Cookie Policy
Plain Language Summary
In short: We use cookies sparingly and transparently. This policy explains what cookies are, which ones we use, and how you can control them.
As a cybersecurity company, we take privacy seriously — including our own website practices. We use a minimal set of cookies, do not run any analytics on this site, and do not use any advertising or tracking cookies.
| Cookie Category | Consent Required | Maximum Duration |
|---|---|---|
| Essential cookies | No (always active) | Session – 1 year |
| Functional cookies | Yes | 9 months |
| Analytics cookies | We don't use any | N/A |
| Marketing cookies | We don't use any | N/A |
You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of any page, or by adjusting your browser settings.
1. What Are Cookies?
Cookies are small text files that are placed on your computer, smartphone, or other device when you visit a website. They are widely used to make websites work more efficiently, as well as to provide information to the website owners.
Types of Cookies
| Type | Description |
|---|---|
| Session Cookies | Temporary cookies that are deleted when you close your browser. They enable website features during your visit. |
| Persistent Cookies | Remain on your device for a set period or until you delete them. They remember your preferences for future visits. |
| First-Party Cookies | Set by the website you are visiting (in this case, enigmalab.io). |
| Third-Party Cookies | Set by external services embedded on our website (such as Intercom). |
Similar Technologies
In addition to cookies, we may use other similar technologies:
- Local Storage — Stores data in your browser with no expiration date
- Session Storage — Stores data only for the duration of your browser session
- Web Beacons/Pixels — Small invisible images used to track page views or email opens
2. How We Use Cookies
Enigma Labs B.V. uses cookies to:
- Ensure website functionality — Enable core features like region routing, security, and consent management
- Remember your preferences — Store language settings and consent choices
- Provide live chat support — Enable our Intercom chat functionality when you consent to Functional cookies
Our Privacy-First Approach
We believe in data minimisation and privacy by design, consistent with Article 25 of the GDPR. Our cookie usage reflects this commitment:
| Feature | Our Approach |
|---|---|
| Analytics | None deployed — we do not run any analytics on this site |
| Advertising | None — we don't use any advertising cookies |
| Tracking | None — no cross-site tracking or profiling |
| Data Sharing | None — we don't sell or share data with advertisers |
3. Types of Cookies We Use
Cookie Categories Summary
| Category | Consent Required | Maximum Duration | Description |
|---|---|---|---|
| Strictly Necessary | No | 1 year | Essential for the website to function. Cannot be disabled. |
| Functional | Yes | 9 months | Enable enhanced features and personalisation. |
3.1 Strictly Necessary Cookies
These cookies are essential for the website and platform to function. They cannot be disabled in our cookie consent tool. These cookies do not store any personally identifiable information. We rely on these cookies on the basis that their use is strictly necessary for the provision of the information-society service you have requested, as recognised by Article 5(3) of the EU ePrivacy Directive (2002/58/EC) and the corresponding provisions of the Dutch Telecommunicatiewet.
| Cookie Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
geoDecision | Enigma Labs B.V. | Stores the signed regional routing decision (region, scoring metadata, preferred legal language, issued-at timestamp) used to deliver the correct regional entity content; signed with HMAC | 24 hours | HTTP (Secure, HttpOnly) |
region | Enigma Labs B.V. | Records the visitor's resolved region so subsequent requests do not need to re-resolve | 1 year | HTTP |
userCountry | Enigma Labs B.V. | Records the visitor's ISO-3166 country code derived from request headers | 24 hours | HTTP |
preferredLegalLanguage | Enigma Labs B.V. | Records the visitor's chosen legal-document language; set when the visitor selects a language on a legal page | 30 days | HTTP |
c15t | Enigma Labs B.V. (via c15t) | Records cookie-consent preferences and the disclosure shown at the time of those choices; mirrored in browser local storage. Set only after you make a consent decision via the banner or settings dialog. | 365 days | HTTP (SameSite=Lax, Secure on HTTPS, host-only) |
Why these are necessary:
geoDecision— Stores the signed routing decision needed to deliver the correct regional version of the site. The cookie is signed (HMAC) and HttpOnly + Secure. Without it the regional content (legal entity, contact details, applicable policies) cannot be reliably served.region— Records the resolved region so each subsequent request does not have to re-evaluate geo signals.userCountry— Records the visitor's country code for region-aware content (currency-of-context metadata, regulatory references).preferredLegalLanguage— Records the visitor's chosen legal-document language so subsequent visits to legal pages render in the correct language.c15t— Required to record your cookie consent choices and the disclosure shown at the time. Without it we cannot honour refusal of non-essential cookies on subsequent page loads. The same data is also mirrored in your browser's local storage so consent is preserved if cookies are cleared but storage is retained.
