COOKIE POLICY
This Cookie Policy explains how BACI LLC ("BACI", "we", "us" or "our") uses cookies and similar technologies in connection with BACI websites, applications and other online Services. It should be read together with the BACI Privacy Policy. BACI's approach is based upon three principles: technologies necessary to operate, secure or provide a requested Service may be used where legally permitted without optional consent; optional technologies will be subject to appropriate transparency and choice; and where Applicable Law requires consent, BACI will not activate the relevant optional technologies before valid consent has been obtained.
1. SCOPE
This Cookie Policy applies to cookies and similar technologies used on online properties controlled by BACI where this Policy is displayed or incorporated. Depending upon the Service, these may include BACI websites, BACI Account interfaces, BACI web applications, BACI developer portals, BACI support interfaces, BACI purchasing and onboarding interfaces, BACI forms, BACI marketing pages and other BACI-controlled digital properties. A particular application or Service may provide additional cookie or technology disclosures where necessary.
2. BACI LEGAL FRAMEWORK
This Cookie Policy forms part of the BACI Legal Framework. It should be read with applicable documents including the Terms of Service; Privacy Policy; Data Processing Addendum; Security Policy or Security Addendum; Data Retention & Deletion Policy; Developer & API Terms; and applicable regional or jurisdictional privacy notices. The Privacy Policy governs BACI's broader processing of Personal Data. This Policy specifically addresses browser and device technologies used in connection with BACI's online Services.
3. WHAT ARE COOKIES?
Cookies are small data files stored on or accessed from a browser or device when an individual visits or uses an online service. Cookies may enable a website or service to recognise a browser or device, maintain a session, remember settings, support authentication, detect abuse, measure performance or perform other functions. Cookies may contain identifiers or other information that constitutes Personal Data under Applicable Data Protection Law.
4. SIMILAR TECHNOLOGIES
BACI may also use technologies that perform functions similar or related to cookies. Depending upon BACI's implementation, these may include pixels, web beacons, tags, local storage, session storage, software development kit technologies, device or browser identifiers, server-side identifiers, embedded scripts, conversion technologies and similar technologies. References to "cookies" in this Policy include these technologies where appropriate unless the context requires otherwise.
5. FIRST-PARTY AND THIRD-PARTY COOKIES
5.1 First-Party Cookies
First-party cookies are generally set by or for the BACI domain or Service an individual is using. They may support matters such as authentication, security, session management, preferences, Service functionality and BACI-controlled analytics.
5.2 Third-Party Cookies
Third-party technologies may be supplied by providers whose services BACI uses. Depending upon BACI's actual technology stack, such providers may support infrastructure, authentication, security, fraud prevention, payment processing, analytics, communications, embedded content, customer support or other functionality. A third party's processing may be governed by its own privacy terms where that third party acts independently. Where a provider processes Personal Data solely on BACI's behalf, BACI will address the relationship through applicable contractual and data-protection controls.
6. COOKIE DURATION
6.1 Session Cookies
Session cookies generally expire when a browser session ends. They may be used for purposes such as maintaining navigation state, authentication, security, transactional functionality and temporary preferences.
6.2 Persistent Cookies
Persistent cookies remain for a defined period or until removed. They may be used to remember preferences, recognise a returning browser, maintain consent choices, support security, measure performance or provide other permitted functionality. BACI will not intentionally retain cookies indefinitely where a shorter period is reasonably sufficient for the relevant purpose.
7. CATEGORIES OF COOKIES
7.1 Strictly Necessary Cookies
These technologies are required for core operation, security or functionality of a requested Service. They may be used to establish and maintain sessions; authenticate users; maintain Account security; prevent cross-site request forgery; detect malicious traffic; prevent fraud or abuse; distribute network traffic; maintain Service availability; preserve privacy choices; process a transaction requested by the user; remember information necessary to complete a requested process; and provide functionality expressly requested by the user. Where Applicable Law permits, these technologies may operate without optional consent because the Service cannot reasonably provide the relevant requested function without them. Disabling necessary cookies through browser controls may cause parts of BACI to stop functioning.
