BrandBazzarr Advanced Cookie & Tracking Technologies Policy

Last Updated: [Date]
Version: 2.1

1. Preamble & Scope

This Advanced Cookie and Tracking Technologies Policy ("Policy") provides a meticulous description of the deployment, function, and governance of cookies, pixels, scripts, software development kits (SDKs), local storage objects, and other tracking technologies (collectively, "Trackers") employed by BrandBazzarr across our digital ecosystem, including the website [www.brandbazzarr.com], associated subdomains, and the BrandBazzarr mobile application (collectively, the "Services").

This document is an integral annex to our [Privacy Policy] and is structured to fulfill our transparency obligations under:

• The General Data Protection Regulation (GDPR) (EU) 2016/679, specifically the requirements for explicit consent for non-essential Trackers.
• The ePrivacy Directive 2002/58/EC (as amended), often referred to as the "Cookie Law."
• The California Consumer Privacy Act (CCPA) as amended by the CPRA, regarding the "right to know" and "right to opt-out" of sale/sharing.
• Emerging global privacy norms, providing a unified standard of protection for all our users.

2. Definitions & Technological Taxonomy

• First-Party Trackers: Set by BrandBazzarr on the domain you are visiting.
• Third-Party Trackers: Set by a domain other than the one you are visiting. Typically belong to our trusted partners and service providers.
• Persistent Trackers: Remain on your device for a predetermined period or until manually deleted.
• Session Trackers: Temporary and are deleted automatically once you close your browser.
• Zombie Cookies / Evercookies: A category of persistent Trackers that are recreated after deletion. BrandBazzarr explicitly does not and will never use these ethically questionable technologies.
• Fingerprinting: The passive collection of technical device characteristics (e.g., screen resolution, installed fonts, browser plugins) to create a unique device identifier. BrandBazzarr does not engage in probabilistic browser fingerprinting for identification or tracking purposes.
• Data Controller: BrandBazzarr, which determines the purposes and means of processing personal data collected via Trackers.
• Data Processor: A third-party vendor that processes data on our behalf under strict contractual obligations.

3. The Legal Bases for Processing

Our use of Trackers is predicated on one of the following legal bases under Article 6 of the GDPR:

• Strictly Necessary: Processing is essential for the provision of the Services you explicitly request. No consent is required for these.
• Consent: For all non-essential Trackers (Performance, Functional, Targeting, Social Media), we rely on your freely given, specific, informed, and unambiguous consent, which you provide via our Consent Management Platform (CMP). You may withdraw consent at any time.
• Legitimate Interest: In limited cases for security and fraud prevention, we may rely on Legitimate Interest, having conducted a Legitimate Interest Assessment (LIA) to ensure our interests do not override your fundamental rights.

4. Granular Categorization of Trackers & Purposes

Category 1: Strictly Necessary Trackers

• Legal Basis: Necessary for the performance of a contract (Our Terms of Service).
• Purpose: These are fundamental for core service functionality. They enable security, network management, load balancing, and access to secure areas. They maintain your session state and shopping cart across pages. Blocking these will render key features of the Services inoperable.
• Control: These cannot be disabled via our CMP. They can be blocked via browser settings, but this will severely degrade or break site functionality.

Category 2: Performance & Analytics Trackers

• Legal Basis: Your Consent.
• Purpose: To analyze and measure how users interact with our Services. This allows us to perform:
  • Cohort Analysis: Understanding behavior of specific user groups.
  • Funnel Analysis: Identifying where users drop off in a process (e.g., checkout).
  • Performance Monitoring: Measuring page load times, responsiveness, and JavaScript errors.
  • A/B (Multivariate) Testing: Serving different versions of content to optimize user experience.
  • Data Anonymization: Data is aggregated and pseudonymized; full IP addresses are not stored.
• Control: Manageable via the CMP. Opting out will hinder our ability to improve our Services.

