns. | Persistent | 90 days | Google LLC — US. EU SCCs / DPF. |
| _gcl_dc | Google LLC (3rd party) | DoubleClick (Google Ads) attribution cookie. Used for cross-device conversion measurement. | Persistent | 90 days | Google LLC — US |
| IDE | Google / DoubleClick (3rd party) | DoubleClick/Google Display Network identifier. Used for remarketing, cross-site interest tracking, and ad frequency capping. Enables Google to show AqNova ads to users on other websites. | Persistent | 13 months | Google LLC — US; advertising partners in Google Display Network |
| 1P_JAR | Google LLC (3rd party) | Collects website statistics and tracks conversion rates for Google Ads campaigns. May be used for targeted advertising. | Persistent | 30 days | Google LLC — US |
| NID | Google LLC (3rd party) | Google advertising and personalisation cookie. Stores user preferences and may be used to personalise Google services shown on AqNova. | Persistent | 6 months | Google LLC — US |
| AID | Google LLC (3rd party) | Links activity across Google products and signed-in devices for cross-device advertising when user is signed into a Google Account. | Persistent | 13 months | Google LLC — US |
| DSID | Google LLC (3rd party) | DoubleClick signed-in user ID cookie. Used with Google Ads for cross-device remarketing for signed-in Google users. | Persistent | 2 weeks | Google LLC — US |
B. Meta (Facebook & Instagram) Advertising
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _fbp | Meta Platforms, Inc. (3rd party) | Meta Pixel browser identifier. Distinguishes and tracks users for Facebook/Instagram ad targeting, custom audience building, and conversion measurement. Stores a unique browser ID. | Persistent | 90 days | Meta Platforms, Inc. — US; advertising partners in Meta Audience Network |
| _fbc | Meta Platforms, Inc. (3rd party) | Facebook Click ID cookie. Stores the fbclid parameter from Facebook ad clicks for attribution to Meta ad campaigns. | Persistent | 90 days | Meta Platforms, Inc. — US |
| fr | Meta Platforms, Inc. (3rd party) | Meta's primary advertising cookie. Used for ad targeting, measurement, and user interest profiling across Meta properties and partner sites (Facebook Audience Network). | Persistent | 90 days | Meta Platforms, Inc. — US; Meta Audience Network partners |
| datr | Meta Platforms, Inc. (3rd party) | Meta security and integrity cookie. Identifies the browser for security and spam prevention on Facebook. May contribute to interest-based ad targeting. | Persistent | 2 years | Meta Platforms, Inc. — US |
C. TikTok Advertising
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _ttp | TikTok Inc. / ByteDance (3rd party) | TikTok Pixel identifier. Tracks ad conversions and user behaviour for TikTok ad campaign optimisation and audience targeting. Unique browser ID. | Persistent | 13 months | TikTok Inc. — US/Singapore. EU SCCs in place. |
| tt_appInfo | TikTok Inc. (3rd party) | Stores TikTok app/session context for web-to-app conversion tracking. | Session | Browser close | TikTok Inc. — US/Singapore |
| tt_sessionId | TikTok Inc. (3rd party) | TikTok session identifier for conversion event attribution. | Session | Browser close | TikTok Inc. — US/Singapore |
D. Pinterest & LinkedIn Advertising
| Cookie Name | Provider | Purpose & Data Collected | Type | Expiry | Data Shared With |
|---|---|---|---|---|---|
| _pin_unauth | Pinterest, Inc. (3rd party) | Pinterest Tag identifier for users not signed in to Pinterest. Used for conversion tracking and audience building for Pinterest Ads. | Persistent | 1 year | Pinterest, Inc. — US. EU SCCs in place. |
| _pinterest_ct_ua | Pinterest, Inc. (3rd party) | Pinterest Conversion Tag user identifier. Links ad clicks to Platform conversions. | Persistent | 1 year | Pinterest, Inc. — US |
| li_fat_id | LinkedIn / Microsoft (3rd party) | LinkedIn Insight Tag first-party ad tracking identifier. Used for B2B retargeting, LinkedIn conversion tracking and website demographics reporting. | Persistent | 30 days | LinkedIn Ireland / Microsoft — IE/US |
| AnalyticsSyncHistory | LinkedIn / Microsoft (3rd party) | Stores information about the time a sync with the lms_analytics cookie took place for LinkedIn analytics. | Persistent | 30 days | LinkedIn Ireland — IE |
| li_gc | LinkedIn / Microsoft (3rd party) | Stores LinkedIn Guest user consent status for advertising cookies. | Persistent | 6 months | LinkedIn Ireland — IE |
