KIVEX Cookies and Similar Technologies

1. Who is responsible for each environment

On KIVEX's own websites and in the KIVEX Hub, KIVEX determines the purposes for which technologies are used.

Where the KIVEX widget is deployed on a Customer's website, the operator of that website, as controller, usually decides on the purposes of customer analytics and on how the necessary consent is obtained. KIVEX provides the technical means to respect the consent status and processes data to the extent set out in the DPA.

2. When consent is required

We use technologies that store information on, or access information from, a device without consent only where they are strictly necessary for transmitting a communication or for providing a service or feature that the user has expressly requested.

Analytics and other optional technologies that do not meet this condition are enabled only after prior, demonstrable consent.

Merely opening the website, continuing to browse, scrolling, closing the banner, opening the widget or starting an ordinary chat is not considered consent to optional analytics.

3. Categories of technologies

3.1. Necessary

These are used in particular for:

• signing in and account security;
• protection of forms and sessions;
• respecting privacy choices;
• keeping messages connected within an active conversation;
• protection against misuse;
• features expressly requested by the user.

We do not use these technologies for optional marketing or behavioural profiling.

3.2. Functional technologies requested by the user

An example is the “remember conversation” feature. It is enabled only on the End User's express choice, and its identifier is not used for broader analytics or marketing without a separate legal ground.

3.3. Analytics

These are used, for example, for more accurate measurement of unique and returning visitors, feature usage or other optional analytics purposes. Where they require information to be stored on or read from a device and are not a necessary feature, they are enabled only after consent.

3.4. Marketing and personalisation

In its standard configuration, KIVEX does not use these without a separately described purpose and appropriate consent. If a Customer introduces them in its own environment, it is responsible for describing them transparently and for their legal regime.

4. Overview of standard technologies

The specific technical name may change with a security or technology update. A change of name must not change the purpose or category, or circumvent the user's stored choice.

If KIVEX deploys a new optional technology with a different purpose or recipient, it must be appropriately described and included in consent management before it is used.

5. Cookieless technical events

Not every server communication is a cookie or a similar technology stored on a device. Before analytics consent is given, the widget may send minimised server events needed for operation, security, diagnostics and aggregated measurement of technical performance.

Such an event may include, in particular:

• the identifier of the Agent and of the Customer's website;
• the page path without sensitive query parameters;
• the time and type of the technical event;
• the general category of device or browser;
• technical data on performance or errors;
• the country or approximate location, if derived transiently from the network request and not used to create a stable visitor profile.

Without analytics consent, no fingerprint or other stable ID intended for long-term linking of anonymous visits may be created from these events.

6. Analytics visitor identifier

A pseudonymous analytics visitor identifier is created only after appropriate consent. It is used for more accurate recognition of the same browser within the relevant Customer or Agent.

The identifier must be separated between unrelated Customers so that KIVEX does not, without more, use it to track the same person across different customer websites.

Withdrawing analytics consent stops future optional analytics processing, and KIVEX will remove the controllable analytics identifier from the device to the extent it can technically do so. Previously collected data is retained only where there is a valid purpose and legal basis for doing so.

7. Active conversations

Once a chat is started, a short-term identifier may be used so that the system knows which messages belong to the same conversation. This is a functional part of the service that the End User expressly requests by starting the chat.

Without analytics consent, this identifier must not be used as a hidden long-term identifier for accurately measuring returns between separate visits.

8. “Remember conversation”

Where this feature is available, the End User may expressly choose to have the conversation history restored on the next visit from the same device.

Such a choice:

• is separate from analytics consent;
• serves only to restore the requested history;
• must not automatically enable broader behavioural analytics;
• may be cancelled by removing the stored choice or browser data and, where a control is available, also directly in the widget.

9. Analytics and Session Replay

If KIVEX or a Customer uses Session Replay or similar detailed client-side measurement, it may only be started where the appropriate consent status is in place and after its purpose has been transparently described.

The configuration of such a tool must exclude or mask at least passwords, authentication secrets, payment details and the content of conversations, unless there is a specific and expressly described legal ground for capturing them.

10. How we obtain and record consent

Where consent is required, the first layer of the choice must provide an equally accessible option to accept or reject optional technologies and allow the detailed settings to be opened.

It typically offers:

• Accept all;
• Reject optional;
• Settings.

Consent must be active, freely given, specific, informed and demonstrable. Neither a pre-ticked option nor merely continuing to use the website is treated as consent.

KIVEX or the operator of the website concerned records the status and version of the choice to the extent necessary to respect and demonstrate it.

11. Changing and withdrawing your choice

Consent may be withdrawn at any time as easily as it was given. On KIVEX's own websites, a “Privacy settings” control or a functionally equivalent option will be available.

On a Customer's website, consent management may be part of its consent manager or another control that passes the corresponding status to KIVEX.

After analytics consent is withdrawn:

1. future optional analytics events stop;
2. controllable analytics IDs in the browser are removed;
3. new events will not be linked to the old analytics identity;
4. neither fingerprinting nor any other hidden ID is used as a substitute for refused consent.

12. Microphone

The browser's microphone permission is a separate technical choice. It is granted only after the End User activates voice mode.

A browser microphone permission is not, in itself, consent to analytics cookies and does not replace information about the processing of voice.

13. Browser settings

Cookies and data in localStorage or sessionStorage can be deleted or blocked in the browser settings. Blocking necessary technologies may make it impossible to sign in, keep an active conversation or use another requested feature.

14. Contact

Questions about the use of cookies and similar technologies may be sent to [email protected].