7.2 Functional Cookies
Functional technologies may remember choices or enable enhanced functionality, including language, region, display preferences, interface settings, remembered configuration and other convenience features. Where Applicable Law requires consent for these technologies, BACI will obtain that consent before activation.
7.3 Analytics and Performance Cookies
Analytics and performance technologies may help BACI understand how visitors use BACI websites, which pages or features are used, navigation patterns, errors, page performance, Service responsiveness, aggregate traffic, feature adoption and whether changes improve the user experience. BACI may use this information to maintain and improve its Services. Where Applicable Law requires consent for these technologies, they will not be activated until the required consent is obtained.
7.4 Marketing and Advertising Cookies
If BACI uses marketing or advertising technologies, they may support measuring campaigns, determining whether communications led to visits, limiting repetitive advertising, measuring conversions, understanding engagement and providing advertising or content where legally permitted. Where these technologies require consent, they will remain inactive until valid consent has been obtained. BACI will not describe a technology as merely "necessary" or "analytics" where its actual purpose includes legally regulated behavioural advertising.
7.5 Social Media Technologies
Where BACI incorporates social-media functionality, third-party technologies may enable users to interact with or share content through external platforms. Such technologies may allow the relevant platform to receive information concerning an individual's interaction with BACI. Where consent is legally required, such technologies will not activate before the required choice has been made.
8. SECURITY TECHNOLOGIES
BACI may use cookies and related technologies to protect Accounts, authentication, sessions, transactions, forms, APIs, BACI infrastructure, Customers and BACI systems. Security technologies may assist BACI in identifying suspicious authentication, credential abuse, automated attacks, malicious traffic, fraud, Account takeover, unauthorised access, session manipulation and violations of BACI security controls. Where a technology is genuinely necessary for security or to provide a requested Service, BACI may use it without optional consent to the extent permitted by Applicable Law.
9. AUTHENTICATION AND ACCOUNT TECHNOLOGIES
BACI may use technologies necessary to recognise an authenticated session and maintain access to an Account. These technologies may support sign-in, multi-factor authentication, session continuity, organisation selection, workspace access, permissions, administrative controls and logout. BACI will design authentication cookies and equivalent credentials with security appropriate to their function. Where technically appropriate, safeguards may include secure transport, appropriate expiration, restricted script access, SameSite controls, rotation, revocation and other recognised security measures.
10. CONSENT
Where Applicable Law requires consent before a cookie or similar technology may be stored or accessed, BACI will seek consent before activating the relevant technology. Consent should be informed, specific where required, freely given where required, affirmative where required and capable of withdrawal. BACI will not treat silence, inactivity or continued browsing as consent where Applicable Law requires an affirmative choice.
11. EQUAL CHOICE
Where consent is required, BACI's cookie interface should provide choices in a manner designed to avoid materially misleading users. Where appropriate, users should be able to accept optional technologies, reject optional technologies and manage categories. BACI will not intentionally design the cookie interface so that rejecting optional tracking is materially more confusing than accepting it. Necessary cookies cannot generally be disabled through BACI's consent interface where they are required to provide the requested Service, although browser controls may independently affect them.
12. WITHDRAWING OR CHANGING CONSENT
Where BACI relies upon consent, an individual may withdraw or modify that consent through the cookie-management mechanism made available on the relevant BACI property. Withdrawal will apply prospectively. Withdrawal does not make unlawful processing that occurred lawfully before consent was withdrawn. Where practicable, BACI will make the mechanism for revisiting cookie choices persistently accessible, including through an appropriate website footer or privacy interface.
13. COOKIE PREFERENCE RECORDS
BACI may store a cookie or similar record necessary to remember an individual's privacy choices. That record may be retained even where optional cookies are rejected because BACI must be able to remember and honour the rejection. A consent or preference record may include consent status, categories selected, timestamp, consent-management version, region or legal configuration and technical information reasonably necessary to demonstrate or honour the choice. Such information will not be used to circumvent the privacy choice it records.
