Cookie Settings

1. Purpose and Scope

This Cookie Policy describes how Jelpify AS (“Jelpify”, “we”, “our”, “us”) uses cookies and similar tracking technologies on:

• www.jelpify.no
• Related subdomains
• Our SaaS platform

This policy forms part of our broader Privacy and Information Security Framework and is implemented in alignment with:

• EU General Data Protection Regulation (GDPR)
• Norwegian Personal Data Act
• ISO/IEC 27001-aligned Information Security Management practices
• SOC 2 Trust Services Criteria

We apply the principles of data minimization, purpose limitation, transparency, and security by design.

2. Governance and Accountability

Cookie usage at Jelpify is governed under our internal data protection and information security framework, which includes:

• Documented policies and procedures
• Risk assessments related to tracking technologies
• Vendor due diligence and contractual safeguards
• Periodic review of cookies and tracking tools
• Access controls and change management

Cookies and tracking tools are subject to:

• Security review prior to implementation
• Data Protection Impact Assessment (where required)
• Approval through internal governance processes

3. What Are Cookies?

Cookies are small text files placed on your device when you access a website or digital service. They enable technical functionality, performance monitoring, and user preference management.

Cookies may be:

• Session-based (deleted after session ends)
• Persistent (stored until expiration)
• First-party (set by Jelpify)
• Third-party (set by approved service providers)

4. Categories of Cookies Used

We apply strict categorization and purpose limitation.

4.1 Strictly Necessary Cookies

These cookies are essential to:

• Enable secure authentication
• Maintain session integrity
• Enforce security controls
• Protect against fraud and misuse
• Ensure system availability

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).

These cookies cannot be disabled as they are required for system operation.

Security measures applied:

• Encrypted transmission (TLS)
• HttpOnly and Secure flags (where applicable)
• Short session expiration
• Restricted internal access

4.2 Functional Cookies

These cookies allow us to:

• Store language preferences
• Maintain interface settings
• Improve usability

Legal basis: Consent or legitimate interest depending on implementation.

4.3 Analytics Cookies

These cookies help us measure and improve performance by collecting aggregated usage data.

Data collected may include:

• Page interactions
• Device information
• Referrer information
• Anonymized IP addresses (where applicable)

Security & privacy controls:

• IP anonymization (where supported)
• Aggregation and pseudonymization
• Limited retention periods
• Access restriction to authorized personnel

Legal basis: Consent (where required).

4.4 Marketing Cookies

Marketing cookies may be used to:

• Measure advertising performance
• Deliver relevant ads
• Prevent repeated ad exposure

Marketing tracking is activated only after explicit user consent.

We do not sell personal data.

Legal basis: Consent (GDPR Art. 6(1)(a)).

5. Third-Party Service Providers

We may use approved third-party vendors for:

• Hosting and infrastructure
• Analytics
• Marketing automation
• CRM and communication tools

All third-party vendors are subject to:

• Data Processing Agreements (DPAs)
• Security and privacy due diligence
• Confidentiality obligations
• Risk-based vendor assessments
• Where applicable, international transfer safeguards

Vendors are required to meet security standards aligned with ISO 27001 or equivalent and maintain appropriate SOC 2 controls where applicable.

6. Data Minimization and Retention

We apply data minimization principles:

• Only necessary cookies are deployed
• Retention periods are defined and documented
• Persistent cookies are limited in duration
• Data is deleted or anonymized when no longer required

Retention periods vary depending on purpose and are reviewed periodically as part of our compliance program.

7. International Transfers

Where cookie-related data is transferred outside the EEA, we ensure:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Appropriate technical and organizational safeguards
• Transfer risk assessments (where applicable)

8. Security Controls

Cookie-related data is protected through:

• Encryption in transit (TLS)
• Role-based access control
• Logging and monitoring
• Incident detection mechanisms
• Periodic security testing
• Change management procedures
• Secure software development lifecycle controls

These measures align with ISO 27001 Annex A controls and SOC 2 Security criteria.

9. Consent Management

Upon first visit, users are presented with a consent management interface allowing them to:

• Accept all cookies
• Reject non-essential cookies
• Customize cookie preferences

Users may modify or withdraw consent at any time via the “Cookie Settings” link.

Consent records are securely stored for audit and compliance purposes.

10. User Rights

In accordance with GDPR, you may:

• Withdraw consent
• Request access to personal data
• Request deletion or restriction
• Object to processing

Requests may be submitted to: post@jelpify.no

11. Incident Response

In the event of a data breach involving cookie-related personal data, Jelpify will:

• Investigate promptly
• Assess risk
• Notify relevant authorities where required
• Notify affected individuals if legally required

Incident response procedures are aligned with our information security framework.

12. Monitoring and Review

We conduct periodic reviews of:

• Cookies deployed
• Vendor compliance
• Legal developments
• Security risks

This ensures ongoing compliance with regulatory and security requirements.

13. Changes to This Policy

We may update this Cookie Policy periodically. Material changes will be clearly communicated and reflected in the “Last updated” date.

14. Contact

Jelpify AS
Vossegtata 22, 0475 Oslo, Norway
Email: post@jelpify.no