> For the complete documentation index, see [llms.txt](https://legal.delos.financial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://legal.delos.financial/legal-agreements-and-policies/cookie-policy.md). # Cookie Policy **Last Updated:** 15 September 2026\ **Effective date:** 15 September 2026 \ **Version:** 1.0 \ **Applies to:** the Delos website (delos.financial) and the Delos online platform (all client-facing and administrative interfaces) *** ### 1. About this policy This Cookie Policy explains how Delos uses cookies and similar technologies across our services, what each one does, why we use it, how long it lasts, and the choices you have. It applies to our public website at delos.financial (including our legal and documentation pages) and to the **Delos online platform** — the applications and interfaces through which our clients and partners access Delos services. Delos is a regulated financial institution. The controller responsible for the cookies described in this policy is **Delos Financial LTD**, a company incorporated in British Columbia, Canada (incorporation no. BC1398268) and registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Services Business (registration no. M23425816) ("**Delos**", "**we**", "**us**"). Because we serve clients and partners in the European Economic Area (EEA) and the United Kingdom, this policy is written to meet the standards of the EU General Data Protection Regulation (GDPR), the UK GDPR, the EU ePrivacy Directive, and the UK Privacy and Electronic Communications Regulations (PECR), in addition to applicable Canadian privacy law (PIPEDA and, where relevant, Québec Law 25). This policy should be read together with our [Privacy Policy](https://legal.delos.financial/legal-agreements-and-policies/privacy-policy), which describes in full how we process personal data, the legal bases we rely on, international transfers, and your rights as a data subject. Where a term is defined in the Privacy Policy, it has the same meaning here. You can contact us using the details in section 12. *** ### 2. What cookies and similar technologies are A **cookie** is a small text file that a website or application places on your device so that it can be recognised on later requests. Cookies can be "first-party" (set by Delos) or "third-party" (set by a provider we use). They can last only for a single browsing session ("session cookies") or persist for a defined period ("persistent cookies"). In this policy, "cookies" also covers **similar technologies** that store or read information on your device for the same purposes, including browser **local storage** and **session storage**, software development kits (SDKs), and device identifiers. We tell you where we use these instead of, or alongside, conventional cookies. *** ### 3. Our approach We take a data-minimising approach to cookies, and we treat our authenticated platform and our public website differently. On the **platform** — an authenticated, logged-in environment — we use only strictly necessary cookies plus, if you consent, our Intercom support chat; we do not run analytics or marketing cookies there. On the **public website**, in addition to the strictly necessary cookies, we use analytics and marketing cookies (provided by HubSpot) and the same optional support chat — and these load **only if you consent** to them. We do not use third-party advertising or retargeting networks, we do not place advertising pixels, and we do not sell or share cookie data for advertising. If our use of cookies changes materially, we will update this policy and, where the law requires it, ask for your consent before any new non-essential cookie is set. *** ### 4. Categories of cookies we use #### **4.1** Strictly necessary cookies (always on) These cookies are essential. They sign you in and keep you securely signed in, renew your session, secure sensitive actions such as one-time-password (OTP) and password-change flows, remember which client entity you are working in, protect against fraud and automated abuse, and record your cookie choice. Because they are strictly necessary to provide a service you have requested, they are exempt from the consent requirement under the ePrivacy Directive and PECR, and **they cannot be switched off** through our cookie controls. You can still block all cookies in your browser settings, but if you do, the service will not function. We keep this category genuinely limited: a cookie is placed here only if the service cannot be delivered without it. #### 4.2 Analytics and marketing cookies — public website only (consent required) On our public website we use **HubSpot** cookies to understand how visitors use the site and to measure the performance of our marketing, including recognising returning visitors. These cookies are **not** used on the authenticated platform, and they are **not** set unless and until you choose "Approve". If you decline or later withdraw consent, we stop them and delete the associated cookies (see section 8). #### 4.3 Functional / support cookies (consent required) We offer an in-product live-chat and support tool provided by **Intercom**. When you consent, Intercom sets cookies (and uses browser local storage) so that it can maintain your chat session and recognise you across conversations. This tool is **not** loaded, and these cookies are **not** set, unless and until you choose "Approve". If you decline or later withdraw consent, we stop the Intercom tool and delete its cookies (see section 8). #### 4.4 What we do not use We do not use third-party advertising, retargeting, or ad-network cookies or pixels, we do not use social-media tracking cookies, and we do not sell or share cookie data. The only analytics and marketing cookies we use are the HubSpot cookies on our public website described above, and only with your consent. *** ### 5. Cookies we use The table below describes the cookies and similar technologies we use, grouped by purpose. The exact, current list of individual cookies is always visible to you in your browser's developer tools (Application → Storage → Cookies). Specific names and durations may change as we improve the service; we keep this policy accurate at the level of category, purpose, provider, and legal basis.