14. COOKIE INVENTORY
BACI will maintain, directly or through its consent-management interface, an inventory of cookies and similar technologies that require disclosure. Where appropriate, the inventory should identify cookie or technology name, provider, category, purpose, first-party or third-party status, duration and other information required by Applicable Law. The live inventory should reflect technologies actually deployed on BACI properties. BACI will not knowingly publish an invented or aspirational cookie inventory. Technologies should be added to the disclosed inventory when they are deployed and removed or updated when implementation changes.
15. TECHNOLOGY GOVERNANCE
Before introducing a materially new tracking technology, BACI should assess its purpose, provider, information collected, whether Personal Data is processed, duration, whether information is disclosed externally, whether consent is required, whether it constitutes sale, sharing or targeted advertising under applicable law, whether contractual safeguards are required and whether BACI's disclosures need updating. This governance requirement applies regardless of whether a technology is introduced directly into BACI source code or through a tag manager, plugin, embedded component or third-party integration.
16. TAG MANAGEMENT
Where BACI uses a tag-management system, the existence of the tag-management system does not itself authorise every technology capable of being deployed through it. Optional tags must remain subject to BACI's applicable consent and governance requirements. BACI should configure tag deployment so that a technology requiring consent is not intentionally triggered before the applicable consent state permits it.
17. ANALYTICS
BACI may use analytics to understand and improve its websites and Services. Where reasonably practicable and appropriate, BACI may configure analytics to reduce unnecessary collection. Analytics should not be treated as strictly necessary merely because the resulting information would be commercially useful. Where Applicable Law requires consent for analytics, BACI will obtain that consent before activating the applicable analytics technologies.
18. PAYMENTS
BACI may use third-party payment providers in connection with purchases. Payment providers may use cookies or related technologies necessary to process transactions, authenticate payment activity, prevent fraud, maintain transaction security and comply with legal obligations. A payment provider may independently determine certain processing under its own legal obligations and privacy terms. BACI's use of payment technology does not mean BACI necessarily receives or stores complete payment-card credentials.
19. EMBEDDED THIRD-PARTY CONTENT
BACI may incorporate content supplied by third parties, such as video, maps, interactive media, documentation, support tools, social-media functionality or other embedded services. Such content may involve third-party technologies. Where those technologies are optional and require consent, BACI should prevent their activation until the appropriate consent is obtained.
20. EMAIL AND COMMUNICATION TECHNOLOGIES
Subject to Applicable Law, BACI communications may use technologies that indicate whether a message was delivered, opened, interacted with or associated with a subsequent permitted action. BACI may use such information for security, operational communications, communication effectiveness, support, permitted marketing and maintaining communication preferences. Where consent or another particular legal basis is required, BACI will comply with the applicable requirement.
21. BROWSER CONTROLS
Most browsers provide controls allowing users to block, restrict or delete cookies. Browser settings vary by provider and version. Users should consult their browser's current documentation for available controls. Blocking all cookies may prevent BACI functionality from operating correctly, particularly authentication, security, Account access, session continuity and preference management. Deleting cookies may also remove previously stored settings, including cookie preferences, requiring those choices to be made again.
22. GLOBAL PRIVACY CONTROL AND UNIVERSAL OPT-OUT SIGNALS
Certain jurisdictions recognise browser-based universal opt-out mechanisms such as Global Privacy Control ("GPC"). Where Applicable Data Protection Law requires BACI to recognise a valid universal opt-out signal, BACI will honour that signal for processing to which the requirement applies. A universal opt-out signal does not necessarily disable technologies that remain legally permitted or necessary to provide a requested Service.
23. DO NOT TRACK
Some browsers transmit a "Do Not Track" signal. There is not a single universally applicable legal or technical standard governing all such signals. BACI will respond to legally recognised preference signals where required by Applicable Law.
