Cookie and Similar Technologies Policy

Version 1.4 · Unpublished draft · No effective date has been set.

NOT READY FOR PUBLICATION. Every field marked ACTION REQUIRED must be completed by the owner before release. Version 1.2 has not been changed or replaced.

1. About this policy

This policy explains how Pennny uses cookies, local storage, session storage, pixels and comparable technologies in the Pennny web application (app.pennny.ai) and on any Pennny-controlled page (pennny.ai).

In short: Pennny uses only strictly necessary technologies. Analytics: None enabled. There is no advertising or marketing technology, so there is no cookie banner and nothing for you to switch on or off.

2. Who is responsible

Pennny B.V. KvK number: 42159747 Registered address: Sydneystraat 6, 1175 RN Lijnden, the Netherlands Privacy contact: [ACTION REQUIRED: privacy mailbox]

3. Scope

This policy applies to the Pennny web application; Pennny-controlled authentication, account, payment and support pages; and any other Pennny-controlled interface that links to this policy.

It does not govern access to a connected inbox or bank, documents you upload, claim evidence, financial transactions, AI analysis of your information, or communications sent as part of a claim. Those are explained in the Privacy Policy and the connection notices.

4. Applicable legal framework

Pennny intends this policy to operate in accordance with the EU ePrivacy framework; Article 11.7a of the Dutch Telecommunications Act; the GDPR; the Dutch GDPR Implementation Act; and applicable guidance from the Autoriteit Persoonsgegevens and the ACM.

As a general rule, storing information on or reading information from your device requires clear information and prior consent. Consent is not required where a technology is used solely to transmit a communication, or is strictly necessary to provide a service you expressly requested. Every technology Pennny uses is in that second group.

5. Categories

5.1 Strictly necessary

Used for account authentication; maintaining a secure session; fraud prevention; application and network security; preventing duplicate or unauthorised transactions; and completing a payment you requested. Pennny does not use the necessary category to activate analytics or advertising.

5.2 Preferences

Remember choices such as display settings only where that is part of the function you asked for.

5.3 Analytics

None enabled. Pennny sets no analytics cookie and sends no usage events to an analytics service. If that ever changes, any tool will be EU-hosted and cookieless where possible, this policy will be updated first, and consent will be asked for before anything optional is switched on.

5.4 Marketing

Pennny ships no marketing or advertising technology. When you open a partner's site from a comparison or travel result, that site is governed by its own cookie policy; Pennny records only that you opened the link (Privacy Policy, section 8).

6. Consent

Because only strictly necessary technologies are used, Pennny does not set a consent cookie and shows no consent banner. If an optional technology is introduced in future, optional categories will be off by default, Accept and Reject will be equally easy, and a choice will be recorded with the policy version.

7. Managing your choices

Your browser lets you block or delete cookies and clear local storage. Blocking strictly necessary technologies may prevent you from signing in or completing a payment.

8. Providers and international transfers

Appendix A names each provider. Pennny's infrastructure is hosted in the European Union. Stripe Payments Europe (Ireland) sets the two payment cookies below; Stripe, Inc. (US) may receive data under Standard Contractual Clauses or the Data Privacy Framework. The Privacy Policy has more detail.

9. Retention

Each technology's duration is stated in Appendix A. Pennny does not describe a technology as session-based if it persists after the session ends. Personal data collected through a technology may have a different retention period from the technology itself; those periods are in the Privacy Policy.

10. Children

Pennny is intended for adults aged 18 and over and does not knowingly use optional technologies to profile children.

11. Security

Pennny applies measures appropriate to the risk, which may include encryption in transit and at rest, access restrictions, provider due diligence, event and access logging, retention controls, incident response and security testing.

12. Relationship with the Privacy Policy

This policy covers information stored on or read from your device. The Privacy Policy covers personal data categories, purposes, legal bases, connected inbox and bank information, financial data, AI processing, recipients, retention, transfers, security and your rights. Where a technology collects personal data, both apply.

13. Your privacy rights

Where information collected through these technologies is personal data, you may have the right to access, correct, delete, restrict, object, receive portable data, withdraw consent, and complain to a supervisory authority. Exercise them through [ACTION REQUIRED: privacy mailbox], or complain to the Autoriteit Persoonsgegevens.

14. Changes

Pennny may update this policy where technologies, providers, purposes, the application or legal requirements change. Where a change introduces an optional technology, Pennny will ask for consent before it is switched on. Pennny maintains policy-version records.

15. Contact

Pennny B.V. Privacy contact: [ACTION REQUIRED: privacy mailbox] Postal address: Sydneystraat 6, 1175 RN Lijnden, the Netherlands

---

Appendix A — Technology inventory

Technology	Provider	Category	Information stored	Purpose	Duration	Consent required	Location
Session cookie	Pennny	Strictly necessary	Session identifier	Keep you signed in securely	1 hour, renewed while you are active (never more than 12 hours in total)	No	EU
Session expiry companion cookie	Pennny	Strictly necessary	The session's expiry time (no secret)	Show how long your session has left	Same as the session cookie	No	EU
CSRF token	Pennny	Strictly necessary	Request-verification token	Prevent unauthorised transactions	Session	No	EU
__stripe_mid	Stripe Payments Europe (Ireland)	Strictly necessary, payment pages only	Device identifier	Fraud prevention while you set up or pay	1 year	No	EU, with transfer to Stripe, Inc. (US) under SCCs or the Data Privacy Framework
__stripe_sid	Stripe Payments Europe (Ireland)	Strictly necessary, payment pages only	Session identifier	Fraud prevention while you set up or pay	30 minutes	No	EU, with transfer to Stripe, Inc. (US) under SCCs or the Data Privacy Framework
Analytics	None	—	—	—	—	—	—

Stripe's scripts load only on pages where you set up or make a payment. No marketing or advertising technology is listed because Pennny ships none. A row must not be added here as a placeholder.