PurposeWhat it doesSet byConsentWhereTypical retention
Authentication & sessionSigns you in, authorises your requests, and silently renews your session so you are not signed out mid-use.Delos (first-party)Not required (strictly necessary)Website & platformSession; expire within minutes and are renewed in use
Secure actions & verificationSecures sensitive steps such as OTP confirmation and password recovery/change, and identifies whose confirmation step is in progress.Delos (first-party)Not required (strictly necessary)PlatformSession / short-lived
Interface stateRemembers which client entity you have selected in the interface and which in-app notices you have dismissed. Access to data is always determined by your authenticated session, never by these cookies.Delos (first-party)Not required (strictly necessary)Website & platformPersistent, up to 6 months
Network securityProtects the service against automated abuse and confirms your connection has passed our security checks (Cloudflare).Cloudflare (third-party)Not required (strictly necessary)Website & platformManaged by Cloudflare (up to 1 year)
Analytics & marketingHelps us understand website traffic and measure marketing performance, and recognises returning visitors (HubSpot).HubSpot (third-party, United States)Required — set only after "Approve"Website onlySession to about 6 months
Support chatRuns the optional live-chat session and recognises you across conversations (Intercom); also uses browser local storage.Intercom (third-party, United States)Required — set only after "Approve"Website & platformAbout 7 days to about 9 months, for as long as your consent stands
*** ### 6. Third parties Three third parties may set cookies or use similar technologies through our services. **Intercom** provides our live-chat and support messaging and sets its cookies only after you consent. **HubSpot** provides website analytics and marketing measurement and sets its cookies, on the public website only, only after you consent. **Cloudflare** provides network security and content delivery; any Cloudflare cookies are strictly necessary security cookies and carry no marketing function. We do not permit any third party to use cookies set through our services for their own advertising or cross-site tracking. *** ### 7. Legal basis | Category | ePrivacy / PECR | GDPR / UK GDPR Article 6 | | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Strictly necessary (authentication, secure actions, interface state, network security, consent record) | Exempt from consent — strictly necessary to provide the service you request | Art. 6(1)(b) performance of our contract with you and, for security and fraud-prevention purposes, Art. 6(1)(f) legitimate interests | | Analytics & marketing — HubSpot | Consent required and obtained before the cookie is set | Art. 6(1)(a) consent | | Functional / support — Intercom | Consent required and obtained before the cookie is set | Art. 6(1)(a) consent | Where cookies involve the processing of personal data, that processing is described in our [Privacy Policy](https://legal.delos.financial/legal-agreements-and-policies/privacy-policy). *** ### 8. Your choices and how to withdraw consent **Giving your choice.** When you first use our website or platform, you are shown a clear notice with two equally presented options: > **Approve** — enables the optional non-essential cookies in addition to the strictly necessary ones: on the website, the HubSpot analytics and marketing cookies and the Intercom support chat; on the platform, the Intercom support chat. **Only necessary** — loads only the strictly necessary cookies. Nothing else is loaded, everything in the product works exactly the same, and you are **not** signed out. Alongside these options we explain, in one line, that *technical cookies (sign-in and security) cannot be turned off because the service will not work without them — see this Cookie Policy for detail.* For signed-in users, your choice is saved to your account, so you are not asked again on every device. **Withdrawing your choice is as easy as giving it.** You can change your mind at any time from your profile settings, where the same two options can be reopened. If you switch to "Only necessary", we immediately stop the relevant tools, delete their cookies — the HubSpot cookies on the website and the Intercom cookies wherever they were set — and clear the associated local storage, so that data genuinely stops flowing. Withdrawing consent is not merely symbolic. **Browser and device controls.** You can also block or delete cookies through your browser settings, and most browsers let you refuse third-party cookies. Blocking strictly necessary cookies will prevent you from signing in or using the service. Where your browser or device sends a Global Privacy Control (GPC) or "Do Not Track" signal, we treat it as a request not to set analytics, marketing, or support cookies, and we load them only if you have actively chosen "Approve". *** ### 9. How long cookies last In summary: session cookies are deleted when you close your browser or sign out; short-lived authentication and verification cookies expire within minutes; the consent record persists for up to six months and is then requested again; and consent-based analytics, marketing, and support cookies persist only for as long as your consent stands and are deleted when you withdraw it. Per-category retention is set out in section 5. *** ### 10. International transfers and security Some of our providers — including Intercom, HubSpot, and Cloudflare — may process data outside your country, including in the United States. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as described in our [Privacy Policy](https://legal.delos.financial/legal-agreements-and-policies/privacy-policy). We apply technical and organisational measures — including cookie attributes such as `HttpOnly`, `Secure`, and `SameSite` — to protect session and authentication cookies against interception and misuse. *** ### 11. Children Our services are intended for businesses and for individuals who are at least 18 years old. We do not knowingly set cookies to profile children. *** ### 12. Changes and contact We may update this policy to reflect changes to our services or the law. When we do, we will revise the "Effective date" and version above and, where the change is material (for example, introducing a new category of cookie), we will ask for your consent again where required. If you have questions about this policy or how we use cookies, contact us at: **Delos Financial LTD** Email: