Cookie Policy

1. What are cookies and similar technologies?

• Cookies – Small text files placed on your device (computer, tablet, or mobile phone) when you visit a website. They enable the site to recognise your device, remember preferences, and provide security, analytics, and advertising functions.
• Web beacons / pixel tags – Tiny images or scripts embedded in web pages or emails that report user interactions.
• Local storage – Data stored directly in your browser (e.g., by third-party widgets) to improve functionality.
• Server logs – Records kept by our hosting provider (GoDaddy) that capture IP addresses, browser type, device information, pages visited, and timestamps for security, troubleshooting, and performance monitoring. Retained for approximately 90 days.
• Embedded content – Third-party services (e.g., Calendly scheduler) may load their own tracking technologies as described in their privacy policies.

2. Legal basis for processing

3. Cookie banner & consent management

We use CookieYes as our consent-management platform (CMP).

• Prior consent – On your first visit a banner appears before any non-essential cookie is set.
• Options – You may Accept all, Reject non-essential, or Customize each category (Analytics, Functional, Advertising, Other).
• Global Privacy Control (GPC) – If your browser sends a GPC signal, we treat it as a request to decline all non-essential cookies.
• Consent logging – Every consent choice (timestamp, IP address, user-agent, selected categories) is stored securely for at least 12 months to demonstrate compliance.
• Changing preferences – A persistent "Cookie Settings" link in the website footer re-opens the banner, allowing you to modify or withdraw consent at any time.

4. Detailed Cookie Inventory

*The _scc_session cookie's exact function is not definitively identified. If it is required for secure form submission or authentication, it will be classified as Necessary; otherwise it will be treated as Consent-based.

5. Do Not Sell or Share My Personal Information

We do not sell personal information for monetary consideration.

For residents of California, Virginia, Colorado, Connecticut, and Utah, you may exercise your right to opt-out of the sale or sharing of personal information (including data collected via cookies) by clicking the link below:

Requests are processed within 15 days.

6. Your Rights

a. Rights for EU/EEA Residents (GDPR)

• Right of Access – Request a copy of the personal data we hold about you.
• Right to Rectification – Request correction of inaccurate data.
• Right to Erasure ("Right to be Forgotten") – Request deletion, subject to legal exceptions (e.g., tax-record retention).
• Right to Restriction of Processing – Limit how we process your data.
• Right to Data Portability – Receive your data in a structured, commonly used, machine-readable format.
• Right to Object – Object to processing for direct marketing or legitimate-interest purposes.
• Right to Withdraw Consent – Withdraw consent for consent-based cookies at any time via the "Cookie Settings" link.

b. Rights for California Residents (CCPA/CPRA)

• Right to Know – Request disclosure of the categories of personal information we collect, the sources, purposes, and third parties with whom we share it.
• Right to Delete – Request deletion of your personal information (subject to legal exemptions).
• Right to Opt-Out of Sale/Sharing – Use the link above to opt-out.
• Right to Non-Discrimination – We will not discriminate against you for exercising any CCPA right.

c. Rights for Residents of Virginia, Colorado, Connecticut, Utah (VCDPA, CPA, CTDPA, UCPA)

• Right to Access – Request a copy of your personal information.
• Right to Delete – Request deletion of your personal information.
• Right to Opt-Out of Sale/Sharing – Use the same "Do Not Sell or Share My Personal Information" link.
• Right to Correct – Request correction of inaccurate data.

To exercise any of these rights, email info@breadcounter.com (or the DPO email for GDPR requests).

7. Data Security Measures

We implement industry-standard technical and organizational safeguards for all cookie-derived data:

• Secure Transmission – All cookies are sent over HTTPS (TLS 1.2+).
• Secure Flag – Cookies that contain sensitive identifiers are marked Secure to ensure they are only transmitted over encrypted connections.
• HttpOnly Flag – Session and authentication cookies are set HttpOnly to prevent access by client-side scripts (mitigates XSS).
• SameSite Attribute – Cookies include SameSite=Lax or Strict to protect against CSRF attacks.
• Limited Retention – Cookies are set with appropriate expiration dates (see the inventory table). Session cookies expire when the browser is closed.
• Third-Party Security – Calendly, Cloudflare, and GoDaddy each maintain their own security programs as described in their privacy policies.

8. International Data Transfers

If personal data is transferred outside the United States (e.g., to the European Economic Area), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on adequacy decisions where applicable (e.g., U.K., Switzerland). These safeguards ensure an equivalent level of protection for your data.

9. Accessibility Statement for the Cookie Banner

Our cookie banner complies with accessibility standards:

• Fully keyboard-navigable (tab order, focus indicators).
• All controls have screen-reader friendly labels and ARIA attributes.
• Colour contrast meets WCAG 2.1 AA requirements.
• Users can reopen the banner at any time via the persistent "Cookie Settings" link.

If you encounter accessibility issues, please contact us (see Section 10).

10. Contact Information

11. Updates to This Cookie Policy

We may update this Cookie Policy to reflect changes in our practices, legal requirements, or technology. When material changes are made, we will:

• Post a prominent notice on our website.
• Update the Effective Date at the top of this page.

Please review this policy periodically to stay informed about how we protect your information.