E. Programmatic Advertising & DSP Partners
AqNova may work with programmatic advertising technology partners to serve targeted display and video advertising across the open internet. The following cookie providers may be activated where the User has consented to Category 4 cookies and AqNova is running active programmatic campaigns:
| Provider | Cookie(s) | Purpose | Expiry | Data Shared With |
|---|---|---|---|---|
| The Trade Desk | TDID, TTDOptOut | Demand-side platform (DSP) user identifier for programmatic display and video advertising. Cross-site audience targeting. | 13 months | The Trade Desk, Inc. — US/EU |
| Criteo | uid, dis, cvt | Retargeting platform. Serves personalised product ads based on Platform browsing history. Stores unique user ID and product interaction events. | 13 months | Criteo S.A. — France/EU |
| Amazon Advertising (AAP) | ad-id, ad-privacy | Amazon DSP / advertising cookie. Used for retargeting across Amazon properties and partner sites where AqNova advertises. | 13 months | Amazon Advertising — US/EU |
| Microsoft Advertising (UET) | MUID, _uetsid, _uetvid | Microsoft/Bing Universal Event Tracking. Conversion tracking and remarketing for Microsoft Advertising campaigns. | 13 months | Microsoft Corporation — US/EU |
AqNova maintains a complete and up-to-date programmatic advertising partner list within the Cookie Preference Center (CPC). All programmatic partners are bound by Data Processing Agreements and are disclosed to users in the IAB TCF 2.2 vendor list (for EU/UK users) and in the CPC third-party register for all other users.
B. Embedded Maps
| Provider | Cookie Name(s) | Purpose & Data Collected | Type | Expiry | Third-Party Policy |
|---|---|---|---|---|---|
| Google Maps | NID, 1P_JAR, CONSENT, SOCS | Embedded Google Maps for vendor location display. Tracks map interaction and may be used by Google for advertising personalisation. | Persistent | 6 months | policies.google.com/privacy |
A. Web Beacons on Platform Pages
In addition to cookies, AqNova embeds web beacons (also called pixel tags or clear GIFs) within certain Platform pages and in HTML email communications. Web beacons are transparent 1x1 pixel images that, when loaded, transmit a minimal HTTP request to a server — recording the event of the page or email being viewed. Data transmitted may include IP address, browser type, referring URL, date and time of the request.
Web beacons on Platform pages function in conjunction with the cookies described in this Policy and are subject to the same consent requirements as the cookies they support. No web beacon on a non-essential page is loaded until the User has given valid consent to the relevant cookie category.
B. Tracking Pixels in Transactional Email
AqNova embeds tracking pixels in certain transactional email communications (order confirmations, dispatch notifications, return updates) for the limited purpose of confirming email delivery and open rates. These pixels are considered essential communications infrastructure. The following disclosures apply:
The pixel is a 1x1 transparent image embedded in the email HTML.
When the email is opened in an HTML-capable email client, the image loads and transmits the open event to AqNova's email service provider (ESP), including timestamp and device type (mobile/desktop).
No personal profile is built from transactional email open data — it is used solely for delivery confirmation and operational reporting.
Marketing and promotional emails that include tracking pixels are subject to opt-in consent under CASL, CAN-SPAM, GDPR Art. 6(1)(a), and equivalent laws. Users may opt out of marketing emails at any time through the unsubscribe link in each message or through account settings.
AqNova's Email Service Provider (ESP) — [provider name — to be confirmed] — is bound by a Data Processing Agreement under GDPR Art. 28 and equivalent requirements.
C. Conversion Pixels (Server-Side)
For users who have consented to Category 4 (Targeting & Advertising) cookies, AqNova may deploy server-side conversion tracking in addition to or in place of client-side pixels. Server-side tracking processes conversion events (purchases, sign-ups, add-to-cart) on AqNova's servers before transmitting hashed, pseudonymised event data to advertising platforms (Google, Meta, TikTok). This approach:
Reduces reliance on browser-stored cookies, improving measurement accuracy in environments where cookies are blocked.
