About this policy
This policy explains how we use cookies and similar technologies on www.yellowcard.io and our other sites and pages (our “Websites”), what choices you have, and how to reach us.
Information collected by these technologies is personal data where it can be used to single you out. That includes cookie identifiers, device identifiers, and IP addresses, even when it does not include your name or contact details. Read this policy together with our Privacy Policy, which explains how we handle personal data generally and which takes priority if the two differ.
Yellow Card Financial Inc. (Delaware, United States) is responsible for the cookies on our Websites.
You can contact our Data Protection Officer at dataprotection@yellowcard.io.
What cookies and similar technologies are
Cookies are small files placed on your device when you visit a website. Cookies set under our own domain are first party cookies. Cookies set by another organisation are third party cookies, and they can recognise your device on our Websites and on other websites too.
Being a first party cookie does not make a cookie essential. Some of our own cookies, including our attribution cookie, are not essential.
We also use technologies that work in a similar way: web beacons and pixel tags in pages and emails, browser storage, session recording tools, and server to server event sharing with advertising partners. Where these are not essential, you control them through our Consent Tool in the same way as cookies.
Why we use them, and on what basis
We use these technologies to run the Websites, keep them secure, understand how they are used, remember your preferences, see which marketing brings in new business customers, and measure our advertising.
Essential technologies. We use these because the Websites cannot work properly without them and because we need to keep our systems secure. They are not subject to consent, although you can block them in your browser and lose some functionality.
Everything else. Where the law that applies to you requires consent before non-essential technologies are used, we rely on your consent, given through our Consent Tool and withdrawable at any time. This includes the General Data Protection Regulation and ePrivacy rules in Europe, the United Kingdom rules, the Nigeria Data Protection Act 2023, the Protection of Personal Information Act in South Africa, and similar laws elsewhere. Where consent is not required, we rely on our legitimate interests in running, securing, measuring, and marketing our Websites, and you can object or switch these technologies off at any time.
We do not use cookies or similar technologies to make automated decisions that have legal effects for you or that otherwise significantly affect you.
What we use
The table below lists the technologies that may run on our Websites. Third party providers set their own cookies and decide how long they last.
Technology and provider | Category | What it does | How long it lasts |
|---|---|---|---|
Session, security, and consent cookies (Yellow Card, Framer) | Essential | Keep you signed in, protect the site from abuse, and remember your cookie choices | Up to 12 months |
orig_ref (Yellow Card) | Attribution | Remembers the first link or search that brought you to us, so we can see which marketing works | 180 days |
Google Analytics 4 (Google) | Analytics | Shows us how people find and use our site | 12 months |
Clarity (Microsoft) | Session recording | Records clicks, mouse movement, and scrolling so we can fix design problems | Up to 13 months |
Meta Pixel (Meta) | Marketing | Measures how our ads perform and which audiences to show them to | Up to 12 months |
Insight Tag (LinkedIn) | Marketing | Measures how our ads perform and which audiences to show them to | Up to 12 months |
Pixel (X Corp.) | Marketing | Measures how our ads perform | Up to 13 months |
Conversion linker (Google Ads) | Marketing | Links enquiries back to the ad campaign that produced them | 12 months |
Account Engagement (Salesforce) | Marketing | Recognises your browser when you return and connects your visits to an enquiry form if you submit one, so our sales team can see what you looked at | Up to 12 months |
Three things worth explaining
Session recording. We use Microsoft Clarity to record clicks, mouse movement, and scrolling so we can find and fix design problems. It is set up to mask keystrokes and sensitive information before the recording reaches us. We do not use recordings to profile you, to make decisions about you, or for marketing. Session recording and our marketing scripts run on our public websites only.
How we understand business enquiries. When someone fills in an enquiry form, we use Salesforce Account Engagement to join the browsing history and campaign details for that visit to the new record in our customer system. This helps our sales team see what you were interested in and lets us measure what our marketing costs us. You can object at any time.
Offline measurement. When a business enquiry moves through our sales pipeline, we send that event from our own systems straight to Meta and LinkedIn, along with a scrambled (hashed) version of an email address and phone number so they can match it. Hashing lowers the risk of misuse, but it does not make the data anonymous: hashed details are still personal data, both for us and for the advertising partner. We use this to measure our return on advertising, to stop showing acquisition ads to people already talking to us, and to find similar business audiences. Because the data goes server to server, browser settings and ad blockers do not stop it. Your marketing choice in the Consent Tool controls whether we send your details this way. If you have not given marketing consent, we do not send them. If you withdraw your consent after submitting an enquiry, email dataprotection@yellowcard.io and we will stop sending your details.
Advertising and other third parties
Advertising partners may place cookies and similar technologies on our Websites to show you advertising that may interest you and to measure how it performs. For the information they collect this way, they act as data controllers in their own right, or jointly with us, and their own privacy notices apply. You can also use the advertising controls each of them offers.
We choose our providers, put them under contract where they act for us, and remain responsible for what we deploy on our Websites. Nothing in this policy limits your rights under data protection law or our obligations under it.
Where your data goes, and for how long
Several of the providers above are based in the United States or other countries. When data moves across borders we use a transfer mechanism recognised by the law that applies to you: standard contractual clauses, the United Kingdom addendum or Swiss amendments where relevant, or the provider's certification under the European Union and United States Data Privacy Framework. For transfers from Nigeria, South Africa, Kenya, and our other African markets we rely on the safeguards those laws allow. We can tell you which mechanism applies to a particular transfer on request.
Cookies last for the periods in the table above. Session cookies go when you close your browser. Anything we keep after that is held in line with our Group Data Retention Policy, and information we send to advertising partners is kept by them under their own rules.
How can you control the use of cookies?
We use a Consent Tool to manage your privacy choices and comply with global privacy rules. This tool, which you can access anytime via the floating cookie icon on our website, allows you to change or withdraw your consent.
Your experience with the Consent Tool depends on your location:
In specific regions (like the EU, UK, Brazil, Canada, Australia, South Africa, China, and Nigeria): We will ask you to explicitly click to accept non-essential tracking before it starts. All non-essential tracking is blocked by default.
In all other regions: Tracking is enabled by default. However, you can easily opt out of non-essential tracking at any time using the floating cookie icon (Universal Preference Centre).
Your choices are saved for the browser and device you are using, so set them again if you switch browser or device or clear your cookies. You can also block or delete cookies in your browser settings, which may affect how the Websites work. Browser settings do not affect the offline measurement described above.
Your rights
Depending on the law that applies to you, you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, withdraw any consent you gave, and in some cases ask for your data in a portable form. Email dataprotection@yellowcard.io and we will respond within the time the law allows.
You can also complain to your data protection authority, such as the Nigeria Data Protection Commission, the Information Regulator in South Africa, the Office of the Data Protection Commissioner in Kenya, or the President of the Personal Data Protection Office in Poland.
Updates
We review this policy at least once a year, and whenever we add a technology, change providers, or need to reflect a legal or operational change. The current version and date are at the top of this document. If a change materially affects how we use these technologies, we will tell you through the Websites or the Consent Tool and, where consent is needed, ask you again.