Cookie Policy

1. Introduction

This Cookie Policy explains how Secure.com ("we," "us," or "our") uses cookies and similar tracking technologies when you visit our website at https://www.secure.com, use our cybersecurity platform and Digital Security Teammate services, or interact with our web applications, browser extensions, or mobile applications (collectively, the "Services").

This policy explains what cookies are, why we use them, which third parties are involved, and how you can control them at any time.

This policy should be read alongside our Privacy Policy, which governs the broader collection and processing of your personal data.

2. What Are Cookies?

A cookie is a small text file saved on your device when you visit a website. It enables the website to remember your actions and preferences over time, so you do not need to re-enter information each time you visit.

Cookies are classified as either:

• Session cookies — deleted automatically when you close your browser; or
• Persistent cookies — stored on your device for a defined period or until you delete them.

We also use similar technologies including tracking pixels, web beacons, software development kits (SDKs), device identifiers, and HTML5 local storage (all referred to collectively as "cookies" throughout this policy for convenience). None of these technologies give us access to your device files or any other application on your device.

3. How and Why We Use Cookies

3.1 Legal Basis and Consent

We operate a default-deny model. Non-essential cookies are never activated until you have provided valid consent.

Essential cookies may be set without consent only where strictly necessary to: (a) transmit a communication over an electronic communications network; or (b) provide an information society service you have expressly requested. The legal basis for processing personal data via essential cookies is our legitimate interests in maintaining platform security and integrity (Article 6(1)(f) GDPR).

3.2 How We Obtain Your Consent

We obtain your consent through an interactive cookie banner displayed on your first visit. Non-essential cookies are not activated until you interact with the banner and grant consent by category (Functional, Analytics, and Advertising).

3.3 Withdrawing or Changing Consent

You may withdraw or amend your consent at any time by clicking "Cookie Settings" in the footer of any page. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

3.4 Transparency and Consent Records

Our Cookie Settings panel contains a live inventory listing each cookie, its provider, purpose, duration, and category. We keep this inventory current. If we make material changes — for example, adding a new advertising vendor or changing a cookie's stated purpose — we will notify you and, where required, prompt you for renewed consent before any new cookies are activated.

4. Types of Cookies We Use

4.1 Essential Cookies

Essential cookies are required for the Services to function. They enable secure login, page navigation, fraud prevention, load balancing, and bot mitigation. These cannot be disabled without impairing functionality. They are set without your consent under the operational necessity exemption of the ePrivacy Directive.

4.2 Functional Cookies

Functional cookies remember your preferences and enable enhanced features. We set these only with your prior consent. Some functional cookies are provided by third parties.

4.3 Performance and Analytics Cookies

Analytics cookies collect information about how you use the Services — such as pages visited and errors encountered. Data is often aggregated or anonymised and helps us improve the platform. We set these only with your prior consent.

4.4 Advertising Cookies

Advertising cookies deliver relevant advertisements, limit ad frequency, and measure campaign effectiveness. This category includes social media cookies and may support cross-context behavioural advertising. We set these only with your prior consent.

5. Detailed Cookie List

The following table lists all cookies and similar technologies currently active across our Services. This inventory is updated in real time in our Cookie Settings panel.

Essential Cookies

Functional Cookies

Analytics Cookies

Advertising Cookies

6. Your Rights and Cookie Controls

6.1 Your GDPR Data Subject Rights

Where personal data is processed via cookies, you have the following rights under the GDPR (subject to applicable exemptions and conditions):

To exercise any of the above rights, please contact us at legal@secure.com. We will respond within 30 days.

6.2 Cookie Settings Centre

You can manage, grant, or revoke consent by category at any time via our Cookie Settings panel, accessible through the persistent link in the footer of every page.

6.3 Browser-Level Controls

You can also block or delete cookies directly in your browser settings:

• Google Chrome: Settings > Privacy and Security > Cookies and other site data
• Apple Safari: Preferences > Privacy > Manage Website Data
• Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
• Microsoft Edge: Settings > Cookies and site permissions > Cookies and site data

Please note that blocking cookies at browser level may impair certain features of our Services.

6.4 Do Not Track and Global Privacy Control

We do not currently respond to the legacy "Do Not Track" (DNT) browser signal, as no uniform standard for its interpretation exists. We actively evaluate compatibility with the Global Privacy Control (GPC) signal. Where legally required — including under the CCPA/CPRA — we honour GPC signals as valid opt-out requests for cross-context behavioural advertising.