Category 3: Functional Trackers

• Legal Basis: Your Consent.
• Purpose: To enhance functionality and personalization beyond the core experience.
  • Remembering login details (if you choose this option).
  • Storing user-preferred settings (language, currency, region).
  • Enabling third-party features like live chat support, interactive maps, and video players.
• Control: Manageable via the CMP. Opting out may cause certain personalized features to be unavailable.

Category 4: Targeting & Advertising Trackers

• Legal Basis: Your Consent.
• Purpose: Used to build a profile of your interests and show relevant advertisements on and off our platform. This includes:
  • Retargeting/Remarketing: Displaying ads to users who have previously visited our Site.
  • Interest-Based Advertising (IBA): Serving ads based on your inferred interests.
  • Cross-Device Tracking: Linking your activity across different devices (where legally permitted and disclosed).
  • Attribution Modeling: Determining which marketing channel led to a conversion (sale, sign-up).
  • CCPA "Sale/Sharing" Notice: The use of these third-party cookies for targeted advertising may constitute a "sale" or "sharing" of personal information under the CCPA. You have the right to opt-out.
• Control: Manageable via the CMP. You can opt-out of this profiling and targeting.

5. Comprehensive Tracker Inventory

The table below is a non-exhaustive, detailed inventory of primary Trackers we use.

6. Advanced User Control & Preference Management

A. Consent Management Platform (CMP):
We deploy a certified CMP (e.g., OneTrust, Cookiebot, or a custom solution) that provides:

• Granular Category Control: Accept or reject categories individually.
• Vendor-Level Control: See and consent to specific third-party vendors.
• Purpose Limitation: Detailed descriptions of each processing purpose.
• Consent Logging: We maintain a cryptographically hashed record of your consent for audit purposes.
• Periodic Re-consent: The banner will reappear after a predetermined period (e.g., 12 months) or if we introduce new tracking purposes.

B. Global Privacy Control (GPC):
BrandBazzarr recognizes and will process the Global Privacy Control signal. If your browser or extension broadcasts a GPC signal, we will interpret this as a valid request to opt-out of the "sale" or "sharing" of your personal information for targeted advertising on our Site, in compliance with the CCPA.

C. Browser & Device-Level Controls:

• Browser Settings: You can configure your browser to refuse all or some Trackers. See links in previous policy.
• Do Not Track (DNT): Our Services do not currently respond to DNT signals due to the lack of a common industry standard. We instead rely on the robust controls provided by our CMP and GPC.
• Mobile Advertising IDs: On mobile devices, you can reset your advertising identifier (Google's Advertising ID or Apple's IDFA) or opt-out of personalized ads through your device's OS settings.

D. Direct Third-Party Opt-Outs:

• Digital Advertising Alliance (DAA): http://optout.aboutads.info/
• Network Advertising Initiative (NAI): http://optout.networkadvertising.org/
• European Interactive Digital Advertising Alliance (EDAA): http://www.youronlinechoices.com/

7. Data Security & International Transfers

Data collected via Trackers is encrypted in transit (TLS 1.2+). Storage is secured according to our Data Protection Policy. As some third-party providers are global entities, data may be transferred outside of Iraq and the European Economic Area (EEA). Such transfers are safeguarded by:

• The European Commission's Adequacy Decisions.
• Standard Contractual Clauses (SCCs).
• Binding Corporate Rules (BCRs).
• Vendor certification under the EU-U.S. Data Privacy Framework.

8. Policy Review & Update Schedule

This Policy is subject to quarterly review and ad-hoc updates following significant changes to our Tracker ecosystem or applicable law. A changelog will be maintained on this page. Material changes will be announced via a prominent notice on our Services prior to the change becoming effective.

9. Contact Information

For all data subject requests, privacy inquiries, or concerns regarding this Policy, please contact our Data Protection Officer (DPO).

BrandBazzarr
Attn: Data Protection Officer
Email: [brandbazzarr@gmail.com] (Preferred)

We are committed to resolving complaints within a legally mandated timeframe. You also have the right to lodge a complaint with a supervisory authority, but we encourage you to contact us first.