3.2 Functional Cookies
These cookies and similar browser-storage technologies enable enhanced functionality. They are loaded via our consent management platform (c15t), which only loads the underlying provider's script after you have granted Functional consent. You can withdraw consent at any time via the Cookie Settings link in the footer, in which case the cookies and storage are cleared.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
intercom-id-* | Intercom | Identifies user for live chat support | No expiry (until cleared) | First-party cookie; also mirrored to browser local storage |
intercom-session-* | Intercom | Maintains live chat session state | 1 week | HTTP cookie |
intercom-device-id-* | Intercom | Identifies device for chat continuity (rolling refresh) | ~9 months (270 days) | HTTP cookie |
What these enable:
- Live chat functionality — Seamless support experience with conversation history. Intercom is loaded only after you have given Functional consent, and is shut down (and its cookies / storage cleared) when you withdraw consent.
4. Cookies We Do NOT Use
Unlike many websites, we do NOT use any advertising or marketing cookies. Specifically, we do not:
| What We Don't Do | Why It Matters |
|---|---|
| Run retargeting campaigns | No ads following you around the web |
| Use Google Ads | No Google tracking pixels |
| Use Facebook Pixel | No Meta/Facebook tracking |
| Use LinkedIn Insight Tag | No professional profile tracking |
| Share data with advertising networks | Your data stays with us |
| Build advertising profiles | No behavioural profiling |
| Sell visitor data | Your information is never sold |
Our commitment: As a cybersecurity company, we believe in practising what we preach. Your privacy is not for sale.
5. Cookie Consent
5.1 How We Obtain Consent
Enigma Labs B.V. uses c15t, a consent management platform that records each visitor's cookie-consent choices and the disclosure shown at the time those choices were made. c15t blocks non-essential cookies until you have given consent and re-prompts you when material changes are made to our cookie use.
When you first visit our website:
- A cookie banner appears at the bottom of the screen
- You can choose to accept all cookies, reject non-essential cookies, or customise your preferences
- Non-essential cookies are blocked until you give consent
- Your preferences are stored in the
c15tcookie for 365 days (mirrored in browser local storage)
Our consent mechanism complies with GDPR and ePrivacy requirements:
| Requirement | Our Implementation |
|---|---|
| Consent before non-essential cookies | ✅ Non-essential cookies blocked until consent |
| Freely given | ✅ Equal prominence for accept/decline options |
| Specific and informed | ✅ Granular categories with clear descriptions |
| Unambiguous | ✅ Clear affirmative action required |
| No pre-ticked boxes | ✅ All non-essential options unchecked by default |
| Easy to refuse | ✅ "Reject All" option equally accessible |
| No cookie walls | ✅ Content accessible without consent |
5.2 Your Consent Choices
When you see our cookie banner, you have three options:
| Option | What Happens |
|---|---|
| Accept All | All cookie categories are enabled (Necessary + Functional) |
| Reject Non-Essential | Only Strictly Necessary cookies are enabled |
| Customize | You choose which categories to enable individually |
5.3 Withdrawing Consent
You can change your cookie preferences at any time:
- Via our website: Click the "Cookie Settings" link in the footer of any page
- Via browser settings: Clear cookies and browser storage for enigmalab.io — including the c15t consent-state cookie (
c15t) and its mirrored local-storage entry - Contact us: Email hello@enigmalab.io
When you withdraw consent:
- Non-essential cookies are immediately deleted
- Associated data processing stops
- Your preference is recorded for 365 days
- Withdrawal of consent does not affect the lawfulness of any processing carried out on the basis of consent before its withdrawal
5.4 Consent Expiration and Renewal
Your cookie consent preferences are stored for 365 days. After this period:
- The cookie consent banner will reappear on your next visit
- You will be asked to confirm or update your preferences
- This ensures your consent remains current and informed
We may also re-display the consent banner if:
- We add new cookie categories
- We add new third-party services
- There are material changes to how we use cookies
6. Managing Cookies
6.1 Using Our Cookie Settings
The easiest way to manage cookies on our website is through our built-in cookie settings:
- Click "Cookie Settings" in the footer of any page
- Toggle individual cookie categories on or off
- Click "Save Preferences"
Your choices take effect immediately.
6.2 Browser Settings
You can also control cookies through your browser settings. Here's how to manage cookies in popular browsers:
| Browser | Settings Path | Instructions Link |
|---|---|---|
| Google Chrome | Settings → Privacy and security → Cookies and other site data | Chrome Help |
| Mozilla Firefox | Settings → Privacy & Security → Cookies and Site Data | Firefox Help |
| Apple Safari | Preferences → Privacy → Cookies and website data | Safari Help |
| Microsoft Edge | Settings → Cookies and site permissions → Manage and delete cookies | Edge Help |
Browser-level options include:
- Block all cookies
- Block third-party cookies only
- Clear cookies when you close the browser
- Create exceptions for specific websites
- View and delete existing cookies
Note: Blocking all cookies may prevent some features of our website from functioning properly.