Uses hashed (SHA-256) email addresses and phone numbers where transmitted for matching purposes — never plain-text PII.
Is subject to the same consent requirements as client-side Category 4 cookies. Server-side conversion events are only transmitted for users who have given valid Category 4 consent.
3.2.9 Mobile Application Tracking & Device Identifiers
If AqNova offers a native mobile application (iOS and/or Android), the following tracking technologies may be deployed within the app, subject to applicable platform consent requirements:
| Identifier / Technology | Platform | Purpose | Opt-Out Mechanism |
|---|---|---|---|
| Apple IDFA (Identifier for Advertisers) | iOS (Apple) | Device-level advertising identifier used for ad targeting and conversion measurement. Apple's App Tracking Transparency (ATT) framework requires explicit opt-in permission before IDFA can be accessed. | iOS System Settings > Privacy > Tracking; or ATT prompt within AqNova app |
| Android Advertising ID (AAID / GAID) | Android (Google) | Android device advertising identifier equivalent to IDFA. Used for ad targeting, attribution, and audience building. | Android Settings > Google > Ads > Delete/Reset Advertising ID, or opt-out via AqNova app consent settings |
| Firebase Analytics | iOS & Android | Google Firebase event analytics. Collects anonymised app event data (screens viewed, actions taken, crashes). Subject to same consent requirements as GA4 on web. | App Privacy Settings > Analytics toggle in AqNova app settings |
| AppsFlyer / Branch / Adjust (MMP) | iOS & Android | Mobile Measurement Partners (MMPs) used for mobile app install attribution and campaign measurement. Tracks which advertising channel drove an app install. | App Privacy Settings > Advertising toggle in AqNova app settings |
| Push Notification Token | iOS & Android | Device token used to deliver push notifications. Only collected upon explicit permission grant. Not used for advertising tracking. | iOS: Settings > Notifications > AqNova. Android: App Notification Settings. |
On iOS, AqNova complies fully with Apple's App Tracking Transparency (ATT) framework — no IDFA or equivalent tracking identifier is accessed without prior ATT permission. On Android, AqNova complies with Google Play's User Data policy and will not use the Advertising ID for personalised advertising without user consent, consistent with Android's consent requirements.
B. Primary Storage Locations
| Cookie Category | Primary Server Location | Secondary / CDN Location | Transfer Mechanism |
|---|---|---|---|
| Essential — AqNova 1st party | United States (AWS US-West); Canada (AWS ca-central-1) | Cloudflare global CDN network | N/A — primary processing |
| Essential — Cloudflare | Global CDN (Cloudflare edge network) | N/A | Standard Contractual Clauses; DPA with Cloudflare |
| Essential — Stripe | United States / European Union | AWS global infrastructure | DPF certification; EU SCCs |
| Performance — Google GA4 | United States (Google data centres) | EU data centres where regionalisation configured | EU SCCs (Module 2); DPF certification; Google DPA |
| Performance — Hotjar | European Union (Malta / EU data centres) | Minimal US processing | EU-based processing; Hotjar DPA |
| Functional — Intercom | United States (AWS) | EU region available | EU SCCs; Intercom DPA under GDPR Art. 28 |
| Advertising — Google Ads | United States / Global | Regional data centres | EU SCCs; DPF certification |
| Advertising — Meta | United States / EU (Meta EU data centre, Dublin) | Global replication | EU SCCs; Meta DPA |
| Advertising — TikTok | United States / Singapore | EU data centre (for EU users) | EU SCCs; TikTok DPA |
| Social Media — Twitter/X | United States | Global CDN | EU SCCs; Twitter DPA |
C. International Transfer Safeguards
Where cookie-related personal data is transferred to third countries without an EU/UK adequacy decision (primarily to the United States for Google, Meta, and similar US-based providers), AqNova ensures the following safeguards are in place:
EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914 — for all transfers from the EU/EEA to non-adequate third countries.
UK International Data Transfer Agreements (IDTAs) — for all transfers from the United Kingdom to non-adequate third countries.
EU-US Data Privacy Framework (DPF) adequacy — for transfers to US providers that are DPF-certified (including Google LLC, Meta Platforms, Inc., Microsoft Corporation, Stripe, Inc., and others).
