Cookie Policy

1. What Are Cookies and How Do We Use Them

Cookies are small text files placed on your device when you visit a website. They help websites function, remember your preferences, and provide information about how visitors use a site. In addition to cookies, we may use similar technologies such as pixel tags, web beacons, local storage, and session storage. This policy uses the word cookies to refer to all such technologies collectively unless a specific distinction is required.

Covenantz, Inc. operates the following public-facing websites, covered by this Cookie Policy:

• covenantz.net and covenantz.com (together, the “Site”), the corporate website of Covenantz, Inc., primarily serving institutional investors, prospective clients, and business partners. References to covenantz.net in this Cookie Policy include covenantz.com unless stated otherwise.
• kiverify.com, the public product website for KiVerify™, an independent verification ecosystem, serving prospective Ecosystem participants prior to login and registration.

This policy explains what cookies we use on each site, why we use them, and how you can manage them. It should be read alongside the Covenantz Website Privacy Policy (covenantz.net/legal/privacy-policy) and the KiVerify™ Website Privacy Policy (kiverify.com/legal/privacy-policy).

This Cookie Policy does not apply to the authenticated KiVerify™ Ecosystem Workspace accessed at ecosystem.kiverify.com. Authenticated sessions use only Strictly Necessary and Functional cookies. No analytics, advertising, or registration-flow tracking cookies are set on authenticated users. Those cookies are described in the KiVerify™ Ecosystem Privacy Policy.

2. Cookie Categories and Legal Basis

We use four categories of cookies across our websites. The following table summarizes each category, its purpose, and the applicable legal basis.

• Strictly Necessary - Essential for our websites to function. These cookies enable page navigation, session security, form integrity, and load balancing. The sites cannot function without them. They do not collect data for analytics or advertising.
• Functional - Remember your preferences, such as language, region, and display settings, to improve your experience. They do not track you across third-party websites.
• Analytics / Performance - Collect aggregated information about how visitors use the websites, pages viewed, time on page, navigation paths, and errors. This data is used to improve website performance and content. Analytics configurations are intended to support privacy-preserving analytics practices, including limitations on advertising personalization features where implemented and operationally configured.

3. Cookie Use by Site

As noted above, the authenticated KiVerify™ Ecosystem uses only Strictly Necessary and Functional cookies. No analytics, advertising, or registration-flow cookies are set on authenticated users. Authenticated sessions are governed by the Ecosystem Privacy Policy.

4. How We Obtain and Manage Your Consent

5. Cookie Registers

The tables below list the specific cookies used on each site. These registers are maintained as living records. When cookie practices change, for example, when a provider is added or removed, this Cookie Policy will be updated accordingly.

The following cookies are set only in authenticated KiVerify™ Ecosystem sessions (post-login). They are listed here for completeness; they are not subject to the consent mechanism because they are Strictly Necessary.

• _cfuvid
  Provider: .kiverify.com (First-party)
  Purpose: Cloudflare - session tracking for bot detection, load balancing, and session routing
  Duration: Session (expires on logout or browser close)
  Category: Strictly Necessary

6. Third-Party Cookie Providers

Some cookies on our websites are set by third parties. We do not control the cookies set by third parties. Each third party's use of cookies is governed by their own policies, linked below. You can manage third-party cookies via the consent banner, via browser settings, or via each provider's own opt-out tools.

• Google LLC (Google Analytics 4)
  Category: Analytics / Performance
  Sites: covenantz.net, kiverify.com
  Opt-Out / Privacy Policy: https://tools.google.com/dlpage/gaoptout
• Cloudflare, Inc.
  Category: Strictly Necessary
  Sites: kiverify.com
  Privacy Policy: https://www.cloudflare.com/privacypolicy
• Didomi SAS
  Category: Strictly Necessary (consent record)
  Sites: covenantz.net, kiverify.com
  Privacy Policy: https://www.didomi.io/privacy-policy

7. Managing and Disabling Cookies

8. California Residents - CCPA / CPRA

California residents may have the right under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), to opt out of the "sale" or "sharing" of their personal information.

Covenantz does not intentionally sell personal data collected through covenantz.net or kiverify.com for monetary consideration or for independent third-party marketing purposes.

Certain analytics, consent-management, security, or website technologies used on the Sites may involve the disclosure, collection, or processing of identifiers, browsing activity, or technical information by third-party service providers acting on our behalf. Depending on applicable law, regulatory interpretation, technical configuration, or third-party technology behavior, certain cookie-based activities may be characterized as “sharing” under the California Privacy Rights Act (CPRA), including where analytics or similar technologies involve cross-context data processing by third-party providers.

Covenantz does not intentionally use website visitor data for cross-context behavioral advertising or advertising personalization purposes. California residents may manage cookie preferences and opt out of non-essential cookie processing at any time through the cookie consent banner or “Cookie Settings” link available on the Sites.

California residents may also contact security@covenantz.com with the subject line "California Privacy Rights Request."

9. International Transfers via Cookies

Some third-party cookies used on our websites may result in personal data being transferred to, processed in, or stored in countries outside the EEA or the UK, including the United States. Where applicable and operationally implemented, we may rely on transfer safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, contractual commitments from service providers, or other lawful transfer mechanisms recognized under applicable data protection laws.

Details of the transfer mechanisms applicable to each third-party provider are set out in those providers ’own policies (see Section 6). Our data processing agreements with third-party cookie providers are maintained in accordance with GDPR Article 28.

10. Updates to This Cookie Policy

We review and update this Cookie Policy when our cookie practices change, for example, when a provider is added or removed, when our analytics stack changes, or when applicable law or regulatory guidance requires an update. The Effective Date at the top of this policy indicates when the current version took effect.

When we make material changes, we will provide notice through the consent banner on both websites before the changes take effect, giving you the opportunity to review and refresh your preferences. Prior versions of this Cookie Policy may be made available upon reasonable request by contacting security@covenantz.com.

11. Contact Us

For questions about our use of cookies, to exercise your rights, or to report a concern about our cookie practices, contact:

Email: security@covenantz.com
Legal: security@covenantz.com
Data Protection Officer: dpo@covenantz.com
Mailing Address: Covenantz, Inc., The Corporation Trust Company, Corporation Trust Center, 1209 Orange St, Wilmington, DE 19801