About the
cookies we use.

What Are Cookies?

Cookies are small text files that a website stores in your browser. They help the site remember things between visits — like your theme preference or whether you've already responded to a cookie prompt.

Cookies are small text files that websites place on your device when you visit. They allow the website to recognize your device on subsequent visits and to remember information about you, such as your preferences. Similar technologies — including localStorage, sessionStorage, web beacons, and pixels — perform comparable functions and are covered by this Policy.

This Policy supplements our Privacy Policy and should be read together with it.

Our Approach

We use as few cookies as we can get away with. Everything we set is a first-party cookie (set by us, not a third party). We do not embed Google Analytics, Meta Pixel, LinkedIn Insight Tag, or any other advertising or social-tracking script.

• First-party only: All cookies on headgatetech.com are set by HEADGATE on the headgatetech.com domain. We do not embed third-party trackers.
• Privacy-preserving analytics: We use a privacy-preserving analytics provider that does not use cross-site identifiers and does not share your data with third parties. The analytics cookie is set only after you give consent.
• No advertising: We do not run advertising on headgatetech.com. We do not build advertising audiences from your visit. We do not retarget you elsewhere on the internet based on your visit.
• Granular consent: You decide which non-essential categories run. Reject is as easy as Accept.

Cookies We Set

Four cookies in total. The table below lists each one — what it does, how long it lasts, and which category it belongs to.

We do not use any cookies in the Marketing or Advertising categories. If we ever did, we would update this Policy and re-prompt for consent before any such cookie was set.

Categories Explained

Cookie categories are a way to group cookies so you can accept or reject them in groups instead of one at a time.

4.1 Strictly Necessary

Essential for the Site to function (e.g., remembering your consent decision, preventing CSRF attacks). These cookies are not subject to consent under GDPR Article 6 or the ePrivacy Directive because they are strictly necessary to provide the service you have requested.

4.2 Preferences

Remember choices that change how the Site looks or behaves (e.g., theme). These are not strictly necessary but are minimally invasive. They are set when you make the relevant interaction (e.g., toggle the theme).

4.3 Analytics

Help us understand how the Site is used in aggregate. We use only a privacy-preserving analytics provider that does not use cross-site identifiers. Set only after you give consent.

4.4 Marketing / Advertising

Not used on headgatetech.com. If we ever introduce cookies in this category, we will update this Policy and re-prompt for consent before any such cookie is set.

Your Choices

Three ways to manage cookies — our preference center, your browser, or Global Privacy Control.

5.1 Cookie Preference Center

A persistent Cookie preferences link in the Site footer re-opens our consent UI at any time. You can:

• Accept all categories
• Reject all non-necessary categories
• Toggle individual categories (Preferences, Analytics)

Your choice is recorded in the hg_consent cookie. If you clear that cookie, you'll be prompted again on your next visit.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before withdrawal.

5.2 Browser Settings

You can also block or delete cookies via your browser settings. The links below take you to each browser's instructions:

• Chrome
• Firefox
• Safari (macOS)
• Safari (iOS)
• Edge

Browsers also offer a private or incognito mode that limits cookies to the session.

5.3 Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal, we treat it as:

• A withdrawal of consent for the Analytics cookie category (we do not set _pa_visitor)
• An opt-out of any "sale" or "sharing" of Personal Information for cross-context behavioral advertising under CCPA/CPRA (in our case, this is a no-op because we do not sell or share)

GPC is honored automatically — no further action required.

5.4 Do Not Track (DNT)

The DNT browser signal is not standardized and not honored uniformly. We continue to honor GPC instead, which has been recognized by the California Privacy Protection Agency as a valid opt-out mechanism.

Cookies We Do NOT Use

For transparency, here's a non-exhaustive list of common trackers we explicitly do not embed.

Cookie Inventory Maintenance

Cookie disclosures rot. We review our list quarterly and on every site change.

• Cookie inventory reviewed quarterly by the engineering team
• Pre-merge check on PRs that add scripts or third-party embeds
• Live audit (browser DevTools) at least quarterly to confirm no unintended cookies are set
• This Policy is updated within 30 days of any material change to the cookie inventory

Children

We don't direct the Site at children and we don't knowingly set cookies for users under 16.

The Site is not directed at children. We do not knowingly set cookies for users under 16. If you believe we have inadvertently done so, contact privacy@headgatetech.com and we will delete the relevant data and revoke the cookies on our side.

Changes to This Policy

We update this Policy from time to time. Material changes get a 30-day heads-up.

For material changes (e.g., addition of a new cookie category, change of analytics provider), we will provide at least thirty (30) days' notice via a prominent banner on the Site and update the "Last updated" date at the top. Non-material changes (typos, clarifications) take effect on posting.

Contact

Questions go to our Data Protection Lead.

• Privacy / cookies: privacy@headgatetech.com
• Postal: HEADGATE TECHNOLOGY LTD, Suite C, Level 7, 50 Stanley Street, Central, Hong Kong
• Hong Kong supervisory authority: Privacy Commissioner for Personal Data (PCPD)