Supplementary Technical Measures — applied to all transfers involving large volumes of personal data or involving high-risk recipient countries, including: end-to-end encryption; pseudonymisation prior to transfer; data minimisation; and contractual prohibitions on access for government surveillance purposes.
Transfer Impact Assessments (TIAs) — conducted for all high-volume or high-risk transfers, reviewed annually.
3.2.11 Global Jurisdiction-Specific Legal Disclosure Summary
The following table provides a jurisdiction-indexed summary of the specific legal bases, disclosure obligations, and user rights that apply to AqNova's cookie deployments in each operating jurisdiction. For the full Cookie Preference Management framework applicable in each jurisdiction, see Section 3.3.
Europe & North America
| Jurisdiction | Primary Cookie Law | Consent Standard | Key Disclosure Obligations | Regulator |
|---|---|---|---|---|
| EU/EEA (all 30 states) | ePrivacy Directive 2002/58/EC; GDPR 2016/679 | Prior, freely given, specific, informed, unambiguous affirmative consent | Purpose, provider, duration, data flows for each cookie; TCF 2.2 vendor list | EDPB; national DPAs (lead SA per Art. 56) |
| United Kingdom | PECR 2003; UK GDPR; DPA 2018 | Same as EU GDPR standard per ICO guidance | Full cookie register; no implied consent; ICO-aligned banner design | ICO |
| Switzerland | revFADP (nDSG) 2023 | GDPR-equivalent standard | Full disclosure; local representative required | FDPIC |
| United States — Federal | COPPA; FTC Act § 5; CCPA/CPRA (CA) | No single federal standard; state law applies; FTC requires accurate disclosure | Material cookie disclosures in accessible privacy/cookie policy | FTC; state AGs; CPPA (CA) |
| California (CCPA/CPRA) | Cal. Civ. Code § 1798.100 et seq. | Opt-out of sale/sharing; GPC honoured; sensitive data: opt-in | Do Not Sell/Share disclosure; categories of data collected via cookies; third parties | CPPA; CA AG |
| Other US States (VA, CO, CT, TX etc.) | Virginia VCDPA; Colorado CPA; CT CTDPA; TX TDPSA et al. | Opt-out of targeted advertising and sale; GPC honoured where mandated by law | Categories of data; third-party sharing; opt-out mechanism | State AGs |
| Canada (Federal — PIPEDA) | PIPEDA; CASL; OPC Guidelines on Consent | Meaningful, informed consent; implied consent may apply to some functional cookies | Cookies listed in policy; purposes disclosed; meaningful opt-out provided | OPC |
| Canada — Quebec (Law 25) | Law 25 (An Act to Modernize Legislative Provisions) | Prior, explicit consent; no implied consent; French-language disclosures required | Profiling disclosure mandatory; French CPC; prior consent to non-essential cookies | CAI (Quebec) |
Latin America
| Jurisdiction | Primary Cookie Law | Consent Standard | Regulator |
|---|---|---|---|
| Brazil | LGPD (Law 13,709/2018); ANPD Guidance | Specific, informed, unambiguous consent (Art. 7(I)); right to withdraw at any time | ANPD |
| Colombia | Ley 1581/2012; Decreto 1377/2013 | Informed, specific, unambiguous consent for data processing via cookies | SIC |
| Chile | Ley 19.628; Reform (Ley Marco de Datos Personales) | Consent required for non-essential cookie processing; reform aligns with GDPR | SERNAC / CPLT |
| Argentina | Ley 25.326; AAIP Disposición 4/2019 | Informed consent required; right to erasure and access applies to cookie data | AAIP |
| Mexico | LFPDPPP 2010; INAI Guidelines | Informed consent; Aviso de Privacidad must cover cookie processing | INAI |
| Peru | Ley 29.733 | Consent for sensitive and non-essential data processing via cookies | ANPD Peru |
| Uruguay | LPDP Ley 18.331 (EU adequacy) | EU-equivalent GDPR standard applied (adequacy country) | URCDP |
| All other LATAM | GDPR baseline applied by AqNova policy | Opt-in consent for non-essential cookies; Spanish/Portuguese disclosures | National authorities |
Africa
| Jurisdiction | Primary Framework | Key Cookie-Relevant Requirements | Regulator |
|---|---|---|---|