24. SALE, SHARING AND TARGETED ADVERTISING
Certain privacy laws define "sale", "sharing", "targeted advertising" or similar concepts broadly enough to include some uses of cookies or advertising technologies even where no money is exchanged for Personal Data. BACI will assess technologies according to applicable statutory definitions rather than relying solely upon ordinary commercial meanings. Where a technology constitutes regulated sale, sharing or targeted advertising, BACI will provide legally required disclosures and opt-out mechanisms.
25. CHILDREN
BACI's general Services are primarily designed for businesses, organisations, professionals and developers and are not directed to children. BACI will not intentionally deploy behavioural advertising technologies for the purpose of profiling children through its general commercial Services. If BACI introduces a Service specifically directed to children, BACI will implement additional controls required by Applicable Law before deploying relevant technologies.
26. INTERNATIONAL USERS
Cookie and tracking rules vary by jurisdiction. BACI may therefore configure its cookie-management interface differently depending upon applicable legal requirements. Differences may include whether prior consent is required, which categories require consent, how choices are presented, how long preferences are retained, whether universal opt-out signals must be recognised and additional disclosures. Regional implementation differences will not reduce mandatory rights provided by Applicable Law.
27. EEA AND UNITED KINGDOM
Where applicable European Economic Area or United Kingdom law requires prior consent for storing information on or accessing information from a user's device, BACI will not intentionally activate non-exempt optional technologies before obtaining the required consent. Strictly necessary technologies may be used without optional consent where permitted by Applicable Law. Consent may be withdrawn through the available cookie-management mechanism.
28. UNITED STATES
Certain United States state privacy laws may provide rights concerning processing performed through cookies or similar technologies. Depending upon applicable law and BACI's actual processing, these may include rights to opt out of sale of Personal Data, sharing of Personal Data, targeted advertising or qualifying profiling. BACI will provide applicable controls where legally required.
29. DATA RETENTION
Information collected through cookies or similar technologies will be retained according to the purpose of the technology, its configured duration, BACI's Data Retention & Deletion Policy, contractual requirements, security requirements and Applicable Law. A cookie's technical expiration period does not by itself determine how long information derived from that cookie may lawfully be retained in BACI systems.
30. SECURITY
BACI will take reasonable measures appropriate to the nature of cookie and tracking technologies used. Where appropriate, BACI may apply secure transmission, restricted cookie scope, secure attributes, appropriate expiration, access controls, identifier rotation, consent controls, vendor governance and monitoring. Cookies containing authentication or security credentials should receive safeguards appropriate to the risk associated with compromise.
31. CHANGES IN PROVIDERS
BACI's technology providers may change as BACI develops. BACI may add, replace or remove providers for reasons including functionality, security, performance, reliability, legal compliance, commercial requirements or technological development. BACI will update required disclosures and consent configurations where a change materially affects cookie or tracking practices.
32. CHANGES TO THIS COOKIE POLICY
BACI may update this Cookie Policy to reflect changes in technology, BACI Services, deployed cookies, providers, Applicable Law, regulatory guidance or the BACI Legal Framework. Each version will identify its effective date and last-updated date. Where required, BACI will provide notice or obtain renewed consent following a material change. BACI may maintain archived versions for transparency and compliance purposes.
33. CONTACT BACI
Questions concerning this Cookie Policy or BACI's use of cookies and similar technologies may be directed to BACI Privacy, BACI LLC, Email: privacy@bacihq.com. Security concerns should be directed to security@bacihq.com.
34. INTERPRETATION
Nothing in this Cookie Policy authorises BACI to use a technology prohibited by Applicable Law; eliminates a consent requirement imposed by Applicable Law; makes an optional technology "necessary" merely because it provides commercial value; overrides a valid privacy choice; converts a third party into BACI's processor where that party independently determines its processing purposes; or reduces a mandatory privacy right. Where Applicable Law imposes greater requirements, the mandatory law controls.
We're listening.