Cookie policy

1. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or phone) when you visit a website. They allow the site to recognise your device on return visits and store information about your preferences or actions. Similar technologies include:

• Local storage / session storage: browser-based key-value stores that persist data without an expiry date (local storage) or until the tab closes (session storage).
• Pixel tags / web beacons: tiny invisible images embedded in pages or emails that signal when content has been loaded or an action taken.
• Device fingerprinting: a combination of browser and device attributes (user agent, screen resolution, installed fonts, time zone, etc.) used to identify a device without a cookie.
• Script-based tracking: JavaScript snippets that observe user behaviour (clicks, scrolls, mouse movements, form interactions) and send that data to a third-party analytics or session-recording service.

All of the above are referred to collectively as "cookies" or "tracking technologies" in this policy.

2. Categories of Cookies We Use

We classify cookies into four categories. Only strictly necessary cookies are placed without consent. All others require your affirmative opt-in via our cookie consent banner.

2.1 Strictly Necessary

These cookies are essential for the Service to function. They cannot be switched off and do not require consent under applicable law. They do not track you for advertising purposes.

2.2 Analytics and Performance

These cookies help us understand how visitors use the Service — which pages are visited, where users drop off, and how performance can be improved. All data is aggregated or pseudonymised. These cookies require your consent.

Google Analytics 4 (GA4)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data transfer: Google may transfer data to the United States. MyTaek has entered into Google's Data Processing Terms incorporating Standard Contractual Clauses (SCCs). Google Analytics data is configured with IP anonymisation enabled and data sharing with Google products disabled.

Opt-out: Google Analytics opt-out browser add-on / withdraw consent in our cookie banner.

Google Privacy Policy: policies.google.com/privacy

PostHog

PostHog is our product analytics platform. It records aggregated event data (page views, feature interactions, funnel steps, retention cohorts) to help us understand how users navigate the application.

Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

Data transfer: PostHog is a US-based provider. MyTaek uses PostHog's EU Cloud (data stored in Frankfurt, EU) where available, and has executed a Data Processing Agreement with PostHog incorporating SCCs for any residual US transfers.

Configuration: PostHog is configured with autocapture: false (we capture only named events, not all DOM interactions). IP addresses are masked at ingestion. We do not send personally identifiable information (name, email, phone) as PostHog event properties.

PostHog Privacy Policy: posthog.com/privacy

Hotjar

Hotjar provides session recording, heatmaps, and on-site surveys. It records mouse movements, clicks, scrolls, and form interactions to help us identify usability issues. Hotjar does not record keystrokes in password or payment fields.

Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta.

Data transfer: Hotjar is EU-based (Malta). Some data may be transferred to US sub-processors. Hotjar has executed SCCs for all such transfers. See Hotjar's Sub-processors List.

Configuration: Hotjar is configured to suppress recording of all input fields tagged as sensitive (passwords, payment fields, personal data fields). We do not use Hotjar on pages that display children's personal data. The Hotjar script is only loaded after consent is granted.

Suppression: Hotjar respects the data-hj-suppress attribute on any element. If you believe a field is being recorded inappropriately, contact privacy@mytaek.com.

Hotjar Privacy Policy: hotjar.com/legal/policies/privacy

Hotjar Do Not Track: hotjar.com/opt-out

2.3 Functional

These cookies enable enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have added to our pages.

Note: if we add functional third-party tools not listed here (e.g. a video player, an embedded map, a scheduling tool), we will update this table before deploying them and request fresh consent if required.

2.4 Marketing and Targeting

At present, MyTaek does not run paid advertising campaigns and does not use advertising network cookies or retargeting pixels. We do not share your data with advertising networks or data brokers.

If we introduce marketing cookies in the future (e.g. Meta Pixel, LinkedIn Insight Tag, Google Ads remarketing), we will:

1. Update this Cookie Policy before deploying any such cookies.
2. Obtain fresh explicit consent from all users via the consent banner.
3. Document the new cookies in the table below.

3. Third-Party Tools — Data Processing Agreements

We have executed formal Data Processing Agreements (DPAs) with each third-party sub-processor that processes personal data through cookies or tracking technologies on our Service. The table below lists our current sub-processors, their role, the legal mechanism for any international data transfers, and links to their DPA or processing terms.

MyTaek maintains a full record of sub-processor agreements in accordance with GDPR Article 28 and Article 30. This list is updated whenever a new sub-processor is onboarded. Material changes (new sub-processors that process significant volumes of personal data) are notified to School account holders with at least 30 days' advance notice, as required by our Data Processing Addendum.

4. Consent Mechanism

4.1 How We Obtain Consent

On your first visit to mytaek.com or the application, a cookie consent banner is displayed. The banner:

• clearly identifies the categories of cookies used;
• provides separate opt-in controls for each non-essential category (Analytics, Functional, Marketing);
• does not pre-tick any non-essential category;
• makes it as easy to decline as to accept (a "Reject all" option is displayed at the same level as "Accept all");
• does not use dark patterns (no confusing language, no hiding the decline option behind multiple clicks).

Your consent is recorded with a timestamp and the version of this Cookie Policy in effect at the time. We do not treat continued browsing, scrolling, or page navigation as consent.

4.2 Withdrawing Consent

You may change your cookie preferences at any time by:

• clicking the "Cookie settings" link in the footer of any page; or
• clearing your browser cookies (this also clears the consent record, so the banner will reappear); or
• using your browser's built-in cookie controls.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.3 Consent for Authenticated Users

When you are logged in to a MyTaek account, analytics and functional cookies may be linked to your account identifier (a pseudonymous ID, not your name or email) to enable cross-session analytics and feature flag delivery. This processing is based on legitimate interests (improving the product for active users) in addition to consent. You may object to this processing by contacting privacy@mytaek.com.

4.4 Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. MyTaek currently does not respond to DNT signals at the browser level because there is no industry-standard definition of what DNT requires. Instead, we rely on the explicit consent mechanism described above. Hotjar additionally respects the Global Privacy Control (GPC) signal where detected.

5. Children

We do not knowingly use analytics or tracking cookies in relation to accounts belonging to children (users under 13, or under the applicable digital consent age in the relevant jurisdiction). Student-facing pages within the application do not load Hotjar session recording scripts. If you believe a child's session data has been inadvertently collected, contact privacy@mytaek.com and we will delete it promptly.

6. Your Browser Controls

In addition to our consent banner, most browsers allow you to control cookies through their settings:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Cookies and site data

Note that blocking all cookies will break essential functionality (login will not work without the session cookie).

You can also opt out of specific third-party analytics tools directly:

• Google Analytics: tools.google.com/dlpage/gaoptout
• Hotjar: hotjar.com/opt-out
• PostHog: contact privacy@mytaek.com to request opt-out from server-side event capture

7. Changes to This Policy

We may update this Cookie Policy when we add, remove, or change tracking technologies. Material changes (new sub-processors, new cookie categories, changes to consent mechanics) will be notified via:

• an updated banner requiring fresh consent for any newly added non-essential cookies;
• an email notification to School account holders for changes affecting the DPA or sub-processor list;
• a "Last updated" date at the top of this page.

We recommend reviewing this page periodically.

8. Contact and Complaints

MyTaek [LEGAL ENTITY TYPE]
[REGISTERED ADDRESS]
Email: privacy@mytaek.com

If you are located in the EU/EEA and believe we have not handled your cookie consent or data correctly, you have the right to lodge a complaint with your national supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl.