Cookie Policy

This Cookie Policy explains how the VSBX Global platform at vsbxgroup.com (the "Platform"), operated by VSBX Group Limited ("VSBX Group", "we", "us", "our"), uses cookies and similar technologies, what they do, and how you can control them. It is a global document: the choices it describes apply to every visitor, wherever you are located. It should be read together with our Privacy Policy. 1. What are cookies and similar technologies Cookies are small text files that a website stores on your device (computer, phone or tablet) when you visit it. They are widely used to make websites work, to remember your preferences and to keep services secure. Similar technologies include local storage (sometimes called "web storage"), which stores small amounts of data in your browser for the same purposes. 2. How our consent management platform works On your first visit, a banner titled "Privacy & Cookie Choices" states our approach in one line: VSBX uses essential technologies to operate securely and optional technologies to understand site usage and improve our services. You can accept, reject, or manage optional technologies. The banner (our consent management platform, or "CMP") then gives you three choices: - Accept All — enables every category of cookie described below. - Reject All — keeps only the strictly necessary cookies, which are always set because the Platform cannot work securely without them. - Customize — opens our preference center, where you can switch each category on or off individually. Strictly necessary cookies are always on and cannot be switched off. The preference center classifies everything into four categories: Strictly Necessary (Essential), Functional & Preference, Analytics & Performance, and Marketing & Advertising (Promotional). Functional & Preference cookies are switched on by default because they remember choices you have asked us to remember (such as your language); you can switch them off at any time. Analytics & Performance and Marketing & Advertising cookies are switched off by default and are only used if you switch them on. You can reopen the preference center at any time using the "Manage Cookie Preferences" button on this page. 3. The cookies we use, by category All cookies and storage items listed below are set by us (first-party) on the vsbxgroup.com domain or its subdomains, and none of them contain personal data beyond the values described. The Platform is served over HTTPS, and every cookie is sent with the SameSite=Lax attribute. 3.1 Strictly Necessary (Essential) — always on These are required for the Platform to function and to keep you signed in securely. They cannot be switched off. - vsbx_refresh: a secure HttpOnly cookie that stores a rotating refresh token used to renew your session without you having to sign in again. It cannot be read by scripts running in your browser, it is limited to the Platform's authentication endpoints, and it is stored for up to 7 days. - vsbx-authenticated: a simple marker (value "1") that lets the Platform know you are signed in so it can show you the right pages. It contains no credentials and grants no access by itself — access is always verified by the Platform's servers. It is stored for up to 24 hours. - vsbx-access-token (local storage): a short-lived access token used to make authenticated requests while you use the Platform. It expires after one hour. - vsbx-session-user (local storage): basic information about your signed-in session (such as your email address and account role) so the interface can display your account correctly. - vsbx-pwd-change-required (local storage): a flag that reminds you when a password change is required by our security rules. 3.2 Functional & Preference — on by default, opt-out available These remember the choices you make so we can provide the experience you asked for. They are set only after you have had the opportunity to review them, and you can switch them off in the preference center. - vsbx-language: remembers the interface language you have chosen. It is stored when you select a language and kept for up to one year. - vsbx-theme: remembers the display theme (light or dark) you have chosen. It is stored with the default theme on your first visit and updated when you change the theme, and kept for up to one year. - vsbx-language and vsbx-theme (local storage): local mirrors of the same preferences, kept for up to one year. 3.3 Analytics & Performance — off by default (opt-in) These help us understand how the Platform is used so we can improve it. We currently set no analytics or performance cookies, and we do not use any third-party analytics service on the Platform. If we introduce such cookies in the future, we will update this policy and list them here, and they will remain switched off unless you choose to enable them. 3.4 Marketing & Advertising (Promotional) — off by default (opt-in) These are used to make advertising more relevant to you. We currently set no marketing or advertising cookies, we do not allow advertising networks to set cookies through the Platform, and we do not sell or share personal information for advertising purposes. If that ever changes, we will update this policy and list any such cookies here, and they will remain switched off unless you choose to enable them. 3.5 Cookies set by third parties We do not use third-party tracking cookies. If you make a payment, our payment providers may set their own cookies on the pages they operate. If you sign in with a third-party identity provider (such as Google, Apple or Microsoft), that provider may set its own cookies on its own pages during sign-in. Those cookies are governed by each provider's own policies, which we recommend you review. 4. Global legal outlook Our approach is designed to meet the requirements of the privacy and ePrivacy laws that may apply to our visitors around the world. The CMP, the four categories, and the opt-in model for analytics and marketing apply to every visitor, regardless of location. - European Union / European Economic Area: the General Data Protection Regulation (GDPR) and the ePrivacy Directive. Consent is required before non-essential cookies are set; our CMP collects a clear, affirmative choice before any Functional & Preference, Analytics & Performance or Marketing & Advertising cookie is stored, and withdrawing consent is as easy as giving it. - United Kingdom: the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), which apply the same principles. - United States (California): the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). We do not sell or share personal information, and we honour the Global Privacy Control (GPC) signal: when your browser sends it, our analytics and marketing categories are treated as off even if you previously enabled them. - Brazil: the Lei Geral de Protecao de Dados (LGPD), which requires a clear legal basis for processing; our consent model satisfies it. - Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA), under which we obtain meaningful consent for non-essential technologies. - Singapore: the Personal Data Protection Act (PDPA), which requires consent for non-essential data use; our opt-in model complies. - India: the Digital Personal Data Protection Act (DPDP Act), which requires consent for specified purposes; our four-category model provides it. - Other jurisdictions: rather than maintaining many separate banners, we apply the same four-category, opt-in-first model worldwide. If you are located in a jurisdiction not listed above, you receive the same choices and the same protections described in this policy. 5. Managing and withdrawing consent - The banner: on your first visit you can choose Accept All, Reject All, or Customize. - The preference center: you can reopen it at any time using the "Manage Cookie Preferences" button on this page, switch any category on or off, and save. Your new choice takes effect immediately. - Browser settings: you can block or delete cookies at any time through your browser settings, and you can clear local storage in the same way (usually under "Site settings" or "Clear browsing data"). If you block strictly necessary cookies, parts of the Platform — including signing in — will not work correctly. - Global Privacy Control: if your browser or extension sends the GPC signal, we treat the Analytics & Performance and Marketing & Advertising categories as off, whatever your saved preferences say, and we will not set or read cookies for those categories while the signal is active. 6. How long we keep your consent record Your choices are stored on your device only, in a local record named vsbx-cookie-consent. It contains the categories you enabled and the date of your choice. It is not sent to our servers and is not linked to your account. We ask you to review your choices again after 12 months, and the record is refreshed each time you save your preferences. 7. Changes to this policy We may update this Cookie Policy from time to time, for example when we change the cookies we use or the laws that apply. The latest version will always be published on this page. 8. Contact Questions about this policy or the cookies we use can be sent to admin@vsbxgroup.com.