7. Third-Party Service Providers

We use both first-party cookies (set by our own domains) and third-party cookies (set by external providers). Our key third-party cookie providers include:

• Security: Cloudflare, Inc.
• Analytics: Google LLC (Google Analytics), Adobe Systems Incorporated
• Advertising and Social Media: Meta Platforms, Inc., LinkedIn Corporation, TikTok Inc., Reddit, Inc., X Corp. (Twitter), Google LLC (Google Ads / DoubleClick)
• B2B Marketing Engagement: Apollo.io

When you grant consent via Cookie Settings, you authorise these third-party providers to run scripts in your browser, place storage objects, and transmit data to their own servers. These providers may combine data collected on our Services with data they hold about you from other online sources. We encourage you to review their individual privacy and cookie policies.

8. Where We Use These Technologies

Cookies and similar technologies are deployed across all surfaces of our digital ecosystem:

• Public website at https://www.secure.com — where advertising pixels, analytics, and bot-mitigation cookies are primarily active.
• Web applications and SaaS dashboards — where session management and essential security tokens operate.
• Browser extensions — where session-state and performance cookies may be active.
• Mobile applications — where SDKs and device advertising identifiers (Apple IDFA, Google AAID) are used in lieu of traditional HTTP cookies.

The same purposes, legal bases, and consent choices described in this policy apply across all surfaces, subject to operating system limitations imposed by device manufacturers.

9. International Transfers

Some third-party cookie providers are based outside your country, including outside the EU/EEA and UK. Where personal data collected via cookies is transferred internationally from the EU/EEA or UK to a country without an EU or UK adequacy decision, we ensure appropriate safeguards are in place, including:

• European Commission Standard Contractual Clauses (SCCs); and/or
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs.

For further information on international transfers, please see our Privacy Policy.

10. Region-Specific Disclosures

10.1 EU/EEA and United Kingdom (GDPR and ePrivacy Directive)

We enforce a strict default-deny posture. No non-essential cookies — including _fbp, _ga, UserMatchHistory, or any advertising pixel — are activated until you provide explicit, affirmative consent via our cookie banner. Essential cookies (X-CSRF-TOKEN and __cf_bm) operate under the operational necessity exemption only. You may withdraw consent at any time via Cookie Settings.

10.2 California, USA (CCPA/CPRA)

We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising as defined under California law. We honour Global Privacy Control (GPC) signals as valid opt-out requests. We do not use sensitive personal information to infer characteristics beyond purposes expressly permitted by the CPRA.

10.3 Brazil (LGPD)

All functional, analytical, and advertising cookies are set only on the basis of your explicit consent (LGPD, Article 7(I)). Brazilian data subjects hold the rights of confirmation, access, correction, anonymisation, portability, deletion, and information on data sharing, as further described in our Privacy Policy. Consent may be revoked at any time via Cookie Settings.

10.4 Canada (PIPEDA and Provincial Laws)

We obtain meaningful, informed consent before activating any non-essential tracking technologies. We provide clear, friction-free mechanisms to withdraw consent. Some third-party providers may process data outside Canada; please see our Privacy Policy for applicable safeguards.

10.5 United Arab Emirates

Operating under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, our consent framework ensures transparency, data minimisation, and limitations on cross-border data transfers in accordance with UAE regulatory requirements.

11. Security

We implement technical and organisational measures to protect cookie data. Specifically:

• Secure flag — cookies are transmitted only over encrypted HTTPS connections, preventing interception.
• HttpOnly flag — sensitive session cookies are inaccessible to client-side JavaScript, mitigating cross-site scripting (XSS) risks.
• SameSite attribute — set to Lax or Strict where appropriate, providing a secondary layer of CSRF protection alongside the X-CSRF-TOKEN.

Cookie data is processed within environments governed by SOC 2 Type II and ISO 27001 compliance standards. Cookies cannot access files or information on your device beyond what the technology itself stored.

12. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, or for operational, legal, or regulatory reasons. Please check this page periodically to stay informed.

If we make material changes — such as adding a new advertising provider, changing a cookie's stated purpose, or extending a cookie's retention period — we will notify you and, where required by law, display a renewed consent prompt before new cookies are activated.