| Nigeria | NDPA 2023; NDPR 2019; NITDA Guidelines | Informed consent; Data Controller registration; English disclosure; AqNova local rep: Sahara Eagle Ltd (Reg: 1957145) | NDPC |
| South Africa | POPIA (Act 4/2013) | Eight POPIA conditions apply; consent under Condition 4; no misleading disclosures; English disclosures | Information Regulator |
| Kenya | Data Protection Act 2019 | Lawful processing basis; consent for non-essential cookies; ODPC registration | ODPC |
| Ghana | Data Protection Act 2012 (Act 843) | Consent-based processing; DPC registration; English disclosures | DPC Ghana |
| Egypt | Personal Data Protection Law No. 151/2020 | Informed consent; PDPO registration; Arabic-language disclosures | PDPO Egypt |
| Morocco | Loi 09-08; CNDP oversight | Consent required; French and Arabic disclosures; CNDP registration | CNDP |
| Rwanda | Law No. 058/2021 | GDPR-influenced standard; consent-based processing; multilingual disclosure | NCSA Rwanda |
| Uganda | Data Protection & Privacy Act 2019 | Consent-based framework; PDPO registration; English disclosures | PDPO Uganda |
| Tanzania, Ethiopia, Cameroon, Ivory Coast, Senegal, Zambia, Zimbabwe | National frameworks (various stages of development) | GDPR baseline applied; local-language disclosures where required by law | National DPAs |
Middle East
| Jurisdiction | Primary Framework | Key Requirements | Regulator |
|---|---|---|---|
| UAE | Federal PDPL (Decree-Law No. 45/2021); ADGM DP 2021; DIFC DPL 2020 | Lawful basis for cookie processing; consent for non-essential; UAE Data Office registration; Arabic CPC; local representative required | UAE Data Office / DIFC Commissioner |
| Saudi Arabia | PDPL (Royal Decree M/19, 2021) | Explicit consent for personal data via cookies; Arabic-language disclosures mandatory; NDMO registration; data localisation where required | NDMO |
| Qatar | Personal Data Privacy Law No. 13/2016 | Consent-based processing; Arabic and English disclosures; MTC oversight | Ministry of Transport & Communications |
| Bahrain | PDPL Law 30/2018 | Consent required; PDPB registration; Arabic and English disclosures | PDPB |
| Oman | Personal Data Protection Law (Royal Decree 6/2022) | Informed consent; ITA oversight; Arabic and English CPC | ITA Oman |
| Kuwait | Draft PDPL advancing; existing electronic transactions law | GDPR baseline applied; Arabic and English disclosures | CITRA / Ministry of Commerce |
| Israel | Privacy Protection Act 1981; PPA 2023 Amendment (EU adequacy) | EU-equivalent standard; PPA registration; Hebrew and English CPC | PPA (Privacy Protection Authority) |
| Turkey | KVKK Law No. 6698 | Explicit consent required; Turkish-language disclosures mandatory; KVKK registration; data localisation; DPO designation | KVKK Authority |
| Jordan, Lebanon | Cybercrime laws; draft legislation | GDPR baseline applied; Arabic and English disclosures | National telecommunications regulators |
Asia & Asia-Pacific
| Jurisdiction | Primary Framework | Key Requirements | Regulator |
|---|---|---|---|
| China (PRC) | PIPL 2021; DSL 2021; CSL 2017; GB/T 35273 | Independent consent per purpose; no bundled consent; cross-border transfer assessments; data localisation; Simplified Chinese disclosures; CAC oversight | Cyberspace Administration of China (CAC) |
| India | DPDPA 2023; IT SPDI Rules 2011 | Freely given, specific, informed, unambiguous consent; DPB oversight; Hindi and English disclosures | Data Protection Board of India (DPB) |
| Japan | APPI (amended 2022); PPC Cookie Guidelines 2023 | Opt-out for cross-site tracking; opt-in for sensitive data; Japanese-language disclosures; PPC cooperation | PPC (Personal Information Protection Commission) |
| South Korea | PIPA (amended 2023); PIPC | Separate consent per purpose; no bundled consent; Korean-language disclosures mandatory; PIPC registration | PIPC |
| Australia | Privacy Act 1988; APPs; OAIC guidance | Collection notice required; APP 3 consent for sensitive info; opt-out of targeted advertising; English disclosures | OAIC |