6.3 Mobile Devices
On mobile devices, you can manage cookies through:
| Device | Path |
|---|---|
| iOS (Safari) | Settings → Safari → Block All Cookies / Prevent Cross-Site Tracking |
| Android (Chrome) | Chrome → Settings → Site settings → Cookies |
6.4 Third-Party Opt-Outs
For cookies set by third-party services, you can also use their dedicated opt-out mechanisms:
| Service | Opt-Out Method |
|---|---|
| Intercom | Intercom Privacy Portal or disable functional cookies in our settings |
| General (EU) | Your Online Choices |
7. Third-Party Services
We use a limited number of third-party services that may set cookies. Here's detailed information about each:
| Service | Purpose | Privacy Policy | Opt-Out |
|---|---|---|---|
| Intercom | Live chat support | Intercom Privacy | Disable functional cookies |
7.1 Intercom (Live Chat)
Purpose: Provides live chat functionality for customer support
Data collected:
- Anonymous user ID for chat continuity
- Chat conversation history
- Device identifier for session management
Role: Intercom acts as our processor in respect of the chat conversation data and user-identifier data we collect through its chat service (where we determine the purposes and means of processing). Intercom may additionally act as an independent controller in respect of certain platform telemetry and product analytics it generates in the operation of the chat service itself. The role allocation between Enigma and Intercom is governed by Intercom's data processing agreement and product terms, as in force from time to time.
Data location: Intercom processes data in the United States. Transfers of personal data from Enigma Labs B.V. (Netherlands) to Intercom (United States) are made on the basis of the EU–U.S. Data Privacy Framework where Intercom is certified, and otherwise pursuant to the European Commission's Standard Contractual Clauses and any supplementary measures required under Chapter V of the GDPR.
Data retention: Device identifier (intercom-device-id-*): ~9 months (270 days) — first-party cookie. Session identifier (intercom-session-*): 1 week — first-party cookie. User identifier (intercom-id-*): first-party cookie with no expiry (until cleared by the user); also mirrored to browser local storage.
How to opt out: Disable "Functional Cookies" in our cookie settings or contact Intercom through their Privacy Portal
8. Do Not Track
What are Do Not Track (DNT) and Global Privacy Control (GPC)?
Do Not Track (DNT) and Global Privacy Control (GPC) are browser signals that communicate your preference not to be tracked. DNT is the older mechanism, sent as a request header; GPC is a newer specification with growing legal recognition, including under the GDPR as a means of signalling objection to processing. GPC is exposed both as a request header (Sec-GPC) and a JavaScript property (navigator.globalPrivacyControl).
Our response to these signals
| Aspect | Our Approach |
|---|---|
| Global Privacy Control (GPC) | Our consent management platform (c15t) recognises GPC and treats it as an automatic refusal of non-essential cookie categories where the underlying legal regime supports it |
| Do Not Track (DNT) | We do not implement specific behaviour for the legacy DNT header. The same outcome (refuse non-essential cookies) is achievable via our cookie banner or settings dialog |
| Third-Party Cookies | Intercom does not currently respect GPC or DNT in all cases; we therefore only load it after explicit Functional consent regardless of either signal |
| Essential Cookies | Still required for website functionality regardless of GPC or DNT |
Alternative options
If your browser doesn't expose GPC or you want additional control:
- Use our cookie consent banner or "Cookie Settings" link to reject non-essential cookies
- Install privacy-focused browser extensions (uBlock Origin, Privacy Badger)
- Use browser settings to block third-party cookies
- Use private / incognito browsing mode
9. Updates to This Policy
We may update this Cookie Policy from time to time to reflect:
- Changes in the cookies we use
- New third-party services
- Changes in legal requirements (including changes to the GDPR, the ePrivacy Directive, the Telecommunicatiewet, the UAVG, or guidance issued by the Autoriteit Persoonsgegevens or the European Data Protection Board)
- Improvements to our privacy practices
How We Notify You of Changes
| Change Type | Notification Method |
|---|---|
| Minor updates (clarifications, typo fixes) | Updated date in document header |
| Material changes (new cookie categories, new third parties) | Cookie banner re-display + email to registered users |
| Version changes | Document version number incremented |
Version History
| Version | Date | Changes |
|---|---|---|
| 1.0 | January 22, 2026 | Initial release |
| 2.0 | May 19, 2026 | Engineering reconciliation: installed c15t as the consent management platform; gated Intercom behind explicit Functional consent; removed cookies and third-party services that were described in v1.x but not actually deployed (PHPSESSID/csrf_token/__Host-session/cc_cookie/locale/lang/plausible_ignore/X cookies, plus the entire Plausible and X share-button sections); added the c15t consent-state cookie to the strictly-necessary inventory; restated intercom-id-* as a first-party cookie with localStorage mirror (correcting v2.0's earlier classification as localStorage-only); reframed §8 around Global Privacy Control (GPC) alongside the legacy DNT signal; fixed the /terms URL to /tos. |
Current version: 2.0 (Last updated: May 19, 2026)
We recommend reviewing this policy periodically. Continued use of our website after changes constitutes acceptance of the updated policy.
