Cookie Policy

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: [Legal / DPO]

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Describe how Touch2Sign Ltd uses cookies and similar technologies on the Touch2Sign website and application. Supports ePrivacy Directive requirements and GDPR transparency obligations. Complements the public Privacy Policy.

2. Scope

Applies to:

• touch2sign.com marketing website
• Touch2Sign web application (app.touch2sign.com or equivalent)
• Signing pages accessed by recipients (/sign/[token], /mobile-verify/[token])
• Mobile browser access to Touch2Sign web properties

Does not apply to native mobile apps if launched separately (update policy if applicable).

3. What are cookies?

Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage, and pixels. This policy uses "cookies" to refer to all such technologies unless stated otherwise.

4. Cookie categories

Category	Purpose	Consent required?
Strictly necessary / essential	Authentication, security, load balancing, signing session	No — required for service
Functional	Remember preferences (language, cookie choice)	No if essential to preference; otherwise yes
Analytics	Usage statistics, performance monitoring	Yes — opt-in
Marketing	Advertising, retargeting	Yes — opt-in (not used by default)

Touch2Sign does not use marketing cookies by default.

5. Cookies in use

5.1 Essential cookies

Cookie / storage	Provider	Purpose	Duration
Cognito session tokens	Amazon Cognito	User authentication	Session / configured expiry
Signing session state	Touch2Sign	Part 11 PIN session, signing flow	Up to 30 minutes
CSRF / security tokens	Touch2Sign	Request forgery protection	Session
Load balancer affinity	AWS	Route requests to healthy instance	Session
cookie_consent	Touch2Sign	Stores consent choice	12 months

These cookies are necessary to provide the eSignature and eWitness service. The service cannot function without them.

5.2 Analytics cookies (optional)

Cookie	Provider	Purpose	Duration	Status
[e.g. _ga]	[Google Analytics / Plausible / etc.]	Page views, funnels	[duration]	Only if user consents

Analytics cookies are loaded only after explicit consent via the cookie banner. Review and update this table when analytics tools are enabled.

5.3 Third-party cookies

Signing flows may redirect to identity providers:

Provider	Purpose	Policy link
OneID	UK bank IDV	OneID privacy policy
eID Easy	QES / EU IDV	eID Easy privacy policy

These are controlled by the identity provider during verification — not Touch2Sign first-party cookies.

6. Consent management

Touch2Sign implements consent via the CookieConsent React component (components/ui/CookieConsent.tsx):

• Displayed on first visit to web properties
• Essential cookies always active — explained in banner
• Analytics cookies disabled until user clicks Accept or equivalent
• Reject option available — analytics remain off
• Consent choice stored in cookie_consent local storage / cookie
• User may withdraw consent via cookie settings link in footer

Consent records:

• Choice (accept / reject / essential only)
• Timestamp
• Policy version

Stored client-side; aggregate consent metrics reviewed quarterly for compliance audit.

7. How to control cookies

Method	Action
Cookie banner	Accept or reject non-essential cookies on first visit
Footer link	"Cookie settings" — reopen preferences
Browser settings	Block or delete cookies (may break signing/login)

Blocking essential cookies will prevent login and document signing.

8. Do Not Track

Touch2Sign does not respond to DNT browser signals. Consent is managed via the CookieConsent component per ePrivacy requirements.

9. Updates

When new non-essential cookies are added:

1. Update this policy and Privacy Policy
2. Update CookieConsent component categories
3. Re-prompt consent if material change
4. Document in compliance gap register

10. Contact

Questions about cookies: privacy@touch2sign.com

11. Related documents

• Privacy Policy (external)
• GDPR_READINESS.md
• CONTROL_MATRIX.md (CookieConsent control mapping)

12. Review

Reviewed annually and whenever cookie inventory or analytics tooling changes.

---

Approval

Name	Role	Signature	Date
Robert	CEO	Electronic	11 July 2026
	Legal / DPO