| Singapore | PDPA 2012 (amended 2020); PDPC Advisory | PDPC Advisory on Cookies — consent or deemed consent; English disclosures; mandatory data breach notification | PDPC Singapore |
| Malaysia | PDPA 2010; PDPC Malaysia | Consent; Data User registration; Bahasa Malaysia and English disclosures | PDPC Malaysia |
| Thailand | PDPA 2019 (effective June 2022) | Explicit consent for non-essential cookies; Thai-language disclosures; PDPC registration | PDPC Thailand |
| Indonesia | UU PDP 2022 (effective Oct 2024) | Explicit consent; Bahasa Indonesia disclosures; Kominfo oversight | Kominfo / PDPC Indonesia |
| Philippines | DPA 2012 (R.A. 10173) | Specific, informed consent; Filipino/English disclosures; NPC registration; DPO required | National Privacy Commission (NPC) |
| Vietnam | Cybersecurity Law 2018; Decree 13/2023 | Consent; Vietnamese-language disclosures; Ministry of Public Security oversight | Ministry of Public Security |
| New Zealand | Privacy Act 2020; IPPs | Collection notice required; consent for sensitive data; English disclosures | OPC New Zealand |
| Hong Kong SAR | PDPO Cap. 486 | Consent under DPP 1(3); PCPD guidance; Traditional Chinese and English disclosures | PCPD Hong Kong |
| Taiwan | PIPA (amended 2023) | Consent required; Traditional Chinese disclosures; PPC Taiwan oversight | PPC Taiwan |
| Pakistan, Bangladesh | Draft legislation advancing | GDPR baseline applied; Urdu/Bengali and English disclosures | National telecom regulators |
C. Global Privacy Control (GPC)
AqNova honours the Global Privacy Control (GPC) signal — a browser-level opt-out signal transmitted in the HTTP header (Sec-GPC: 1). If your browser or browser extension transmits a valid GPC signal, AqNova will automatically treat it as a request to opt out of: the sale of your personal information; the sharing of your personal information for cross-context behavioural advertising; and all Category 4 (Targeting & Advertising) cookies. The GPC signal is honoured automatically without the need to manually adjust CPC settings. Major browsers and extensions supporting GPC include: Brave Browser; DuckDuckGo Privacy Browser; Firefox with privacy-focused settings; Global Privacy Control browser extensions.
D. Industry Opt-Out Tools
For advertising cookies specifically, the following industry opt-out tools are available:
Digital Advertising Alliance (DAA) — AdChoices: optout.aboutads.info (US)
Network Advertising Initiative (NAI): optout.networkadvertising.org (US)
Your Online Choices (EDAA): youronlinechoices.com (EU/UK)
Google Ads Settings: adssettings.google.com
Meta Ad Preferences: facebook.com/help/optout_nonusers
TikTok Privacy: tiktok.com/legal/privacy-policy (advertising opt-out within TikTok app settings)
3.2.14 Contact Information
| AqNova Cookie Policy — Contact Directory Cookie Preference Center: [aqnova.co/cookie-preferences] Do Not Sell / Share (California): [aqnova.co/do-not-sell] Cookie Policy Archive: [aqnova.co/legal/cookie-policy-archive] Privacy & Data Protection Officer: privacy@aqnova.co Cookie Queries & Complaints: privacy@aqnova.co [Subject: Cookie Policy Inquiry — {Country}] General Legal Inquiries: legal@aqnova.com Security Incident Reporting: security@aqnova.co EU GDPR Article 27 Representative: [EU Representative — to be designated] UK GDPR Article 27 Representative: [UK Representative — to be designated] UAE Data Protection Representative: [UAE PDPL Representative — to be designated] Saudi Arabia Representative: [Saudi PDPL Representative — to be designated] Nigeria Local Representative: Sahara Eagle Ltd | Reg: 1957145 | Tax ID: 31052811-0001 NEPC Reg: 0030281 Registered Office: Arivon Holding Corporation C/O Arivon Holding Corporation, 2571 Saturn Avenue, Unit #265 Huntington Park, CA 90255, USA EIN: 41-3210066 | D-U-N-S: 142957477 | GB EORI: GB511467217000 CA File No: B20250418195 |
|---|
AqNova Marketplace | Global Legal Footer Framework | Section 3.2: Cookie Policy
© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.