# Cookie Policy

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** [Legal / DPO]  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

Describe how Touch2Sign Ltd uses cookies and similar technologies on the Touch2Sign website and application. Supports ePrivacy Directive requirements and GDPR transparency obligations. Complements the public Privacy Policy.

## 2. Scope

Applies to:

- touch2sign.com marketing website  
- Touch2Sign web application (app.touch2sign.com or equivalent)  
- Signing pages accessed by recipients (`/sign/[token]`, `/mobile-verify/[token]`)  
- Mobile browser access to Touch2Sign web properties  

Does not apply to native mobile apps if launched separately (update policy if applicable).

## 3. What are cookies?

Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage, and pixels. This policy uses "cookies" to refer to all such technologies unless stated otherwise.

## 4. Cookie categories

| Category | Purpose | Consent required? |
|----------|---------|-----------------|
| **Strictly necessary / essential** | Authentication, security, load balancing, signing session | **No** — required for service |
| **Functional** | Remember preferences (language, cookie choice) | **No** if essential to preference; otherwise yes |
| **Analytics** | Usage statistics, performance monitoring | **Yes** — opt-in |
| **Marketing** | Advertising, retargeting | **Yes** — opt-in (not used by default) |

Touch2Sign does **not** use marketing cookies by default.

## 5. Cookies in use

### 5.1 Essential cookies

| Cookie / storage | Provider | Purpose | Duration |
|------------------|----------|---------|----------|
| Cognito session tokens | Amazon Cognito | User authentication | Session / configured expiry |
| Signing session state | Touch2Sign | Part 11 PIN session, signing flow | Up to 30 minutes |
| CSRF / security tokens | Touch2Sign | Request forgery protection | Session |
| Load balancer affinity | AWS | Route requests to healthy instance | Session |
| `cookie_consent` | Touch2Sign | Stores consent choice | 12 months |

These cookies are necessary to provide the eSignature and eWitness service. The service cannot function without them.

### 5.2 Analytics cookies (optional)

| Cookie | Provider | Purpose | Duration | Status |
|--------|----------|---------|----------|--------|
| [e.g. _ga] | [Google Analytics / Plausible / etc.] | Page views, funnels | [duration] | **Only if user consents** |

Analytics cookies are loaded **only after** explicit consent via the cookie banner. Review and update this table when analytics tools are enabled.

### 5.3 Third-party cookies

Signing flows may redirect to identity providers:

| Provider | Purpose | Policy link |
|----------|---------|-------------|
| OneID | UK bank IDV | OneID privacy policy |
| eID Easy | QES / EU IDV | eID Easy privacy policy |

These are controlled by the identity provider during verification — not Touch2Sign first-party cookies.

## 6. Consent management

Touch2Sign implements consent via the **`CookieConsent`** React component (`components/ui/CookieConsent.tsx`):

- Displayed on first visit to web properties  
- **Essential cookies** always active — explained in banner  
- **Analytics cookies** disabled until user clicks **Accept** or equivalent  
- **Reject** option available — analytics remain off  
- Consent choice stored in `cookie_consent` local storage / cookie  
- User may withdraw consent via cookie settings link in footer  

Consent records:

- Choice (accept / reject / essential only)  
- Timestamp  
- Policy version  

Stored client-side; aggregate consent metrics reviewed quarterly for compliance audit.

## 7. How to control cookies

| Method | Action |
|--------|--------|
| Cookie banner | Accept or reject non-essential cookies on first visit |
| Footer link | "Cookie settings" — reopen preferences |
| Browser settings | Block or delete cookies (may break signing/login) |

Blocking essential cookies will prevent login and document signing.

## 8. Do Not Track

Touch2Sign does not respond to DNT browser signals. Consent is managed via the CookieConsent component per ePrivacy requirements.

## 9. Updates

When new non-essential cookies are added:

1. Update this policy and Privacy Policy  
2. Update CookieConsent component categories  
3. Re-prompt consent if material change  
4. Document in compliance gap register  

## 10. Contact

Questions about cookies: **privacy@touch2sign.com**

## 11. Related documents

- Privacy Policy (external)  
- GDPR_READINESS.md  
- CONTROL_MATRIX.md (CookieConsent control mapping)  

## 12. Review

Reviewed **annually** and whenever cookie inventory or analytics tooling changes.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO | Electronic | 11 July 2026 |
| | Legal / DPO | | |