10. Your Rights
Under the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG), you have certain rights regarding cookies and the data they may collect:
| Right | Description | How to Exercise |
|---|---|---|
| Right to be informed (Arts. 13–14) | Know what cookies are used, for what purposes, and on what basis | This policy together with our Privacy Policy provides this information |
| Right of access (Art. 15) | Access any personal data we hold about you | Contact hello@enigmalab.io |
| Right to rectification (Art. 16) | Correct inaccurate personal data | Contact hello@enigmalab.io |
| Right to erasure (Art. 17) | Request deletion of personal data collected via cookies | Clear cookies, withdraw consent, or contact us |
| Right to restriction of processing (Art. 18) | Limit how your personal data is used | Adjust cookie preferences or contact us |
| Right to data portability (Art. 20) | Receive your personal data in a structured, commonly-used, machine-readable format, where applicable | Contact hello@enigmalab.io |
| Right to object (Art. 21) | Object to certain types of processing | Reject non-essential cookies or contact us |
| Right to withdraw consent (Art. 7(3)) | Withdraw consent at any time, without affecting prior lawful processing | Use "Cookie Settings" in the footer, or clear the c15t cookie and its mirrored local-storage entry |
| Rights related to automated decision-making (Art. 22) | Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects | The cookies and processing described in this policy do not currently engage Art. 22 |
| Right to lodge a complaint (Art. 77) | Complain to the Autoriteit Persoonsgegevens (the Dutch supervisory authority) | See contact details in Section 11 below |
For more detailed information about your privacy rights and the lawful bases on which we process personal data, please refer to our Privacy Policy.
11. Contact Us
If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies, please contact us:
| Contact Method | Details |
|---|---|
| Privacy Email | hello@enigmalab.io |
| Data Protection Officer | hello@enigmalab.io |
| Company Address | Enigma Labs B.V., Korte Lijnbaanssteeg 1, 1012SL Amsterdam, Netherlands |
| KvK Number | 99568322 |
| Privacy Policy | https://enigmalab.io/privacy |
| Terms of Service | https://enigmalab.io/tos |
We aim to respond to all privacy-related inquiries within 30 days.
Supervisory Authority
If you are not satisfied with our handling of your request, or if you believe that our processing of your personal data contravenes the GDPR or the UAVG, you have the right to lodge a complaint with the Dutch supervisory authority:
| Contact Method | Details |
|---|---|
| Authority | Autoriteit Persoonsgegevens |
| Postal Address | Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands |
| Website | https://autoriteitpersoonsgegevens.nl |
Document Information
| Field | Value |
|---|---|
| Document Title | Cookie Policy |
| Company | Enigma Labs B.V. |
| Legal Entity | Besloten Vennootschap (Dutch Private Limited Company) |
| Registered Address | Korte Lijnbaanssteeg 1, 1012SL Amsterdam, Netherlands |
| KvK Number | 99568322 |
| Country of Incorporation | The Netherlands |
| Website | https://enigmalab.io |
| Cookie Policy URL | https://enigmalab.io/cookies |
| Privacy Policy URL | https://enigmalab.io/privacy |
| Terms of Service URL | https://enigmalab.io/tos |
| Effective Date | May 19, 2026 |
| Last Updated | May 19, 2026 |
| Version | 2.0 |
| Cookie Consent Tool | c15t |
Legal Framework
This Cookie Policy complies with:
- EU ePrivacy Directive (2002/58/EC) — Cookie consent requirements
- GDPR (Regulation (EU) 2016/679) — Personal data processing via cookies
- Dutch Telecommunications Act (Telecommunicatiewet) — Dutch implementation of ePrivacy
- UAVG (Uitvoeringswet AVG) — Dutch implementation of the GDPR
- EDPB Guidelines on Consent — Granular, freely given, informed consent
Related Documents
- Privacy Policy — Full details on how we process personal data
- Terms of Service — Terms governing use of our services
This Cookie Policy (version 2.0) was last updated on May 19, 2026. For the most current version, please visit https://enigmalab.io/cookies.
© 2026 Enigma Labs B.V. All rights reserved.