Cookie Policy & Tracking.

What is a cookie?

A cookie is a small text file placed on your device by a website you visit. It allows the website to remember your actions and preferences (login, language, font size, other display preferences) over a period of time so you don't have to re-enter them on every visit. We also use similar technologies including local storage, session storage, web beacons, and pixel tags — collectively referred to as 'cookies' in this policy.

Categories of cookies we use

Strictly necessary: needed for the site to work, such as security, sign in, your language and remembering your cookie choices. These are always on.

Functional: remember optional preferences, such as your region and your quiz answers on this browser. Off until you allow them.

Analytics: measure which pages and programmes are useful and recognise your browser when you return, using our own first-party identifier. Off until you allow them.

Marketing: measure which adverts lead to enquiries and bookings, send follow-up emails based on the pages you return to (only if you also agreed to marketing emails), and show you relevant adverts on Google, Meta and LinkedIn. Off until you allow them.

Cookie inventory

Strictly necessary. CITIZENSURE_LOCALE: your language, 12 months. cs_geo: your country from our network provider, used to decide whether to show this banner, 24 hours. cs_consent (and the browser storage entry cs.consent.v1): your cookie choices and the version of this notice you agreed to, 12 months. payload-token: keeps you signed in to your account, 30 days. cs_consult: holds a consultation slot while you pay, 7 days. __cf_bm and cf_clearance: Cloudflare bot protection, 30 minutes to 1 year.

Functional. cs_region: the region you chose, 12 months. cs_qv: links your quiz answers on this browser, 180 days. cs_ab_*: which version of a landing page you saw, 90 days.

Analytics. cs_vid: a random identifier set by our server only after you allow analytics or marketing cookies. It cannot be read by scripts on the page and is never shared with advertisers. It lets us recognise your browser when you return and, if you later contact us or sign in, link your visits to your enquiry. Up to 13 months, renewed when you visit. cs_seg: a coarse stage (new visitor, subscriber, enquiry, registered, client) so the site can show relevant content, no personal details, 30 days. _ga and _ga_*: Google Analytics, up to 13 months.

Marketing. cs_attr: the campaign that brought you here and the advert click identifiers (gclid from Google, fbclid from Meta), 90 days. _fbp and _fbc: Meta Pixel, 90 days. _gcl_au: Google Ads, 90 days. li_fat_id, lidc and bcookie: LinkedIn Insight, up to 1 year.

Recognising returning visitors

With your permission we recognise your browser when you come back, so that an adviser can see which programmes you looked at and we can follow up in a way that is useful to you. We record visits to key pages only (programmes, pricing, comparisons, booking and our tools), never what you type into forms, and never the full web address.

Your visits stay anonymous until you identify yourself, for example by submitting an enquiry, booking a consultation, subscribing, signing in, or clicking a link in one of our emails. From then on they are linked to your record in our client management system. Visit records are deleted 13 months after your last visit.

If you also agreed to marketing emails, we may send a small number of follow-up emails when you return, for example a programme guide after you view the same programme more than once, or a reminder if you started booking a consultation but did not finish. We limit how often these are sent, every email has a one-click unsubscribe link, and existing clients do not receive them. When an existing client returns, their adviser may get a reminder to check in instead.

Third-party cookies and partners

Google (Analytics, Ads and Tag Manager), Meta (Pixel and Conversions API), LinkedIn (Insight Tag) and Cloudflare set or read cookies on this site. We use Google Consent Mode: in the UK, the EEA and Switzerland, Google tags run with storage and advertising signals denied until you opt in.

With marketing consent only, we also tell Google and Meta directly from our servers when an enquiry, booking, registration or payment happens, so we can measure our adverts without relying on browser cookies. We send a scrambled (SHA-256 hashed) version of your email address and phone number, the advert click identifiers and an event reference, never your name in readable form or what you wrote to us. With the same consent, hashed contact details may be added to advertising audiences of people who recently viewed a programme or started a booking; they are removed when you withdraw consent, unsubscribe or become a client.

Lawful basis

Strictly necessary cookies are used because they are essential to provide the service you request and under our legitimate interests. Functional, analytics and marketing cookies, the returning visitor identifier, follow-up emails and server-side advertising measurement rely on your consent, in accordance with applicable data protection law, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Consent is granular: you can choose each category separately.

We keep a record of each choice: the version of this notice, the categories you chose, the time, and a scrambled form of the browser identifier. This proof is kept for 13 months after the identifier expires, then deleted.

Manage or withdraw your choices

Select Cookie settings at the bottom of any page to change your choices at any time, as easily as you gave them. If you withdraw analytics and marketing consent, we delete the visitor identifier from your browser and delete your visit records; if you withdraw marketing consent only, we stop follow-up emails, stop sending advertising measurements and remove you from advertising audiences at the next update. You can also clear cookies in your browser settings.

How long we keep it

Cookie lifetimes are listed in the inventory above. The returning visitor identifier never lasts more than 13 months, which regulators treat as the maximum for this kind of identifier, after which we ask again. Visit records, campaign details and advert click identifiers held on our servers are deleted 13 months after your last visit, or straight away if you withdraw consent or ask us to erase your data.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies and advertising measurement. Where we rely on a cookie choice you made, that choice is respected; strictly necessary cookies remain active.

Changes to this policy

We may update this Cookie Policy from time to time to reflect changes in technology, regulation, or our practices. The 'Last updated' date at the top reflects the most recent revision. Material changes will be notified via the consent banner; continued use of the site after notification constitutes acceptance.

Contact us about cookies

Questions about this Cookie Policy or the cookies we use? Contact privacy@citizensure.com or write to: Data Protection Officer, Citizen Sure, Business Bay, Dubai, United Arab Emirates.

Manage your cookie preferences

Select Cookie settings at the bottom of any page to change or withdraw your choices at any time.