Cookie Policy Version 1.0 The cookies and similar technologies Propvora uses, why we use them, how long they last and how you can control them. 1. About this policy This Cookie Policy explains how Blackwellen Limited ("Blackwellen", "we", "us" or "our"), company number 16482166, registered office 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom, uses cookies and similar technologies on the Propvora website at https://propvora.com, in the Propvora application and in its portals (collectively, the Service). It is designed to meet our obligations under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, and under the UK GDPR where a cookie involves personal data. It should be read with our Privacy Policy (/legal/privacy), which explains how we handle personal data generally and what rights you have. This policy reflects a review of the Service's code carried out when this version was published. We will keep it up to date as the Service changes (see section 10). 2. What cookies and similar technologies are A cookie is a small text file that a website stores on your device through your browser. The browser sends the cookie back to that website on later requests, which lets the site recognise the device, for example to keep you signed in as you move between pages. Cookies can be described in several ways: - First-party cookies are set by the site you are visiting. Third-party cookies are set by a different domain, for example an advertising network embedded in a page. - Session cookies are deleted when you close your browser. Persistent cookies remain until they expire or you delete them. - HttpOnly cookies can be read only by the server, not by scripts running in the page, which helps protect them from theft. Similar technologies include browser storage such as localStorage and sessionStorage (which let a site save information in your browser that is not automatically sent to the server), pixels and web beacons, SDKs in mobile apps, and device fingerprinting. PECR applies to all of these in the same way as to cookies: the rules cover any storing of information on, or accessing information from, your device. In this policy, "cookies" includes these similar technologies unless we say otherwise. 3. When consent is needed Under PECR, we must give you clear and comprehensive information about any cookie we use, and must obtain your consent before setting it, unless an exemption applies. The exemptions, as updated by the Data (Use and Access) Act 2025, include storage or access that is: - strictly necessary to provide a service that you have explicitly requested, such as keeping you signed in or remembering an item you have asked us to save; - solely for the purpose of transmitting a communication over a network; - needed to protect the security of the service or of your device, or to prevent or detect fraud or technical faults; - used solely to collect information for statistical purposes to improve the service (analytics), provided we give you clear information and a simple, free means to object; - used solely to adapt the appearance or functionality of the site to your preferences, again with clear information and a simple means to object; and - needed to locate you in an emergency. We currently rely only on the strictly necessary and security exemptions. We do not rely on the analytics or functionality exemptions, because we do not set those kinds of cookies today. Advertising and cross-site tracking cookies always need consent and we do not use them. 4. The cookies and storage we use The table below lists every cookie and browser storage item the Service sets today. All are first-party and all are strictly necessary. None is used for advertising, analytics or tracking across other websites, and none is shared with advertisers. ### Authentication session cookies - Name: sb-[project-ref]-auth-token (the token may be split into numbered parts, such as sb-[project-ref]-auth-token.0 and .1, if it is too large for one cookie). Where a sign-in uses a one-time code or link flow, a short-lived sb-[project-ref]-auth-token-code-verifier cookie may also be set. - Provider: first-party, set on our domain by the Supabase authentication library we use (Supabase is our authentication provider; see the Subprocessor register (/legal/subprocessors)). - Purpose: keeps you securely signed in. It holds an access token and a refresh token that prove who you are each time your browser requests a page, and is refreshed automatically by our server as you use the Service. The code-verifier cookie protects the sign-in flow against interception. - Type: persistent, first-party. - Duration: until you sign out, at which point it is cleared, or until it expires. The cookie can last up to 400 days (the maximum browsers allow), but the access token inside it is short-lived and is renewed only while your session remains valid. The code-verifier cookie lasts only for the sign-in flow. - Category: strictly necessary. Without it you cannot sign in. ### Active workspace cookie - Name: pv_ws - Provider: first-party (Propvora). - Purpose: remembers which of your workspaces is currently open, so that the application loads the right workspace when you return or switch between pages. It contains only the workspace's short identifier (its "slug"), not any of the workspace's content. Your access to that workspace is always checked separately against your membership on our server; the cookie never grants access by itself. - Type: persistent, first-party, HttpOnly (cannot be read by page scripts), sent only over secure connections in production, with a SameSite=Lax setting that limits it being sent with cross-site requests. - Duration: 1 year from when you last switched workspace, or until you delete it. - Category: strictly necessary to provide the multi-workspace service you have requested. ### Sign-in access type (browser storage) - Name: propvora:access-type - Provider: first-party, stored in your browser's localStorage. - Purpose: remembers which type of access you chose on the sign-in screen (for example property manager, supplier or portal user) so the right sign-in form is shown next time. It is a display preference only and is never used to decide what you are allowed to access. - Type: localStorage (persistent; not sent to our server). - Duration: until you clear your browser's site data. - Category: strictly necessary for the sign-in choice you have made. We will review its classification if guidance changes; if it is treated as a functionality preference, we will rely on the functionality exemption and give you a simple way to object. ### Remembered email address (browser storage) - Name: propvora:remembered-email:[form], and propvora:remembered-email:[form]:off - Provider: first-party, stored in your browser's localStorage. - Purpose: only if you tick "remember me" on the sign-in form, stores your email address on that device so you do not have to type it again. If you untick the box, the address is removed and a marker (the ":off" item) records that you do not want it remembered. No password is ever stored. - Type: localStorage (persistent; not sent to our server). - Duration: until you untick "remember me" or clear your browser's site data. - Category: strictly necessary to provide a feature you have explicitly asked for. Do not tick the box on a shared or public device. ### Onboarding draft (browser storage) - Name: propvora:onboarding:[your email address]:[workspace type] - Provider: first-party, stored in your browser's localStorage. - Purpose: saves your answers and progress while you complete the workspace set-up wizard, so that you do not lose your work if you refresh the page or come back later. It can contain the information you have entered in the wizard, such as your name, company details, portfolio size, regions and service details. - Type: localStorage (persistent; not sent to our server until you submit the wizard). - Duration: deleted automatically when you complete onboarding; otherwise until you clear your browser's site data. - Category: strictly necessary to provide the set-up process you have requested. ### Items we do not set - Sidebar and layout preferences, such as collapsing the navigation sidebar, are held only in the page's memory while you use it. They are not saved in a cookie or in browser storage, so they reset when you reload. - Fonts are served from our own domain, so no request is made to a third-party font service when you load a page. - No analytics, advertising, social media, heatmap, session-recording or live-chat scripts are loaded on the Service. 5. Why there is no cookie banner Because every cookie and storage item listed in section 4 is exempt from the consent requirement, we do not set any non-essential cookies at the moment, and so we do not show a cookie consent banner. We still provide the information in this policy, as PECR requires. Our commitment: before we add any cookie or similar technology that is not strictly necessary, we will update this policy and: 1. for analytics or functionality cookies that fall within the exemptions introduced by the Data (Use and Access) Act 2025, give you clear information and a simple, free way to object (opt out) before or at the point the cookie is first used, and honour that choice; and 2. for any other non-essential cookie, including any advertising, cross-site tracking or social media cookie, obtain your prior, freely given, specific, informed and unambiguous consent through a consent tool that lets you accept or reject as easily as each other, without pre-ticked boxes, and lets you change your mind at any time. We will not use "cookie walls" that block access to public pages unless you accept non-essential cookies. 6. Third-party cookies No third-party cookies are set when you browse the Service today. ### Payments When you start a paid subscription, change your payment method or manage billing, you may be taken to a page hosted by Stripe, our payment provider (for example Stripe Checkout or the Stripe customer portal). Partners who set up payouts through Stripe Connect use Stripe-hosted onboarding pages. Those pages are on Stripe's domains and Stripe may set its own cookies there, mainly to process the payment securely and to prevent fraud. Stripe is responsible for those cookies, and its own cookie and privacy policies apply to them. We do not receive any information from Stripe's cookies. ### Our hosting and security providers Our hosting and content delivery providers (Vercel and Cloudflare) deliver and protect the Service. They may process technical information about your connection, such as your IP address, to route traffic and block attacks. If a security challenge is ever needed to check that a visitor is human, the provider may set a short-lived security cookie, which is exempt as strictly necessary for security. Where any such cookie is in regular use, we will add it to the table in section 4. ### Links and integrations If you follow a link to another website, or a Customer connects an integration, that third party's own cookie policy applies. We are not responsible for cookies set by other websites. 7. Portals, emails and shared devices ### Portals Tenants, landlords, owners, applicants, guarantors, contractors and leaseholders who use a Portal set the same strictly necessary cookies described in section 4 when they sign in: the authentication cookie and, where relevant, the active workspace cookie. Portals do not set any additional cookies. The business that invited you to the Portal (the Customer) does not place cookies on your device through the Service, and cannot add its own tracking scripts to Portal pages. ### Emails Emails we send on our own behalf, and emails that Customers send through the Service, are transactional messages such as invitations, sign-in links, reminders and notifications. We do not add tracking pixels to these emails to build profiles of recipients. Our email delivery provider records technical delivery events, such as whether a message was delivered or bounced, which we use only to make sure important messages arrive. If we later measure whether marketing emails are opened, we will tell you in our Privacy Policy (/legal/privacy) and treat any such pixel as a similar technology under this policy, asking for consent where PECR requires it. ### Shared and public devices Because the onboarding draft and remembered email address are stored in your browser, anyone else who uses the same browser profile could see them. On a shared or public device you should not tick "remember me", you should sign out when you finish, and you should clear the browser's site data for our domain or use a private browsing window, which deletes stored data when it closes. 8. Cookies and personal data Some of the items in section 4 involve personal data: the authentication cookie identifies your account, and the remembered email and onboarding draft contain information you have typed. We process that data as controller to provide the Service, on the basis of our contract with you or, where you are an invited user, our legitimate interest in providing the service the Customer has requested (see the Privacy Policy (/legal/privacy), section 7). Information in localStorage stays in your browser and is not sent to us until you submit a form. See section 7 for advice on shared devices. 9. How to control cookies You can control cookies and browser storage through your browser settings. Most browsers let you: - see the cookies and site data stored for each website, and delete them individually or all at once; - block cookies from particular sites, or block all third-party cookies; - block all cookies; and - delete all cookies and site data when you close the browser. Clearing "cookies and site data" for our domain also clears the localStorage items listed in section 4. Each browser's help pages explain how to do this, for example in Chrome (Settings, then Privacy and security), Safari (Settings or Preferences, then Privacy), Firefox (Settings, then Privacy & Security) and Edge (Settings, then Cookies and site permissions). > If you block or delete the strictly necessary cookies, the Service will not work properly. In particular, you will be signed out and will not be able to sign in, and the application will not remember which workspace you were using. Signing out of the Service clears the authentication cookie. Unticking "remember me" removes the remembered email address. Completing onboarding removes the onboarding draft. Because we do not use analytics or advertising cookies, there is currently nothing further to opt out of. If that changes, the control we provide under section 5 will be available from every page, and we will also respect any recognised browser-level privacy signal that the law requires us to honour. 10. Changes to this policy We will update this policy whenever we add, remove or change a cookie or similar technology, and change the version number and effective date at the top. If we plan to introduce any non-essential cookie, we will update this policy and put in place the consent or opt-out mechanism described in section 5 before the cookie is first set. We review the cookies used by the Service when we release significant changes, and at least once a year. 11. Contact If you have a question about this policy or our use of cookies, contact our data protection lead at info@blackwellen.com (mailto:info@blackwellen.com) or by post at 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk (https://ico.org.uk/make-a-complaint/), as explained in the Privacy Policy (/legal/privacy). Our ICO registration number is ZB905402.